The disk usage is at 17% and inode usage is at 1%. The error message from Splunk Web says minFreeSpace is 5000 and free space is 85711:
03-03-2020 16:16:48.266 +0000 WARN DiskMon - MinFreeSpace=5000. The diskspace remaining=85711 is less than 2 x minFreeSpace
This could be from your index max size ? Not sure though, very new to splunk but that would make sense.
This could be from your index max size ? Not sure though, very new to splunk but that would make sense.
check your indexes.conf & server.conf for data roll
Check this formula
LocalDiskSpace = minFreeSpace + (maxHotBuckets * maxDataSize) + (maxWarmDBCount * maxDataSize)
Refer below-mentioned link for more details
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Configureindexstorage
https://www.splunk.com/en_us/blog/tips-and-tricks/managing-index-sizes-in-splunk.html