Archive

Minimum free disk space (1000MB) reached for /opt/splunk/var/run/dispatch

newtosplunk
Engager

I changed this setting to 500MB in Manager > System configurations > System settings > General settings but this is only a temporary fix.

I have splunk installed on a Debian version 5.x and the system is complaining that the minimum free disk space reached for /opt/splunk/var/run/splunk/dispatch.

Please advise on how I can fix this issue and what options do I have???

Tags (2)

Sriram
Communicator

i have the same problem in windows version of splunk of 6.1 and 6.2 with trial version. I know there is additional space in that folder. I even uninstalled and reinstalled splunk to same as well as different folders. I changed the system settings limit. Nothing works. Any help.

0 Karma

BrandSentiment
Explorer

have the same problem and cannot find a fix. Please can someone help. Many thanks

0 Karma

cuke
Engager

I have similar problem. Is this a common issue in Version 6?

0 Karma

saigop
New Member

My dispatch directory has only 104k but still i get the message as "Search not executed: The minimum free disk space (50000MB) reached for /opt/splunk/var/run/splunk/dispatch. user=admin" even though I configured my maxTotalDataSizeMB = 200000 in indexes.conf, in the GUI its showing as 50000 MB. Some one can please advice...

Thanks in Advance.

Regards

0 Karma

svenwendler
Path Finder

You can also move the directory to another location with more space and then create a symbolic link to that directory.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

/opt/splunk/var/run/splunk/dispatch/ contains the search artifacts, which are the results of your searches. You should go into the folder and remove the contents as you probably have many configured searches which are causing this folder to become full. This is going to be something you are going to have to watch for. Some jobs have a ttl, after which they'll be removed, but if you are running a lot of saved searches, this could be causing the dispatch folder to fill. If you remove the jobs in the folder, they'll just run again at the next scheduled time, so it shouldn't really cause you a problem to remove these artifacts.

lukejadamec
Super Champion

You make it sound like a dispatch folder is like a predictive summary index - next step while running sort of stuff. I guess the next phase is to integrate ease of the terrain and rest.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!