Monitoring Splunk

How to fix a disk space warning for /opt/splunk/var/lib/splunk/audit/db

Glasses
Builder
The diskspace remaining=8376 has breached the yellow threshold for filesystems=[/opt/splunk/var/lib/splunk/audit/db]
06-18-2019 14:30:39.377 -0500 WARN DiskMon - MinFreeSpace=5000. The diskspace remaining=8376 is less than 2 x minFreeSpace

In the .../audit dir only db has data, nothing in colddb etc...

I am not sending them to a frozen path, I was hoping they would roll...

How do I set this to roll or drop after it reaches 2GB?

Labels (1)
Tags (3)
0 Karma
1 Solution

martynoconnor
Communicator

If you would rather roll data out by time or space limit, that's something for indexes.conf and you can see how to do that here:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Configureindexstorage

View solution in original post

0 Karma

martynoconnor
Communicator

If you would rather roll data out by time or space limit, that's something for indexes.conf and you can see how to do that here:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Configureindexstorage

0 Karma

Glasses
Builder

thanks, cannot believe I did not think of that...

0 Karma

martynoconnor
Communicator

No worries. 🙂

0 Karma

martynoconnor
Communicator

Hi there,

You can change the value of the free disk space that triggers the warning in limits.conf - see the docs link below:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Setlimitsondiskusage#Set_minimum_free_dis...

Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...