Splunk Search

Dispatch folder is only 284KB but I still encounter minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch

wuming79
Path Finder

I wanted to reduce my storage space. I have already set retirement policy but my used space did not reduce although the error message is not gone.

I did a ncdu on /opt/splunk/var/run/splunk/dispatch but the total disk usage is only 284KB. Am I looking at the right place? Can I delete all the files in Dispatch folder without breaking anything?

Tags (1)
0 Karma

kunalmao
Communicator

That message is for the entire mount , sure you can delete everything in dispatch all that will be affected will be your current running searches. Either clean your mount point or go to settings -> server settings -> general settings ->
Pause indexing if free disk space (in MB) falls below * reduce this parameter to 1000 or whatever suits your need.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...