I keep getting the "minimum free disk space (5000MB) reached for /var/run/splunk/dispatch" on one of my heavy forwarders. There are no jobs that I can see in the job manager. Not sure where to go from this point. Should I just delete all of the search artifacts in the directory since it is a forwarder?
If you have a small data partition allocated for Splunk on that host, you can reduce the minimum free space required by Splunk to continue running. Set the minFreeSpace stanza in server.conf:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setlimitsondiskusage
If you have a small data partition allocated for Splunk on that host, you can reduce the minimum free space required by Splunk to continue running. Set the minFreeSpace stanza in server.conf:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Indexer/Setlimitsondiskusage
what is the root cause of this issues?
I can go from the default of 5000 "5gb" to 10000 (10gb) sure that's fine however, whats to stop this error from happening again?
[diskUsage]
minFreeSpace = 10000