Cant see logs in splunk

[Hash]

Hi All,

I setup splunk and trying to capture security logs from the client machine.My VM is setup as server / client with active directory group setting.But i am getting diskspace error."The diskspace remaining =9620 has breached the yellow threshold for filesystems=C:]Program Files \splunk\var\lib\splunk\_metrics\colddb.

But i have free space in c drive.Please clarify

[richgalloway]

The message is a warning, not an error.  I says the free space on C: is getting low, not that you don't have any.

You can free up some space to get back below the yellow threshold or change the threshold to alert at different level.