Splunk Search

Dispatch folder is only 284KB but I still encounter minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch

wuming79
Path Finder

I wanted to reduce my storage space. I have already set retirement policy but my used space did not reduce although the error message is not gone.

I did a ncdu on /opt/splunk/var/run/splunk/dispatch but the total disk usage is only 284KB. Am I looking at the right place? Can I delete all the files in Dispatch folder without breaking anything?

Tags (1)
0 Karma

kunalmao
Communicator

That message is for the entire mount , sure you can delete everything in dispatch all that will be affected will be your current running searches. Either clean your mount point or go to settings -> server settings -> general settings ->
Pause indexing if free disk space (in MB) falls below * reduce this parameter to 1000 or whatever suits your need.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!