Deployment Architecture

How to fix Splunk search head pool "Error in dispatch process. Failed to create directory /data/var/run/dispatch/xyz"?

pdash
Path Finder

Error in search head pooling validate-quiet: Failed to create test file: /data/etc/users/testpath: Disk quota exceeded
There was an error validating your search head pooling configuration. For more information, run 'splunk pooling validate'
Error fixing dangling data: Failed to lock /data/etc/apps/sentinel.txt with code -1, possible reason: No such file or directory
There was an error preparing your conf files for search head pooling. For more information, run 'splunk btool find-dangling'.

This is the error am getting when i restart my search head and it doesnt allow me to to search once it started "Error in dispatch process. Failed to create directory /data/var/run/dispatch/xyz"

0 Karma

jmheaton
Path Finder

Assuming your using pooling, then i would verify that all of your servers in the pool are running with the correct permissions. This had happened to us a couple months ago when we spun up a new search head and it was running as a user that didn't have permissions to read and write all the files in the pool.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...