Hello,
It looks like I'm running out of space on my splunk server. Here is the error that I received when running a search.
The minimum free disk space (2000MB) reached for /opt/splunk/var/run/splunk/dispatch. The search was not run.
What config file options do I need to change so that older data is cleared out so that this doesn't continue to happen?
I am running 4.1.6 on Debian 5.
Thanks,
Steven
Retention periods are set on a per index basis in indexes.conf.
See http://www.splunk.com/base/Documentation/latest/Admin/Setaretirementandarchivingpolicy for a discussion of all the possible settings.