Minimum disk usage(5000MB) on Search head error

[ramprakash]

Hi Guys,

I have my searches disabled on Search heads as the default minimum free disk space is 5000MB.

Problem is my splunk configuration. I have splunk installed on two different file system. One FS is for Search head pooling(NAS).

Where and what changes should be make to avoid this error.

                  265G  905M  251G   1% **/APPLICATIONS/SPLUNKT**

                  9.9G  5.0G  5.0G  50% **/APPLICATIONS/SPLUNKT/Global_Storage** --- Search head pooling

[woodcock]

Search Head Pooling is a deprecated feature so the only way to get rid of the warning is to NOT USE IT (please don't; it is TERRIBLE and will result in all manner of outages and intermittent errors).

[jimmytpowers]

SH Clustering is the way to go!!!

[woodcock]

Well, IMHO, SHC stinks, too, but FAR less and it gets better every release and at some point it will be fine.

[jimmytpowers · Accepted solution]

Hello ramprakash,

If it won't affect your performance, you can add a [diskUsage] stanza in server.conf, right now your minFreeSpace is 5Gb, you can lower that threshold to 1Gb or you can add more storage.

Below will help remove the error, and show the instance as healthy, but won't address the storage issue, if there is one.

$SPLUNK_HOME/etc/system/local/server.conf

[diskUsage]
minFreeSpace = 1000

Cheers,

[ramprakash]

Thank you. But I have two different File system where Splunk is installed on Search head..Exactly where to make changes ?

One File system is for NAS(Search head pooling)

[jimmytpowers]

I would add the server.conf stanza on the NAS instance, and possibly look into the below if it doesn't resolve the issue.

https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Manageconfigurationchanges

[ramprakash]

Thank you so much for helping.I will do the changes and update you..

Can i make this server.conf change via Splunk Web ?

[jimmytpowers]

You can change via server.conf, CLI or Splunk Web 🙂

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Setlimitsondiskusage

remember to select your correct version of Splunk on the top right

[jimmytpowers]

How did it work out for you?