Monitoring Splunk

disk space error

s_unny
Loves-to-Learn Lots

The diskspace remaining=6235 has breached the yellow threshold for filesystems=['C:\Program Files\Splunk\var\lib\splunk\_introspection\db' 'C:\Program Files\Splunk\var\lib\splunk\_internaldb\db' 'C:\Program Files\Splunk\var\lib\splunk\audit\db' 'C:\Program Files\Splunk\var\lib\splunk\_configtracker\db' 'C:\Program Files\Splunk\var\lib\splunk\audit\colddb' 'C:\Program Files\Splunk\var\lib\splunk\_metrics\db' 'C:\Program Files\Splunk\var\lib\splunk\_configtracker\colddb']

 

Hi, I am new to Splunk, I am using Splunk enterprise on my laptop, and I have been getting this error about disk space, please help me to solve it 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @s_unny ,

as also @isoutamo said, you don't have enough disk space on your desktop.

I hint to reduce the retention time of your indexes, starting from _internal and the most large indexes.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if I understood right you issue, you have used too much of SPLUNK_DB space on your system. There are many instructions  on net, how to move/change SPLUNK_DB into another Drive on Windows which you need to do. Another option is limit your disk space to lower, but probably this will denied to collect enough events to your system.

Another option is ask some local Splunk Partner to fix this for you.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...