Splunk Search

Minimum disk usage(5000MB) on Search head error

ramprakash
Explorer

Hi Guys,

I have my searches disabled on Search heads as the default minimum free disk space is 5000MB.

Problem is my splunk configuration. I have splunk installed on two different file system. One FS is for Search head pooling(NAS).

Where and what changes should be make to avoid this error.

                  265G  905M  251G   1% **/APPLICATIONS/SPLUNKT**

                  9.9G  5.0G  5.0G  50% **/APPLICATIONS/SPLUNKT/Global_Storage** --- Search head pooling
0 Karma
1 Solution

jimmytpowers
Path Finder

Hello ramprakash,

If it won't affect your performance, you can add a [diskUsage] stanza in server.conf, right now your minFreeSpace is 5Gb, you can lower that threshold to 1Gb or you can add more storage.

Below will help remove the error, and show the instance as healthy, but won't address the storage issue, if there is one.

$SPLUNK_HOME/etc/system/local/server.conf

[diskUsage]
minFreeSpace = 1000

Cheers,

View solution in original post

0 Karma

woodcock
Esteemed Legend

Search Head Pooling is a deprecated feature so the only way to get rid of the warning is to NOT USE IT (please don't; it is TERRIBLE and will result in all manner of outages and intermittent errors).

0 Karma

jimmytpowers
Path Finder

SH Clustering is the way to go!!!

0 Karma

woodcock
Esteemed Legend

Well, IMHO, SHC stinks, too, but FAR less and it gets better every release and at some point it will be fine.

0 Karma

jimmytpowers
Path Finder

Hello ramprakash,

If it won't affect your performance, you can add a [diskUsage] stanza in server.conf, right now your minFreeSpace is 5Gb, you can lower that threshold to 1Gb or you can add more storage.

Below will help remove the error, and show the instance as healthy, but won't address the storage issue, if there is one.

$SPLUNK_HOME/etc/system/local/server.conf

[diskUsage]
minFreeSpace = 1000

Cheers,

0 Karma

ramprakash
Explorer

Thank you. But I have two different File system where Splunk is installed on Search head..Exactly where to make changes ?

One File system is for NAS(Search head pooling)

0 Karma

jimmytpowers
Path Finder

I would add the server.conf stanza on the NAS instance, and possibly look into the below if it doesn't resolve the issue.

https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Manageconfigurationchanges

0 Karma

ramprakash
Explorer

Thank you so much for helping.I will do the changes and update you..

Can i make this server.conf change via Splunk Web ?

0 Karma

jimmytpowers
Path Finder

You can change via server.conf, CLI or Splunk Web 🙂

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Setlimitsondiskusage

remember to select your correct version of Splunk on the top right

0 Karma

jimmytpowers
Path Finder

How did it work out for you?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...