Splunk Enterprise

Splunk v. 9.1 Enterprise Disc Space


Can Splunk v. 9.1 Enterprise run on an AWS EC2 t2.micro with the standard 8GB?  When I run the query, index="_internal" | STATS count by host, I get an error saying the minimum 5000(thousand)MB is not met.  Thanks for all your help.

Labels (1)
0 Karma



it depends what you are doing. If just testing wit only some inputs and one or two user it’s doable, but you need to wait many times to get results to your queries. For any reasonable use, I said that 4-6 core is minimum and splunk’s own recommendations are much higher.  

That warning is meaning that splunk db has less than 5GiB disk base. Usually splunk db is under /opt/splunk/var. Just check it and add more disk base or move SPLUNK_DB to somewhere where are enough space. Docs has good instructions how to do it  

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...