Dispatch folder is only 284KB but I still encounter minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch

[wuming79]

I wanted to reduce my storage space. I have already set retirement policy but my used space did not reduce although the error message is not gone.

I did a ncdu on /opt/splunk/var/run/splunk/dispatch but the total disk usage is only 284KB. Am I looking at the right place? Can I delete all the files in Dispatch folder without breaking anything?

[kunalmao]

That message is for the entire mount , sure you can delete everything in dispatch all that will be affected will be your current running searches. Either clean your mount point or go to settings -> server settings -> general settings ->
Pause indexing if free disk space (in MB) falls below * reduce this parameter to 1000 or whatever suits your need.