Monitoring Splunk

minimum free disk space reached fix without changing value

eafitt
Path Finder

I have the warning "The minimum free disk space reached for C:\Program files\splunk\var\run\splunk\dispatch" I did some research on splunk about how to fix this warning, but I didn't see a resolution without changing the value in system settings. Is there away to delete older logs? Or something in C:\Program files\splunk\var\run\splunk\dispatch I can delete?

We have an enterprise trial license and still testing Splunk but this is hard to do with this warning.

Tags (1)
1 Solution

lguinn2
Legend

C:\Program files\splunk\var\run\splunk\dispatch is where search results are stored. So you can delete things from that directory, but there are other things that you could and should do:

Logged in as the Splunk Admin, go to the Jobs manager (upper right of the window). Here you can see the saved search results, and the amount of disk space that is being taken by each. If you delete some (or all) of these, you will be recovering space in C:\Program files\splunk\var\run\splunk\dispatch

Also, for each of the roles (User, Power User), you can set the Limit total jobs disk quota. This controls the amount of disk space that each user can consume for searches and saved search results. You can reduce this amount to prevent the problem from recurring.

However, I would take a look at the searches in Jobs manager - how much disk space is being used? Do you have enough? Perhaps your testing environment needs a little more disk space. You need disk for running searches as well as for storing the index.

View solution in original post

lguinn2
Legend

C:\Program files\splunk\var\run\splunk\dispatch is where search results are stored. So you can delete things from that directory, but there are other things that you could and should do:

Logged in as the Splunk Admin, go to the Jobs manager (upper right of the window). Here you can see the saved search results, and the amount of disk space that is being taken by each. If you delete some (or all) of these, you will be recovering space in C:\Program files\splunk\var\run\splunk\dispatch

Also, for each of the roles (User, Power User), you can set the Limit total jobs disk quota. This controls the amount of disk space that each user can consume for searches and saved search results. You can reduce this amount to prevent the problem from recurring.

However, I would take a look at the searches in Jobs manager - how much disk space is being used? Do you have enough? Perhaps your testing environment needs a little more disk space. You need disk for running searches as well as for storing the index.

eafitt
Path Finder

thank you for your help

0 Karma

prasadjvv522
Explorer

i am using splunk free version.
How to fix this space issue.

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...