Installation

The index processor has paused data flow

ajangiti123
Engager

The index processor has paused data flow. Current free disk space on partition '/' has fallen to 4665MB, below the minimum of 5000MB. Data writes to index path '/opt/splunk/var/lib/splunk/audit/db'cannot safely proceed. Increase free disk space on partition '/' by removing or relocating data

Tags (1)
0 Karma

ac89live
Explorer

Hi

Is it possible the system do rotation to data older that specified X time ?

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Just define shorter retention time for indexes. But usually this is not an option. Basically you must add more space to your system.
In best practices you should start to use volumes which automatically freeze old data and make new space available on your index storages.
https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Configureindexstoragesize
r. Ismo
0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Your storage has less than 5GB available. Splunk will pause indexing until more storage is available.

Alternatively, you can change the minmum free disk space required by going to https://localhost:8000/en-US/manager/launcher/server/settings/settings?action=edit OR editing server.conf

[diskUsage]
minFreeSpace = <num>|<percentage>
# default = 5000MB (5GB)

This is not recommended however. Just free up some space, and Splunk will continue indexing.

0 Karma

nplamondon
SplunkTrust
SplunkTrust

This message is fairly self-explanatory...

What's your question?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...