I just got Splunk ingesting some data and now I'm getting this error message. I found several posts related to this but they are 6 years old and I think they are out of date. One of them said to go to the server.conf file and edit this stanza, but I don't see that stanza in the file. Is that stanza in another location?
[diskUsage] minFreeSpace = <num>
Okay do I need to stop splunk on the forwarders then?
Also, the files that need to be deleted are on the splunk server? (single instance).
Hi @TaraPennington,
The problem is a search problem so only on Indexer (your single instance).
Ciao.
Giuseppe
Hi @TaraPennington,
The problem is that you reached the minimum disk space in the dispatched folder.
You have to delete the oldest folders and files in the folder $SPLUNK_HOME/var/run/splunk (after Splunk stop) and then restart Splunk.
Ciao.
Giuseppe