Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- setting up indexer cluster
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
setting up indexer cluster
Hi,
I was trying to setup indexer cluster, but in the console its showing the replication factor and search factor or not met ?
got the below error in Splunkd.log
Eviction results: count=0, test_count=0, bytes_evicted=0, bytes_needed=5610983424, elapsed_ms=1
01-26-2019 07:43:28.260 +0000 WARN CacheManager - Unable to evict enough data. Evicted size=0 instead of size=5610983424
01-26-2019 07:43:29.261 +0000 INFO CacheManager - Eviction requested, bytes_needed=5610983424 partition of path=/opt/splunk/var/lib/splunk/audit/db
01-26-2019 07:43:29.261 +0000 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
This sounds like your error
https://answers.splunk.com/answers/620357/unable-to-search-getting-this-error-unable-to-evic.html
Check the things mentioned in this answer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to decrease the free min disk space please ? at this path = /opt/splunk/var/lib/splunk/audit/db
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI, this is set in server.conf
[diskUsage]
minFreeSpace = <num>
https://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setlimitsondiskusage
or via CLI
splunk set minfreemb <number>
splunk restart
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please accept the answer if it helped 🙂
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
