Splunk Search

Unable to see the License usage report "Could not create search"

khusain_splunk
Splunk Employee
Splunk Employee

I am not able to view my license usage report for Today and Previous 30 days. I am getting below WARNINGS under Message:

Dispatch Command: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch.
Dispatch Command: The number of search artifacts in the dispatch directory is higher than recommended (count=25536, warning threshold = 5000) and could have an impact on search performance.

Tags (1)
0 Karma
1 Solution

khusain_splunk
Splunk Employee
Splunk Employee

It looks like dispatch directory hit the disk space threshold (5000MB). Please be informed that searches will not run until you fix this issue. You can go under "/opt/splunk/var/run/splunk/dispatch" directory and clear old search artifacts. If you can't delete anything from that directory then set the new threshold value for this parameter by navigating as follows:

Settings > Server settings > General settings > "Pause indexing if free disk space (in MB) falls below"

You can set it to 2000 or less than that also, then this error will go away and license and other searches will start running.

View solution in original post

0 Karma

khusain_splunk
Splunk Employee
Splunk Employee

It looks like dispatch directory hit the disk space threshold (5000MB). Please be informed that searches will not run until you fix this issue. You can go under "/opt/splunk/var/run/splunk/dispatch" directory and clear old search artifacts. If you can't delete anything from that directory then set the new threshold value for this parameter by navigating as follows:

Settings > Server settings > General settings > "Pause indexing if free disk space (in MB) falls below"

You can set it to 2000 or less than that also, then this error will go away and license and other searches will start running.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...