Archive

The index processor has paused data flow

Engager

The index processor has paused data flow. Current free disk space on partition '/' has fallen to 4665MB, below the minimum of 5000MB. Data writes to index path '/opt/splunk/var/lib/splunk/audit/db'cannot safely proceed. Increase free disk space on partition '/' by removing or relocating data

Tags (1)
0 Karma

Explorer

Hi

Is it possible the system do rotation to data older that specified X time ?

 

0 Karma

Champion
Just define shorter retention time for indexes. But usually this is not an option. Basically you must add more space to your system.
In best practices you should start to use volumes which automatically freeze old data and make new space available on your index storages.
https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Configureindexstoragesize
r. Ismo
0 Karma

Splunk Employee
Splunk Employee

Your storage has less than 5GB available. Splunk will pause indexing until more storage is available.

Alternatively, you can change the minmum free disk space required by going to https://localhost:8000/en-US/manager/launcher/server/settings/settings?action=edit OR editing server.conf

[diskUsage]
minFreeSpace = <num>|<percentage>
# default = 5000MB (5GB)

This is not recommended however. Just free up some space, and Splunk will continue indexing.

0 Karma

SplunkTrust
SplunkTrust

This message is fairly self-explanatory...

What's your question?

0 Karma