Splunk Search

Why is disk used in my SEARCH HEAD too high?

muez
Explorer

I can check that 80% of my disk is used in my Search Head. How to decrease it and what exactly is taking up space? This SH is not the INDEXER, therefore it does not store incoming data.

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Search heads need space too, for things like search artifacts:

https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Dispatchdirectoryandsearchartifacts

You should check to see where the disk space is being used, and to make sure that your search head is in fact forwarding events to the index tier.

anmolpatel
Builder

I would check the DMC first to check if the SH if not listed as a IDX
- localhost:8000/en-US/app/splunk_monitoring_console/monitoringconsole_overview

and also review the indexer instance
- localhost:8000/en-US/app/splunk_monitoring_console/index_detail_instance

There could be internal logs that could consume the disk space, so check that you're forwarding those to the IDX's.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...