Splunk App for VMware: "The minimum free disk space (5000MB) reached for /home/splunkadmin/opt/splunk/var/run/splunk/dispatch"

[radhikamh]

Hello,

I have deployed Splunk app for vmware appliance. I get this message while searching -

Search not executed: The minimum free disk space (5000MB) reached for /home/splunkadmin/opt/splunk/var/run/splunk/dispatch. user=admin.

I did see there were some messages posted on this behavior, just want to confirm what is the solution for vapp appliance.
I really appreciate any help.

Thanks,
Radhika

[esix_splunk]

Are you getting this on the DCN, or Search Head?

If you are getting this on the SH, you need to check your FS and make sure you have enough free space. By default, 5gb is the minimum space required for for Splunk to index and dispatch/run jobs. You can tune this in $splunk_home$/etc/system/local/server.conf

[diskUsage]
minFreeSpace = 4000

This value is in mb.

But you should be careful, less then 5gb free on a production box isnt ideal...

[radhikamh]

Hi,

Splunk vmware app is acting as a data collection node. I have allocated 20GB space, atleast 18GB is still free/unused.

Thanks,
Radhika