The index processor has paused data flow

[ajangiti123]

The index processor has paused data flow. Current free disk space on partition '/' has fallen to 4665MB, below the minimum of 5000MB. Data writes to index path '/opt/splunk/var/lib/splunk/audit/db'cannot safely proceed. Increase free disk space on partition '/' by removing or relocating data

[ac89live]

Hi

Is it possible the system do rotation to data older that specified X time ?

[isoutamo]

Just define shorter retention time for indexes. But usually this is not an option. Basically you must add more space to your system.
In best practices you should start to use volumes which automatically freeze old data and make new space available on your index storages.
https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Configureindexstoragesize
r. Ismo

[sduff_splunk]

Your storage has less than 5GB available. Splunk will pause indexing until more storage is available.

Alternatively, you can change the minmum free disk space required by going to https://localhost:8000/en-US/manager/launcher/server/settings/settings?action=edit OR editing server.conf

[diskUsage]
minFreeSpace = <num>|<percentage>
# default = 5000MB (5GB)

This is not recommended however. Just free up some space, and Splunk will continue indexing.

[nplamondon]

This message is fairly self-explanatory...

What's your question?