Splunk Enterprise

After moving $splunk_db to a new path, why am I still seeing error "The minimum free disk space reached" in Splunk Light?

New Member

Hi there.

In the Splunk Light UI, an error message states:

The minimum free disk space (5000MB) reached for C:\Program Files\Splunk\var\run\splunk\dispatch. 6/29/2015, 5:15:01 PM

Splunk Light 6.2.3 is installed on Win 2008 Server R2 Standard.

After researching this pretty extensively, I stopped the splunkd service, edited the value of $splunk_db in the file C:\Program Files\Splunk\etc\splunk-launch.conf to the path:
I copied the contents of the original database path to the new path, then restarted the splunkd service, logged into the UI, and checked that in the General Settings: Server Settings, that the index path was properly updated by the server.

However, I'm still seeing the same error as before. The current size of the splunk_db is roughly 121MB. The D partition has 99gb free and unused space.

I look forward to any advice the community can provide. Thanks in advance!
Robin Way

0 Karma

Path Finder

This happens to us when the c drive (installation drive) does not have enough space for Splunk to process temp files that use disk space and then are cleaned. If there is not enough space then that error shows up. We expand the space on our C drive and the error goes away.,That usually indicates that your C drive is filling up due to temporary files that use space during searches. When this happens to our servers we increase the size of the c drive.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...