While logging to any Splunk Instance through web browser
If you encounter the below error on the screen:
IOError: [Errno 49] Disc quota exceeded: ‘/opt/splunk/var/run/splunk/session-‘
First of all you must do the following :
1. ssh
2. /opt/splunk/bin/splunk status
splunkd is not running. —-> NOT RUNNING
splunkweb is running (PID: 14841).
3. Now,your splunkd is not running, you have to start it
/opt/splunk/bin/splunk start splunkd
O/P :-
Splunk> See your world. Maybe wish you hadn’t.
Checking prerequisites…
Checking mgmt port [8089]: open
Checking configuration… Done.
Checking critical directories…Done
Checking indexes…
homePath=‘/opt/splunk/var/lib/splunk/XXX/db’ of index=_audit on unusable filesystem.Validating databases (splunkd validatedb) failed with code ‘1’. If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue
Look at the “Red” marked lines in the above output .
The problem could exist for the XXX index.
4. Now, you go to the index directory :
cd /opt/splunk/var/lib/splunk/XXX/db
Delete the unwanted files/directory
which are not being used
OR
Archive them to some other location/directory
5. Now, you should start the splunk :
/opt/splunk/bin/splunk restart
Note : Hope whenever you encounter :
IOError: [Errno 49] Disc quota exceeded: ‘/opt/splunk/var/run/splunk/session-‘
the above error, you will be able to solve it immediately!!
Happy Splunking !!!
What’s your Reaction?
+1
+1
+1
+1
+1
1
+1
+1
