- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Re: Minimum Free Disk Space for Splunk Universal F...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Minimum Free Disk Space for Splunk Universal Forwarder
In Splunk Enterprise, the minimum free disk space (5000MB) is needed. For Splunk Universal Forwarder, what is the minimum free disk space?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please refer below link
https://answers.splunk.com/answers/172716/minimum-disk-space-for-splunk-6x-universal-forward.html
And note: Disable kv-store on your forwarders (if it is heavy forwarder) to avoid additional storage impacts.
https://answers.splunk.com/answers/336932/how-to-disable-kvstore-on-a-heavy-forwarder.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also It all depends on how much you are forwarding. If it is in GBs, you don't need 5GB. But just be safe and go with defaults.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi nareshinsvu, so what's the default minimum free disk space for UF? is it 5GB? I had check the link you provided, but there is no solid number that they provided.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, it is mentioned as 5GB
Maintain a minimum of 5GB of free hard disk space on any Splunk Enterprise instance, including forwarders, in addition to the space required for any indexes. See Estimate your storage requirements in Capacity Planning for a procedure on how to estimate the space you need. Failure to maintain this level of free space can degrade performance and cause operating system failure and data loss.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hope it helped? Kindly accept and/or upvote my response
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
