After upgrading to Splunk 4.1 from 4.0.10 today, we find that we can no longer run searches.
splunkd.log shows:
04-05-2010 16:36:33.982 ERROR SearchScheduler - The minimum free disk space (2048MB) reached for /opt/splunk/var/run/splunk/dispatch. The search was not run. SearchId=scheduler_eam_search_QVNOTkVYIC0gRGV2IERCIEZhaWx1cmU_at_1270499760_1463245089
SplunkWeb says the same thing if I run a search.
The filesystem in question has over 1GB free, but less than 2GB. We have minFreeSpace=500 in the diskUsage section of server.conf, but that value seems to be for indexing not search. What is the minimum disk space check value for a search?
In 4.1 this value is hardcoded to 2GB and it cannot be changed. The 4.1.1 release will honor the same minFreeSpace
value
In 4.1 this value is hardcoded to 2GB and it cannot be changed. The 4.1.1 release will honor the same minFreeSpace
value