Splunk Search

Minimum disk usage(5000MB) on Search head error

Explorer

Hi Guys,

I have my searches disabled on Search heads as the default minimum free disk space is 5000MB.

Problem is my splunk configuration. I have splunk installed on two different file system. One FS is for Search head pooling(NAS).

Where and what changes should be make to avoid this error.

                  265G  905M  251G   1% **/APPLICATIONS/SPLUNKT**

                  9.9G  5.0G  5.0G  50% **/APPLICATIONS/SPLUNKT/Global_Storage** --- Search head pooling
0 Karma
1 Solution

Path Finder

Hello ramprakash,

If it won't affect your performance, you can add a [diskUsage] stanza in server.conf, right now your minFreeSpace is 5Gb, you can lower that threshold to 1Gb or you can add more storage.

Below will help remove the error, and show the instance as healthy, but won't address the storage issue, if there is one.

$SPLUNK_HOME/etc/system/local/server.conf

[diskUsage]
minFreeSpace = 1000

Cheers,

View solution in original post

0 Karma

Esteemed Legend

Search Head Pooling is a deprecated feature so the only way to get rid of the warning is to NOT USE IT (please don't; it is TERRIBLE and will result in all manner of outages and intermittent errors).

0 Karma

Path Finder

SH Clustering is the way to go!!!

0 Karma

Esteemed Legend

Well, IMHO, SHC stinks, too, but FAR less and it gets better every release and at some point it will be fine.

0 Karma

Path Finder

Hello ramprakash,

If it won't affect your performance, you can add a [diskUsage] stanza in server.conf, right now your minFreeSpace is 5Gb, you can lower that threshold to 1Gb or you can add more storage.

Below will help remove the error, and show the instance as healthy, but won't address the storage issue, if there is one.

$SPLUNK_HOME/etc/system/local/server.conf

[diskUsage]
minFreeSpace = 1000

Cheers,

View solution in original post

0 Karma

Explorer

Thank you. But I have two different File system where Splunk is installed on Search head..Exactly where to make changes ?

One File system is for NAS(Search head pooling)

0 Karma

Path Finder

I would add the server.conf stanza on the NAS instance, and possibly look into the below if it doesn't resolve the issue.

https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Manageconfigurationchanges

0 Karma

Explorer

Thank you so much for helping.I will do the changes and update you..

Can i make this server.conf change via Splunk Web ?

0 Karma

Path Finder

You can change via server.conf, CLI or Splunk Web 🙂

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Setlimitsondiskusage

remember to select your correct version of Splunk on the top right

0 Karma

Path Finder

How did it work out for you?

0 Karma