Splunk Disk Reporting Incorrect

[trevor_dunstan8]

Hi all,

I am running a Splunk 7.3.0 distributed / clustered environment and I have noticed that the DMC is reporting that disk usage on my indexers is high ie around the 85% mark, however Windows Server 2016 says that it is around 65% as per attached screenshot. Its mainly the F drive as far as I can tell.

Disk usage was high previously however I then implemented retention policies on the indexes which cleared out a large amount of data, is it possible the DMC is caching an old value and is not updating ? I have restarted the Cluster master node and we have rebooted the index cluster since then I believe.

Any info would be great,

Thanks 

[trevor_dunstan8]

I thought that the Indexing cluster had been restarted but obviously not, storage figures reported correctly in DMC after cluster restart

[isoutamo]

At lest in linux version you must restart splunk after you have added/increased FS/LVM/Disks. Without restart REST queries didn't show those correctly.
r. Ismo

[trevor_dunstan8]

We haven't extended the disks on the servers so that solution doesn't apply to us.