Monitoring Splunk

The index processor has paused data flow

rgarcia
Engager

After a hardware failure was resolved, I attempted to start splunk again...but I am now getting this error

"The index processor has paused data flow. Current free disk space on partition '/' has fallen to 158MB, below the minimum of 5000MB. Data writes to index path '/data1/splunk/indexes/audit/db'cannot safely proceed. Increase free disk space on partition '/' by removing or relocating data."

I understand what is saying, but the odd part is that partition "/" never had that much space and all other indexers are configured the same with no issues.

What am I missing here?

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Can it be so that your node hasn’t mount all FSs yet?

You should check what is your SPLUNK_DB path and then check that it’s present and it has enough space.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can it be so that your node hasn’t mount all FSs yet?

You should check what is your SPLUNK_DB path and then check that it’s present and it has enough space.

r. Ismo

0 Karma

rgarcia
Engager

You're right, mount points were missing. thank you

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...