Deployment Architecture

How to fix Splunk search head pool "Error in dispatch process. Failed to create directory /data/var/run/dispatch/xyz"?

pdash
Path Finder

Error in search head pooling validate-quiet: Failed to create test file: /data/etc/users/testpath: Disk quota exceeded
There was an error validating your search head pooling configuration. For more information, run 'splunk pooling validate'
Error fixing dangling data: Failed to lock /data/etc/apps/sentinel.txt with code -1, possible reason: No such file or directory
There was an error preparing your conf files for search head pooling. For more information, run 'splunk btool find-dangling'.

This is the error am getting when i restart my search head and it doesnt allow me to to search once it started "Error in dispatch process. Failed to create directory /data/var/run/dispatch/xyz"

0 Karma

jmheaton
Path Finder

Assuming your using pooling, then i would verify that all of your servers in the pool are running with the correct permissions. This had happened to us a couple months ago when we spun up a new search head and it was running as a user that didn't have permissions to read and write all the files in the pool.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...