I am getting the below error message on a new Indexer that I recently added to a cluster (which previously had 2 Indexers)
Search peer NEW_INDEXER has the following message: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch.
Checking disk space on this Indexer, it seems its already filled to 24Gb, whereas, on old Indexers, one is 12GB and other has used 14 GB.
Why is there so much difference in disk space used for this directory between all Indexers ?
Also, please advise how this can be fixed. (other than just extending the directory space, which I had already requested storage team to increase)
You can remove this message bu updating the settings
Goto : Settings>Server settings > General settings
Reduce - Pause indexing if free disk space (in MB) falls below from 5000 to 500.
Please note this is just a configuration which changes the setting to generate the message when the disk space falls below 500MB insted of 5GB(your current setting)
As to why your disk space on the new indexer is taking this amount of space, would need a detailed investigation of your confs.If environment is clustered - can you perform 1 check
On the cluster master . Goto
Settings > Indexer Clustering > Indexes > Bucket StatusCheck if there is anything under Indexes with Excess Buckets