Splunk Search
Highlighted

Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

Explorer

So I keep getting this error:

Dispatch Command: The minimum free disk space (3000MB) reached for /opt/splunk/var/run/splunk/dispatch.

So I went in and manually cleaned out the folder using rm -rf yesterday and the error still persists this morning even when the directory is completely empty. Has anyone else had this issue before?

0 Karma
Highlighted

Re: Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

SplunkTrust
SplunkTrust

The message is not saying the dispatch directory is full. It is saying the disk containing the dispatch directory doesn't have at least 3GB of free space.

You've cleaned up the dispatch directory. Next, look at the rest of the disk (using du or your favorite tool) to find where space can be recovered.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

Explorer

I got it fixed shortly after posting this. You were correct , the /opt directory was full and clearing out some space allowed to start searching again. Thanks!

0 Karma
Highlighted

Re: Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

SplunkTrust
SplunkTrust

If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma