Splunk Search

Dispatch folder is only 284KB but I still encounter minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch

wuming79
Path Finder

I wanted to reduce my storage space. I have already set retirement policy but my used space did not reduce although the error message is not gone.

I did a ncdu on /opt/splunk/var/run/splunk/dispatch but the total disk usage is only 284KB. Am I looking at the right place? Can I delete all the files in Dispatch folder without breaking anything?

Tags (1)
0 Karma

kunalmao
Communicator

That message is for the entire mount , sure you can delete everything in dispatch all that will be affected will be your current running searches. Either clean your mount point or go to settings -> server settings -> general settings ->
Pause indexing if free disk space (in MB) falls below * reduce this parameter to 1000 or whatever suits your need.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...