Hi Guys,
I have my searches disabled on Search heads as the default minimum free disk space is 5000MB.
Problem is my splunk configuration. I have splunk installed on two different file system. One FS is for Search head pooling(NAS).
Where and what changes should be make to avoid this error.
265G 905M 251G 1% **/APPLICATIONS/SPLUNKT**
9.9G 5.0G 5.0G 50% **/APPLICATIONS/SPLUNKT/Global_Storage** --- Search head pooling
Hello ramprakash,
If it won't affect your performance, you can add a [diskUsage] stanza in server.conf, right now your minFreeSpace is 5Gb, you can lower that threshold to 1Gb or you can add more storage.
Below will help remove the error, and show the instance as healthy, but won't address the storage issue, if there is one.
$SPLUNK_HOME/etc/system/local/server.conf
[diskUsage]
minFreeSpace = 1000
Cheers,
Search Head Pooling is a deprecated feature so the only way to get rid of the warning is to NOT USE IT (please don't; it is TERRIBLE and will result in all manner of outages and intermittent errors).
SH Clustering is the way to go!!!
Well, IMHO, SHC stinks, too, but FAR less and it gets better every release and at some point it will be fine.
Hello ramprakash,
If it won't affect your performance, you can add a [diskUsage] stanza in server.conf, right now your minFreeSpace is 5Gb, you can lower that threshold to 1Gb or you can add more storage.
Below will help remove the error, and show the instance as healthy, but won't address the storage issue, if there is one.
$SPLUNK_HOME/etc/system/local/server.conf
[diskUsage]
minFreeSpace = 1000
Cheers,
Thank you. But I have two different File system where Splunk is installed on Search head..Exactly where to make changes ?
One File system is for NAS(Search head pooling)
I would add the server.conf stanza on the NAS instance, and possibly look into the below if it doesn't resolve the issue.
https://docs.splunk.com/Documentation/Splunk/7.3.0/DistSearch/Manageconfigurationchanges
Thank you so much for helping.I will do the changes and update you..
Can i make this server.conf change via Splunk Web ?
You can change via server.conf, CLI or Splunk Web 🙂
https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Setlimitsondiskusage
remember to select your correct version of Splunk on the top right
How did it work out for you?