rotate input data - Splunk Community

Monitoring Splunk

Hello,

It looks like I'm running out of space on my splunk server. Here is the error that I received when running a search.

The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch. The search was not run.

What config file options do I need to change so that older data is cleared out so that this doesn't continue to happen?

I am running 4.1.6 on Debian 5.

Thanks,

Steven

Retention periods are set on a per index basis in indexes.conf.

See http://www.splunk.com/base/Documentation/latest/Admin/Setaretirementandarchivingpolicy for a discussion of all the possible settings.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...