Monitoring Splunk

The minimum free disk space (2000MB) reached regarding Data Forwarding

syusjk6
Engager

Hi, the following message came up on Splunk UI when forwarding data:
The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch.

This message occurred when I did some data forwarding with host IP along with autotomatic load balancing.
I have been looking for related FAQs regarding this issue, but it seems that none fits.
And I want to know what kinds of situation the message comes up and how I can resolve this issue.

Any thought?

Tags (1)
0 Karma

cyue_splunk
Splunk Employee
Splunk Employee

In $SPLUNK_HOME/etc/system/default/limits.conf, you can find
dispatch_dir_warning_size = 2000

If you don't want the warning message to come up, you can reduce the 2000 to a smaller one, such as 1000.

But I'll suggest you check your /opt/splunk/var/run/splunk/dispatch free spaces, if it's too low, it'll impact your searching performance.

syusjk6
Engager

Thanks. It helped.

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...