The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch

[mgaraventa_splu]

On our cluster master server, we saw the following message:

The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch

I've done some research on google and the value is set in server.conf.

Can you please advise what is the impact on changing this to a lower value, e.g. 2000MB?

How can we determine what is the best (lowest) value we can use without any impact on performance?

Should we consider updating this value on search heads, heavy forwarders, indexers?

Thanks.

[shockman]

I moved the dispatch dir to a location with more space. I assume this is a sort of search cache.
https://answers.splunk.com/answers/2205/can-i-change-the-path-of-the-dispatch-directory.html#answer-...

[mgaraventa_splu · Accepted solution]

Limits for controlling disk space in Splunk can be changed

The relevant stanza and parameter of interest in server.conf is:

[diskUsage]
minFreeSpace = <num>

For more details please look here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setlimitsondiskusage

This can be changed on any Splunk installations as explained on the online documentation: "for all installations, including forwarders, you must have a minimum of 5GB of hard disk space available in addition to the space required for any indexes." The default is 5000 and this value can be changed as explained before.

For more details, please check here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Installation/Systemrequirements#Recommended_hardwa...

Hope this helps.