Getting Data In

what is means of field "Pause indexing if free disk space (in MB) falls below" in General Setting

rameshlpatel
Communicator

Hi,

Please explain meaning and use of field "Pause indexing if free disk space (in MB) falls below" under General Setting?

Where this free space are used ?

Tags (2)
0 Karma

lukejadamec
Super Champion

Check the splunk\etc\system\local\server.conf file for the attribute minFreeSpace = <num>

This attribute sets the minimum allowed free disk space on the disk that holds the indexed data. See the server.conf spec:

http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Serverconf

The solution is to increase the size of the audit partition, or reduce the volume of data being indexed, or decrease the age of data before it is frozen(deleted or archived), or decrease the size of the index that is getting too large before it is frozen(deleted or archived).

If you cannot increase the size of your disk, then basically you need to modify your 'data retirement policy'. See the docs at:

http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy

If it is the audit or other internal indexes that are causing the problem, then you should find out why they are getting so large so fast. If things seem normal, then maybe the audit partition where the audit index is being stored is simply too small.

aelliott
Motivator

I believe it is referring to if the disk space within the machine that the index(or drive) is on falls below a certain amount of MB, then pause indexing.

0 Karma

aelliott
Motivator

I would recommend setting the following setting if you would like to control the size of your index in indexes.conf

[indexName]
maxTotalDataSizeMB = 250000

http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy

0 Karma

rameshlpatel
Communicator

I am getting following disk space issue related to this size.

You are low in disk space on partition "/opt/splunk/var/lib/splunk/audit/db". Indexing has been paused. Will resume when free disk space rises above 1000MB.

Every Time I am lowing size here and after some day issue raised again. Please give some permanent solution to resolve this.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...