search

splunk / docker-splunk

Splunk Docker GitHub Repository
462 stars 253 forks source link

Querying through curl not working #619

Closed VihasMakwana closed 1 year ago

VihasMakwana commented 1 year ago

I'm trying to install splunk as k8s pod in github actions. All works fine but while searching for data via curl, I get:

details: {"messages":[{"type":"WARN","text":"Search not executed: The minimum free disk space (5000MB) reached for /opt/splunk/var/run/splunk/dispatch. user=admin., concurrency_category=\"historical\", concurrency_context=\"user_instance-wide\", current_concurrency=0, concurrency_limit=5000","help":""}]}

What could be the root cause?? too much data? Can we change this limit?

VihasMakwana commented 1 year ago

Workaround:

decrease minFreeSpace in server.conf in splunk. Here's how I did for my kubernetes pod.

kubectl exec -it splunk -- bash -c 'echo -e "\n[diskUsage]\nminFreeSpace = 50" >> /opt/splunk/etc/system/local/server.conf'