Can you help me get around the following error with my Splunkd health status on Docker Image?

[lewisj]

I get the following error before I even get to do anything with Splunk on docker 7.2.0.

Disk Space
Root Cause(s):
The diskspace remaining=3002 has breached the red threshold for filesystems=[/opt/splunk/var/lib/splunk/audit/db]
Last 50 related messages:

11-02-2018 23:49:19.457 +0000 ERROR DiskMon - Disk Monitor: The index processor has paused data flow. Current free disk space on partition '/opt/splunk/var' has fallen to 3002MB, below the minimum of 5000MB. Data writes to index path '/opt/splunk/var/lib/splunk/audit/db'cannot safely proceed. Increase free disk space on partition '/opt/splunk/var' by removing or relocating data.

Any ideas on how to get around this?

[renjith_nair]

@lewisj,

By default , minimum disk space required for splunk to run is 5000 MB(approx 5 GB). In your case, it looks like the partition '/opt/splunk/var' does not have enough disk space and hence halted. To get around this, you may add more disk to this partition or delete any unwanted files or move splunk to other partition where it has enough disk space. Other option (not so recommended) is to reduce the default disk space required from 5GB to lesser by changing below setting in server.conf

[diskUsage
minFreeSpace = <num>|<percentage>
* Minimum free space for a partition.

Reference : http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#Disk_usage_settings_.28for_the_i...