Monitoring Splunk

disk space error

s_unny
Loves-to-Learn Lots

The diskspace remaining=6235 has breached the yellow threshold for filesystems=['C:\Program Files\Splunk\var\lib\splunk\_introspection\db' 'C:\Program Files\Splunk\var\lib\splunk\_internaldb\db' 'C:\Program Files\Splunk\var\lib\splunk\audit\db' 'C:\Program Files\Splunk\var\lib\splunk\_configtracker\db' 'C:\Program Files\Splunk\var\lib\splunk\audit\colddb' 'C:\Program Files\Splunk\var\lib\splunk\_metrics\db' 'C:\Program Files\Splunk\var\lib\splunk\_configtracker\colddb']

 

Hi, I am new to Splunk, I am using Splunk enterprise on my laptop, and I have been getting this error about disk space, please help me to solve it 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @s_unny ,

as also @isoutamo said, you don't have enough disk space on your desktop.

I hint to reduce the retention time of your indexes, starting from _internal and the most large indexes.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

if I understood right you issue, you have used too much of SPLUNK_DB space on your system. There are many instructions  on net, how to move/change SPLUNK_DB into another Drive on Windows which you need to do. Another option is limit your disk space to lower, but probably this will denied to collect enough events to your system.

Another option is ask some local Splunk Partner to fix this for you.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...