Monitoring Splunk

The minimum free disk space (2000MB) reached regarding Data Forwarding

syusjk6
Engager

Hi, the following message came up on Splunk UI when forwarding data:
The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch.

This message occurred when I did some data forwarding with host IP along with autotomatic load balancing.
I have been looking for related FAQs regarding this issue, but it seems that none fits.
And I want to know what kinds of situation the message comes up and how I can resolve this issue.

Any thought?

Tags (1)
0 Karma

cyue_splunk
Splunk Employee
Splunk Employee

In $SPLUNK_HOME/etc/system/default/limits.conf, you can find
dispatch_dir_warning_size = 2000

If you don't want the warning message to come up, you can reduce the 2000 to a smaller one, such as 1000.

But I'll suggest you check your /opt/splunk/var/run/splunk/dispatch free spaces, if it's too low, it'll impact your searching performance.

syusjk6
Engager

Thanks. It helped.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...