Splunk Search

Minimum free disk space reached for /opt/splunk/var/run/dispatch


I am receiving the following message in Splunk 6.01 "Minimum free disk space reached (5000MB) for /opt/splunk/var/run/dispatch". We also have Splunk App for ES installed. I have erased everything in the directory and after one day I receive the message again. What do I need to adjust in order to resolve this issue permanently?

Tags (3)

Path Finder

I had this issue installing a heavy forwarder, I was allocated 4gb of space and after the install, I only had 3.4gb left.

After researching it, I added this to my ~/etc/system/local/server.conf:

minFreeSpace =2000

Yes, this is low, but I'm just receiving & forwarding, and not expecting to index anything relevant here. If I run into space issues, I'll just request a few more gigs of space.

Splunk Employee
Splunk Employee

5GB is dangerously low for an enterprise system. After you optimize the TTL on your results , you may still find yourself running low on space.

See about attaching more space to your system. One of the great things about *NIX systems is that you can mount new storage directly to your var/run/dispatch directory without affecting the rest of your system.

Also if your system is using LVM volumes you can also transparently add storage without interruption.

Good luck


Moreover, whichever jobs are not required you could set dispatch.ttl parameter to as low as possible.

Path Finder
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...