Monitoring Splunk

rotate input data

New Member


It looks like I'm running out of space on my splunk server. Here is the error that I received when running a search.

The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch. The search was not run.

What config file options do I need to change so that older data is cleared out so that this doesn't continue to happen?

I am running 4.1.6 on Debian 5.



0 Karma


Retention periods are set on a per index basis in indexes.conf.

See for a discussion of all the possible settings.