Monitoring Splunk

minimum free disk space reached fix without changing value

eafitt
Path Finder

I have the warning "The minimum free disk space reached for C:\Program files\splunk\var\run\splunk\dispatch" I did some research on splunk about how to fix this warning, but I didn't see a resolution without changing the value in system settings. Is there away to delete older logs? Or something in C:\Program files\splunk\var\run\splunk\dispatch I can delete?

We have an enterprise trial license and still testing Splunk but this is hard to do with this warning.

Tags (1)
1 Solution

lguinn2
Legend

C:\Program files\splunk\var\run\splunk\dispatch is where search results are stored. So you can delete things from that directory, but there are other things that you could and should do:

Logged in as the Splunk Admin, go to the Jobs manager (upper right of the window). Here you can see the saved search results, and the amount of disk space that is being taken by each. If you delete some (or all) of these, you will be recovering space in C:\Program files\splunk\var\run\splunk\dispatch

Also, for each of the roles (User, Power User), you can set the Limit total jobs disk quota. This controls the amount of disk space that each user can consume for searches and saved search results. You can reduce this amount to prevent the problem from recurring.

However, I would take a look at the searches in Jobs manager - how much disk space is being used? Do you have enough? Perhaps your testing environment needs a little more disk space. You need disk for running searches as well as for storing the index.

View solution in original post

lguinn2
Legend

C:\Program files\splunk\var\run\splunk\dispatch is where search results are stored. So you can delete things from that directory, but there are other things that you could and should do:

Logged in as the Splunk Admin, go to the Jobs manager (upper right of the window). Here you can see the saved search results, and the amount of disk space that is being taken by each. If you delete some (or all) of these, you will be recovering space in C:\Program files\splunk\var\run\splunk\dispatch

Also, for each of the roles (User, Power User), you can set the Limit total jobs disk quota. This controls the amount of disk space that each user can consume for searches and saved search results. You can reduce this amount to prevent the problem from recurring.

However, I would take a look at the searches in Jobs manager - how much disk space is being used? Do you have enough? Perhaps your testing environment needs a little more disk space. You need disk for running searches as well as for storing the index.

eafitt
Path Finder

thank you for your help

0 Karma

prasadjvv522
Explorer

i am using splunk free version.
How to fix this space issue.

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...