Splunk v. 9.1 Enterprise Disc Space

[rutherglen]

Can Splunk v. 9.1 Enterprise run on an AWS EC2 t2.micro with the standard 8GB?  When I run the query, index="_internal" | STATS count by host, I get an error saying the minimum 5000(thousand)MB is not met.  Thanks for all your help.

[isoutamo]

Hi

it depends what you are doing. If just testing wit only some inputs and one or two user it’s doable, but you need to wait many times to get results to your queries. For any reasonable use, I said that 4-6 core is minimum and splunk’s own recommendations are much higher.  

That warning is meaning that splunk db has less than 5GiB disk base. Usually splunk db is under /opt/splunk/var. Just check it and add more disk base or move SPLUNK_DB to somewhere where are enough space. Docs has good instructions how to do it  

r. Ismo