Getting Data In

How to remove and prevent error "minimum free disk space (5000MB) reached for /var/run/splunk/dispatch" on my heavy forwarder?

Contributor

I keep getting the "minimum free disk space (5000MB) reached for /var/run/splunk/dispatch" on one of my heavy forwarders. There are no jobs that I can see in the job manager. Not sure where to go from this point. Should I just delete all of the search artifacts in the directory since it is a forwarder?

0 Karma
1 Solution

Champion

If you have a small data partition allocated for Splunk on that host, you can reduce the minimum free space required by Splunk to continue running. Set the minFreeSpace stanza in server.conf:

http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setlimitsondiskusage

View solution in original post

0 Karma

Champion

If you have a small data partition allocated for Splunk on that host, you can reduce the minimum free space required by Splunk to continue running. Set the minFreeSpace stanza in server.conf:

http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setlimitsondiskusage

View solution in original post

0 Karma

Contributor

what is the root cause of this issues?

I can go from the default of 5000 "5gb" to 10000 (10gb) sure that's fine however, whats to stop this error from happening again?

 [diskUsage]
 minFreeSpace = 10000
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!