What you are seeing in 6.2 - 6.2.6 is a known issue, SPL-109387 where both UF and LWF will log this benign error every 10 minutes.
ERROR DiskMon - None such on disk: .../splunkforwarder/var/run/splunk/dispatch
This is related when the app .../splunkforwarder/etc/apps/introspection_generator_addon has been enabled and information relating to disk object partitions is attempted to be retrieved.
Below are 3 different workarounds:
Option 1:
Edit ../splunkforwarder/etc/system/local/server.conf and add the following entry:
[introspection:generator:disk_objects__partitions]
disabled = true
Option 2:
In ../splunkforwarder/etc/log.cfg (requires restart),
Increase the logging level of category.DiskMon=INFO to
category.DiskMon=CRIT
Option 3:
3) create on that UF/LWF an empty directory called... /splunkforwarder/var/run/splunk/dispatch
... View more