I'm running search and suddenly there aren't any results neither in the Search & Report app or Hadoop connect search. I receive the error below:
reason="Search not executed: Dispatch Command: The minimum free disk space (5000MB) reached for $PATH
user=admin.", concurrency_category="historical", concurrency_context="user_instance-wide", current_concurrency=0, concurrency_limit=5000
Any suggestions?
Limits for controlling disk space in Splunk can be changed
The relevant stanza and parameter of interest in server.conf ($SPLUNK_HOME/etc/system/local/server.conf) is:
[diskUsage]
minFreeSpace = 500
For more details please look here:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Setlimitsondiskusage
Hope this helps.
Your Splunk disk has less than 5GB of free space, which is the least Splunk requires to do a search. Free up some space on the disk and you should be able to search again. A good place to look for things to delete is the dispatch directory ($SPLUNK_HOME/var/run/splunk/dispatch). It often contains old search artifacts that were never cleaned up for one reason or another.
Just clear $splunk$/var/run/splunk/dispatch and that will purge a fair amount. you'll have to run "$splunk$/bin/splunk stop" and then purge to clear the whole thing
I deleted a lot, but didn't solve the issue.
The solution above did.
Thanks a lot for your suggestion!