Minimum free disk space (1000MB) reached for /opt/splunk/var/run/dispatch


I changed this setting to 500MB in Manager > System configurations > System settings > General settings but this is only a temporary fix.

I have splunk installed on a Debian version 5.x and the system is complaining that the minimum free disk space reached for /opt/splunk/var/run/splunk/dispatch.

Please advise on how I can fix this issue and what options do I have???

Tags (2)


i have the same problem in windows version of splunk of 6.1 and 6.2 with trial version. I know there is additional space in that folder. I even uninstalled and reinstalled splunk to same as well as different folders. I changed the system settings limit. Nothing works. Any help.

0 Karma


have the same problem and cannot find a fix. Please can someone help. Many thanks

0 Karma


I have similar problem. Is this a common issue in Version 6?

0 Karma

New Member

My dispatch directory has only 104k but still i get the message as "Search not executed: The minimum free disk space (50000MB) reached for /opt/splunk/var/run/splunk/dispatch. user=admin" even though I configured my maxTotalDataSizeMB = 200000 in indexes.conf, in the GUI its showing as 50000 MB. Some one can please advice...

Thanks in Advance.


0 Karma

Path Finder

You can also move the directory to another location with more space and then create a symbolic link to that directory.

0 Karma

Splunk Employee
Splunk Employee

/opt/splunk/var/run/splunk/dispatch/ contains the search artifacts, which are the results of your searches. You should go into the folder and remove the contents as you probably have many configured searches which are causing this folder to become full. This is going to be something you are going to have to watch for. Some jobs have a ttl, after which they'll be removed, but if you are running a lot of saved searches, this could be causing the dispatch folder to fill. If you remove the jobs in the folder, they'll just run again at the next scheduled time, so it shouldn't really cause you a problem to remove these artifacts.

Super Champion

You make it sound like a dispatch folder is like a predictive summary index - next step while running sort of stuff. I guess the next phase is to integrate ease of the terrain and rest.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...