Monitoring Splunk

The index processor has paused data flow

rgarcia
Engager

After a hardware failure was resolved, I attempted to start splunk again...but I am now getting this error

"The index processor has paused data flow. Current free disk space on partition '/' has fallen to 158MB, below the minimum of 5000MB. Data writes to index path '/data1/splunk/indexes/audit/db'cannot safely proceed. Increase free disk space on partition '/' by removing or relocating data."

I understand what is saying, but the odd part is that partition "/" never had that much space and all other indexers are configured the same with no issues.

What am I missing here?

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Can it be so that your node hasn’t mount all FSs yet?

You should check what is your SPLUNK_DB path and then check that it’s present and it has enough space.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can it be so that your node hasn’t mount all FSs yet?

You should check what is your SPLUNK_DB path and then check that it’s present and it has enough space.

r. Ismo

0 Karma

rgarcia
Engager

You're right, mount points were missing. thank you

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...