minimum free disk space reached fix without changing value

[eafitt]

I have the warning "The minimum free disk space reached for C:\Program files\splunk\var\run\splunk\dispatch" I did some research on splunk about how to fix this warning, but I didn't see a resolution without changing the value in system settings. Is there away to delete older logs? Or something in C:\Program files\splunk\var\run\splunk\dispatch I can delete?

We have an enterprise trial license and still testing Splunk but this is hard to do with this warning.

[lguinn2 · Accepted solution]

C:\Program files\splunk\var\run\splunk\dispatch is where search results are stored. So you can delete things from that directory, but there are other things that you could and should do:

Logged in as the Splunk Admin, go to the Jobs manager (upper right of the window). Here you can see the saved search results, and the amount of disk space that is being taken by each. If you delete some (or all) of these, you will be recovering space in C:\Program files\splunk\var\run\splunk\dispatch

Also, for each of the roles (User, Power User), you can set the Limit total jobs disk quota. This controls the amount of disk space that each user can consume for searches and saved search results. You can reduce this amount to prevent the problem from recurring.

However, I would take a look at the searches in Jobs manager - how much disk space is being used? Do you have enough? Perhaps your testing environment needs a little more disk space. You need disk for running searches as well as for storing the index.

[eafitt]

thank you for your help

[prasadjvv522]

i am using splunk free version.
How to fix this space issue.

Thanks in advance