The index processor has paused data flow. Current free disk space on partition '/' has fallen to 4665MB, below the minimum of 5000MB. Data writes to index path '/opt/splunk/var/lib/splunk/audit/db'cannot safely proceed. Increase free disk space on partition '/' by removing or relocating data
Your storage has less than 5GB available. Splunk will pause indexing until more storage is available.
Alternatively, you can change the minmum free disk space required by going to https://localhost:8000/en-US/manager/launcher/server/settings/settings?action=edit OR editing server.conf
[diskUsage] minFreeSpace = <num>|<percentage> # default = 5000MB (5GB)
This is not recommended however. Just free up some space, and Splunk will continue indexing.