Splunk Search

clean dispatchtmp ?

paulahoffman
Explorer

Splunk 4.3.3, I'm getting a disk space error:
The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch
The problem is displatchtmp is the directory with old data. Some directories in dispatchtmp have 6GB of data and don't seem to match anything in dispatch.

The clean-dispatch application seems to require a directory to move old data to. We don't have another disk with 6GB+ free. And if we did would it clean out the dispatchtmp directory?

Question can I purge dispatchtmp without impact? Do I need to shutdown the service first?

Thanks

Tags (1)

yannK
Splunk Employee
Splunk Employee

You can stop splunk and clean manually.
The dispatch tool is useful to triage the search artifacts by time.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...