Splunk Search

Dispatch folder is only 284KB but I still encounter minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch

wuming79
Path Finder

I wanted to reduce my storage space. I have already set retirement policy but my used space did not reduce although the error message is not gone.

I did a ncdu on /opt/splunk/var/run/splunk/dispatch but the total disk usage is only 284KB. Am I looking at the right place? Can I delete all the files in Dispatch folder without breaking anything?

Tags (1)
0 Karma

kunalmao
Communicator

That message is for the entire mount , sure you can delete everything in dispatch all that will be affected will be your current running searches. Either clean your mount point or go to settings -> server settings -> general settings ->
Pause indexing if free disk space (in MB) falls below * reduce this parameter to 1000 or whatever suits your need.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...