Splunk Search

Minimum free space 32 bit

crystalkirkland
New Member

I keep getting a message stating that I do not have enough space. I went to general settings to adjust the limitation. When I go to save it, it is requesting that I enter a kv port which I know my 32 bit laptop does not support. Is there anyway around this? I am just trying to get through the fundamentals training.

Thanks in advance

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi crystalkirkland,

use your favourite editor and open the file $SPLUNK_HOME\etc\system\local\server.conf and add the following:

[diskUsage]
minFreeSpace = <num>|<percentage>

the num per is in MB and percentage can be like 1%. Restart Splunk once you saved the file.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi crystalkirkland,

use your favourite editor and open the file $SPLUNK_HOME\etc\system\local\server.conf and add the following:

[diskUsage]
minFreeSpace = <num>|<percentage>

the num per is in MB and percentage can be like 1%. Restart Splunk once you saved the file.

Hope this helps ...

cheers, MuS

0 Karma

crystalkirkland
New Member

So all I have to do is put this in notepad and save it to my computer and it should work? I don't have to do anything in splunk itself?

Thank you so much

0 Karma

crystalkirkland
New Member

Ok great, and I just wanted to make sure.....is line 3 supposed to be blank? Your're a life saver

0 Karma

MuS
SplunkTrust
SplunkTrust

blank lines are no problem at all in Splunk configuration files 😉

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

When you change settings in the Splunk web UI, it will modify config files in the background - so in the end both approaches are doing exactly the same.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...