Monitoring Splunk
Highlighted

Disk Space Error

Contributor

Hi

I'm getting this error

You are low in disk space on partition C:\Program Files\Splunk\var\lib\splunk\audit\db. Indexing has been paused. Will resume when free disk space rises above 5000MB.

How can i change the drive as can not increase the space in my C Drive.I have space in my other drives.

Any Suggestions are Appreciated,

Cheers.

Tags (3)
0 Karma
Highlighted

Re: Disk Space Error

SplunkTrust
SplunkTrust

Hi harshavrath,

well, you have installed Splunk on the C: drive and you're using the C: drive as well for your indexes. Read about the indexes.conf how to change the homePath for your indexes.

To move your existing data to another location proceed like this:

  1. stop Splunk
  2. change the homePath in indexes.conf
  3. move all existing data from old homePath (in your case C:\Program Files\Splunk\var\lib\splunk) to new homePath
  4. start Splunk

hope this helps ...

cheers, MuS

View solution in original post

Highlighted

Re: Disk Space Error

Contributor

Hi MuS

Can i directly change the path to f drive instead of c drive under the Splunk UI
Settings>System Settings>General Settings>Index Settings(Path to Indexes)

0 Karma
Highlighted

Re: Disk Space Error

SplunkTrust
SplunkTrust

Yes, this will change the setting globally for all indexes. But you still have to move the files from 'old path' to 'new path' while Splunk is not running.

Highlighted

Re: Disk Space Error

Builder

how to do it in a cluster .... how to stop and move .... Can we delete the _internal data instead and change the homepath so that the new data goes to the new path

0 Karma
Highlighted

Re: Disk Space Error

Contributor

if i stop splunk how will i use the UI.?
As i require the UI to specify the new path under
Settings>System Settings>General Settings>Index Settings(Path to Indexes)

0 Karma
Highlighted

Re: Disk Space Error

SplunkTrust
SplunkTrust

okay, you can restart Splunk from the UI as well since you don't want to keep the old data. Just in case you want/need to keep the old indexes, change the setting in the UI but don't restart yet. do a 'net stop splunkd', move data and do a 'net start'. You can stop/start Splunkweb, but this is not mandatory for this action.

Highlighted

Re: Disk Space Error

Contributor

Thanks this worked now its showing Events Indexed:163,153

0 Karma
Highlighted

Re: Disk Space Error

Contributor

I'm getting a new Error
The minimum free disk space (5000MB) reached for
(C:\Program Files\Splunk\var\run\splunk\dispatch)

0 Karma
Highlighted

Re: Disk Space Error

SplunkTrust
SplunkTrust

seams your C: drive is pretty tight on space, try to clean up to gain disk space and lower the disk space alert for splunk in server.conf minFreeSpace option or in the UI > settings > general settings > 'Pause indexing if disk space ...'