Hi, the following message came up on Splunk UI when forwarding data:
The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch.
This message occurred when I did some data forwarding with host IP along with autotomatic load balancing.
I have been looking for related FAQs regarding this issue, but it seems that none fits.
And I want to know what kinds of situation the message comes up and how I can resolve this issue.
Any thought?
In $SPLUNK_HOME/etc/system/default/limits.conf, you can find
dispatch_dir_warning_size = 2000
If you don't want the warning message to come up, you can reduce the 2000 to a smaller one, such as 1000.
But I'll suggest you check your /opt/splunk/var/run/splunk/dispatch free spaces, if it's too low, it'll impact your searching performance.
Thanks. It helped.