Minimum free disk space reached

[TaraPennington]

TaraPennington_0-1614015603527.png

I just got Splunk ingesting some data and now I'm getting this error message. I found several posts related to this but they are 6 years old and I think they are out of date. One of them said to go to the server.conf file and edit this stanza, but I don't see that stanza in the file. Is that stanza in another location? 

[diskUsage]
minFreeSpace = <num>

[TaraPennington]

Okay do I need to stop splunk on the forwarders then?

Also, the files that need to be deleted are on the splunk server? (single instance).

[gcusello]

Hi @TaraPennington,

The problem is a search problem so only on Indexer (your single instance).

Ciao.

Giuseppe

[gcusello]

Hi @TaraPennington,

The problem is that you reached the minimum disk space in the dispatched folder.

You have to delete the oldest folders and files in the folder $SPLUNK_HOME/var/run/splunk (after Splunk stop) and then restart Splunk.

Ciao.

Giuseppe