Monitoring Splunk

Can you help me get around the following error with my Splunkd health status on Docker Image?

lewisj
New Member

I get the following error before I even get to do anything with Splunk on docker 7.2.0.

Disk Space
Root Cause(s):
The diskspace remaining=3002 has breached the red threshold for filesystems=[/opt/splunk/var/lib/splunk/audit/db]
Last 50 related messages:

11-02-2018 23:49:19.457 +0000 ERROR DiskMon - Disk Monitor: The index processor has paused data flow. Current free disk space on partition '/opt/splunk/var' has fallen to 3002MB, below the minimum of 5000MB. Data writes to index path '/opt/splunk/var/lib/splunk/audit/db'cannot safely proceed. Increase free disk space on partition '/opt/splunk/var' by removing or relocating data.

Any ideas on how to get around this?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@lewisj,

By default , minimum disk space required for splunk to run is 5000 MB(approx 5 GB). In your case, it looks like the partition '/opt/splunk/var' does not have enough disk space and hence halted. To get around this, you may add more disk to this partition or delete any unwanted files or move splunk to other partition where it has enough disk space. Other option (not so recommended) is to reduce the default disk space required from 5GB to lesser by changing below setting in server.conf

[diskUsage
minFreeSpace = <num>|<percentage>
* Minimum free space for a partition.

Reference : http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#Disk_usage_settings_.28for_the_i...

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...