After upgrading to Splunk 4.1 from 4.0.10 today, we find that we can no longer run searches.
splunkd.log shows:
04-05-2010 16:36:33.982 ERROR SearchScheduler - The minimum free disk space (2048MB) reached for /opt/splunk/var/run/splunk/dispatch. The search was not run. SearchId=scheduler_eam_search_QVNOTkVYIC0gRGV2IERCIEZhaWx1cmU_at_1270499760_1463245089
SplunkWeb says the same thing if I run a search.
The filesystem in question has over 1GB free, but less than 2GB. We have minFreeSpace=500 in the diskUsage section of server.conf, but that value seems to be for indexing not search. What is the minimum disk space check value for a search?
... View more