Splunk Search

Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

mcxrisley08
Path Finder

So I keep getting this error:

Dispatch Command: The minimum free disk space (3000MB) reached for /opt/splunk/var/run/splunk/dispatch.

So I went in and manually cleaned out the folder using rm -rf yesterday and the error still persists this morning even when the directory is completely empty. Has anyone else had this issue before?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The message is not saying the dispatch directory is full. It is saying the disk containing the dispatch directory doesn't have at least 3GB of free space.

You've cleaned up the dispatch directory. Next, look at the rest of the disk (using du or your favorite tool) to find where space can be recovered.

---
If this reply helps you, Karma would be appreciated.

mcxrisley08
Path Finder

I got it fixed shortly after posting this. You were correct , the /opt directory was full and clearing out some space allowed to start searching again. Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...