rotate input data

[spowell]

Hello,

It looks like I'm running out of space on my splunk server. Here is the error that I received when running a search.

The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch. The search was not run.

What config file options do I need to change so that older data is cleared out so that this doesn't continue to happen?

I am running 4.1.6 on Debian 5.

Thanks,

Steven

[ftk]

Retention periods are set on a per index basis in indexes.conf.

See http://www.splunk.com/base/Documentation/latest/Admin/Setaretirementandarchivingpolicy for a discussion of all the possible settings.