Monitoring Splunk

The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch

mgaraventa_splu
Splunk Employee
Splunk Employee

On our cluster master server, we saw the following message:

The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch

I've done some research on google and the value is set in server.conf.

Can you please advise what is the impact on changing this to a lower value, e.g. 2000MB?

How can we determine what is the best (lowest) value we can use without any impact on performance?

Should we consider updating this value on search heads, heavy forwarders, indexers?

Thanks.

1 Solution

mgaraventa_splu
Splunk Employee
Splunk Employee

Limits for controlling disk space in Splunk can be changed

The relevant stanza and parameter of interest in server.conf is:

[diskUsage]
minFreeSpace = <num>

For more details please look here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setlimitsondiskusage

This can be changed on any Splunk installations as explained on the online documentation: "for all installations, including forwarders, you must have a minimum of 5GB of hard disk space available in addition to the space required for any indexes." The default is 5000 and this value can be changed as explained before.

For more details, please check here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Installation/Systemrequirements#Recommended_hardwa...

Hope this helps.

View solution in original post

shockman
Engager

I moved the dispatch dir to a location with more space. I assume this is a sort of search cache.
https://answers.splunk.com/answers/2205/can-i-change-the-path-of-the-dispatch-directory.html#answer-...

mgaraventa_splu
Splunk Employee
Splunk Employee

Limits for controlling disk space in Splunk can be changed

The relevant stanza and parameter of interest in server.conf is:

[diskUsage]
minFreeSpace = <num>

For more details please look here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setlimitsondiskusage

This can be changed on any Splunk installations as explained on the online documentation: "for all installations, including forwarders, you must have a minimum of 5GB of hard disk space available in addition to the space required for any indexes." The default is 5000 and this value can be changed as explained before.

For more details, please check here:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Installation/Systemrequirements#Recommended_hardwa...

Hope this helps.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...