Splunk v. 9.1 Enterprise Disc Space

rutherglen · ‎07-08-2023

Can Splunk v. 9.1 Enterprise run on an AWS EC2 t2.micro with the standard 8GB? When I run the query, index="_internal" | STATS count by host, I get an error saying the minimum 5000(thousand)MB is not met. Thanks for all your help.

isoutamo · ‎07-08-2023

Hi

it depends what you are doing. If just testing wit only some inputs and one or two user it’s doable, but you need to wait many times to get results to your queries. For any reasonable use, I said that 4-6 core is minimum and splunk’s own recommendations are much higher.

That warning is meaning that splunk db has less than 5GiB disk base. Usually splunk db is under /opt/splunk/var. Just check it and add more disk base or move SPLUNK_DB to somewhere where are enough space. Docs has good instructions how to do it

r. Ismo

Splunk v. 9.1 Enterprise Disc Space

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Splunk v. 9.1 Enterprise Disc Space

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...