Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Low in Disk Space. Indexing Has Been Paused.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Low in Disk Space. Indexing Has Been Paused.
I installed Splunk 4.1 on a machine (forwarder) and it is giving me a message that reads, "You are low in disk space. Indexing has been paused." I haven't added any data to Splunk yet. The machine is going to be a forwarder. Can I add data to Splunk and forward the data to the receiver despite the fact that indexing has been paused? What effects does it have on indexing or disk space? Am I able to forward the data to the receiver without using up disk space on the forwarder?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Clear saved searches below locations
"/opt/splunk/var/run/splunk/dispatch" and "/opt/splunk/var/lib/splunk/audit/db"
but it may loss previous searches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can get to this setting through Manager > System configurations > System settings > General settings.
The URL for the above page is http://yoursplunkserver:8000/en-US/manager/unix/server/settings/settings?action=edit
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Minimum free space is set either in the management UI or in the server.conf file, under [diskUsage], minFreeSpace=
Enabling as a forwarder (either kind) will decrease the default setting from 2000 MB to 100 MB, although you will still need to have that much free space available or forwarding will stop too.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I changed this setting to 500MB in Manager > System configurations > System settings > General settings but this is only a temporary fix.
I have splunk installed on a Debian version 5.x and the system is complaining that the minimum free disk space reached for /opt/splunk/var/run/splunk/dispatch.
Please advise on how I can fix this issue and what options do I have???
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are going to need to increase the disk space somehow. Splunk usually wants 2G free to do it's work (but this may be tunable). No indexing will take place until this is resolved.
[edit]
Ahh, this is a forwarder. Splunk will use a little space on the forwarder to keep track of known files, positions, etc, so it will need to have some headroom - but not a lot.
As long as this forwarder is not indexing as well (did you make it a forwarder?) then you should be OK to send data to an indexer
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
