How to remove and prevent error "minimum free disk space (5000MB) reached for /var/run/splunk/dispatch" on my heavy forwarder?

[sbattista09]

I keep getting the "minimum free disk space (5000MB) reached for /var/run/splunk/dispatch" on one of my heavy forwarders. There are no jobs that I can see in the job manager. Not sure where to go from this point. Should I just delete all of the search artifacts in the directory since it is a forwarder?

[the_wolverine · Accepted solution]

If you have a small data partition allocated for Splunk on that host, you can reduce the minimum free space required by Splunk to continue running. Set the minFreeSpace stanza in server.conf:

http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setlimitsondiskusage

[sbattista09]

what is the root cause of this issues?

I can go from the default of 5000 "5gb" to 10000 (10gb) sure that's fine however, whats to stop this error from happening again?

 [diskUsage]
 minFreeSpace = 10000