Is there a configuration value I can change to reduce the indexing size threshold?

[alekksi]

Hi all,

We have an indexer on our test environment that is complaining with the following error message:

Search peer splunk-indexer has the following message: You are low in disk space on partition "/location/to/splunk/var/lib/splunk/_internaldb/db". Indexing has been paused. Will resume when free disk space rises above 5000MB.

While I appreciate that we could increase the size, this is our test environment, so it's not so much of a hassle if we only have limited space on here. As it is, instead of having the required 5000MB free, we have 4750MB free and the indexer has given up.

Is there a config value I can change to reduce the threshold for this?

Best regards,
Alex

[alacercogitatus]

You can add this to your local/server.conf file.

[diskUsage]
minFreeSpace = <num>

Replace `with the number ofMB` that you want to have the threshold set as.

Ref: http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Serverconf?r=docsinline

[richgalloway · Accepted solution]

I believe you want to adjust the minFreeSpace setting in the diskUsage stanza of SPLUNK_HOME/etc/system/local/server.conf.

[alekksi]

That's the one, couldn't find it for the life of me. Cheers!! 🙂