Monitoring Splunk
Highlighted

rotate input data

New Member

Hello,

It looks like I'm running out of space on my splunk server. Here is the error that I received when running a search.

The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch. The search was not run.

What config file options do I need to change so that older data is cleared out so that this doesn't continue to happen?

I am running 4.1.6 on Debian 5.

Thanks,

Steven

0 Karma
Highlighted

Re: rotate input data

Motivator

Retention periods are set on a per index basis in indexes.conf.

See http://www.splunk.com/base/Documentation/latest/Admin/Setaretirementandarchivingpolicy for a discussion of all the possible settings.