Why am I getting error "Search not executed: The minimum free disk space (1000MB) reached for /opt/splunk/var/run/splunk/dispatch."?

[rshaik26]

Hi

I am getting this error on search

Search not executed: The minimum free disk space (1000MB) reached for /opt/splunk/var/run/splunk/dispatch. user=admin.

I have checked other posts regarding this issue, which suggested that either you clear up space from the directory, or create a symlink to disk with more space.

How do I fix this without doing both as suggested above?
Why am I seeing this error in the first place when there is only some 224KB of data in that dispatch folder?

[richgalloway · Accepted solution]

Go to Settings->Server Settings->General Settings and change the "Pause indexing if free disk space (in MB) falls below" value to a number smaller than 1000 (1GB). This should get Splunk working again. You should then take steps to clear up space on that disk before the new limit is reached.