Splunk Search

Splunk says dispatch directory is full but when I go to the dispatch directory, it is empty.

mcxrisley08
Path Finder

So I keep getting this error:

Dispatch Command: The minimum free disk space (3000MB) reached for /opt/splunk/var/run/splunk/dispatch.

So I went in and manually cleaned out the folder using rm -rf yesterday and the error still persists this morning even when the directory is completely empty. Has anyone else had this issue before?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The message is not saying the dispatch directory is full. It is saying the disk containing the dispatch directory doesn't have at least 3GB of free space.

You've cleaned up the dispatch directory. Next, look at the rest of the disk (using du or your favorite tool) to find where space can be recovered.

---
If this reply helps you, Karma would be appreciated.

mcxrisley08
Path Finder

I got it fixed shortly after posting this. You were correct , the /opt directory was full and clearing out some space allowed to start searching again. Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...