Getting Data In

what is means of field "Pause indexing if free disk space (in MB) falls below" in General Setting

rameshlpatel
Communicator

Hi,

Please explain meaning and use of field "Pause indexing if free disk space (in MB) falls below" under General Setting?

Where this free space are used ?

Tags (2)
0 Karma

lukejadamec
Super Champion

Check the splunk\etc\system\local\server.conf file for the attribute minFreeSpace = <num>

This attribute sets the minimum allowed free disk space on the disk that holds the indexed data. See the server.conf spec:

http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Serverconf

The solution is to increase the size of the audit partition, or reduce the volume of data being indexed, or decrease the age of data before it is frozen(deleted or archived), or decrease the size of the index that is getting too large before it is frozen(deleted or archived).

If you cannot increase the size of your disk, then basically you need to modify your 'data retirement policy'. See the docs at:

http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy

If it is the audit or other internal indexes that are causing the problem, then you should find out why they are getting so large so fast. If things seem normal, then maybe the audit partition where the audit index is being stored is simply too small.

aelliott
Motivator

I believe it is referring to if the disk space within the machine that the index(or drive) is on falls below a certain amount of MB, then pause indexing.

0 Karma

aelliott
Motivator

I would recommend setting the following setting if you would like to control the size of your index in indexes.conf

[indexName]
maxTotalDataSizeMB = 250000

http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy

0 Karma

rameshlpatel
Communicator

I am getting following disk space issue related to this size.

You are low in disk space on partition "/opt/splunk/var/lib/splunk/audit/db". Indexing has been paused. Will resume when free disk space rises above 1000MB.

Every Time I am lowing size here and after some day issue raised again. Please give some permanent solution to resolve this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...