'Splunk Docker instace Search not executed due to minimum free disk space
I have a splunk Docker instance running on my local Mac Book. But the search function in the application is failing.
Search not executed: The minimum free disk space (5000MB)
I can't cleanup harddisk space much.
What is the best way to fix this issue?
Solution 1:[1]
from Splunk forum
Best answer: redo your search head so that /opt/splunk/var is in its own disk volume so that nothing else can take up this space. Some people even go so var as to put /opt/splunk/var/run/dispatch into its own volume.
The next best answer: add more disk space to to the volume that contains the dispatch directory.
OK answer: Reduce the TTL for search artifacts so things auto-purge more quickly as described here: https://www.splunk.com/blog/2012/09/12/how-long-does-my-search-live-default-search-ttl.html
The WORST answer: reduce this quota in Settings -> Server settings -> General settings -> Pause indexing if free disk space (in MB) falls below.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | flaxon |