Monitoring Splunk

disk space error

s_unny
Loves-to-Learn Lots

The diskspace remaining=6235 has breached the yellow threshold for filesystems=['C:\Program Files\Splunk\var\lib\splunk\_introspection\db' 'C:\Program Files\Splunk\var\lib\splunk\_internaldb\db' 'C:\Program Files\Splunk\var\lib\splunk\audit\db' 'C:\Program Files\Splunk\var\lib\splunk\_configtracker\db' 'C:\Program Files\Splunk\var\lib\splunk\audit\colddb' 'C:\Program Files\Splunk\var\lib\splunk\_metrics\db' 'C:\Program Files\Splunk\var\lib\splunk\_configtracker\colddb']

 

Hi, I am new to Splunk, I am using Splunk enterprise on my laptop, and I have been getting this error about disk space, please help me to solve it 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @s_unny ,

as also @isoutamo said, you don't have enough disk space on your desktop.

I hint to reduce the retention time of your indexes, starting from _internal and the most large indexes.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if I understood right you issue, you have used too much of SPLUNK_DB space on your system. There are many instructions  on net, how to move/change SPLUNK_DB into another Drive on Windows which you need to do. Another option is limit your disk space to lower, but probably this will denied to collect enough events to your system.

Another option is ask some local Splunk Partner to fix this for you.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...