IOError: [Errno 49] Disc quota exceeded: '/opt/splunk/var/run/splunk/session-'

  IOError: [Errno 49] Disc quota exceeded: '/opt/splunk/var/run/splunk/session-'

While logging to any Splunk Instance through web browser

if you encounter the below error on the screen :

IOError: [Errno 49] Disc quota exceeded: '/opt/splunk/var/run/splunk/session-'

First of all you must do the following :

1. ssh <Splunk_Instance> <enter>

2. /opt/splunk/bin/splunk status <enter>

   splunkd is not running.  ----> NOT RUNNING

   splunkweb is running (PID: 14841).

3. Now,your splunkd is not running, you have to start it

   /opt/splunk/bin/splunk start splunkd <enter>

 O/P :- 

Splunk> See your world.  Maybe wish you hadn't.

Checking prerequisites...

        Checking mgmt port [8089]: open

        Checking configuration...  Done.

        Checking critical directories...        Done

        Checking indexes...

homePath='/opt/splunk/var/lib/splunk/XXX/db' of index=_audit on unusable filesystem.

Validating databases (splunkd validatedb) failed with code '1'.  If you cannot resolve the issue(s) above after consulting documentation, please file a case online at http://www.splunk.com/page/submit_issue

Look at the "Red" marked lines in the above output .

The problem could exist for the XXX index.

4. Now, you go to the index directory :

   cd /opt/splunk/var/lib/splunk/XXX/db <enter>

   

   Delete the unwanted files/directory which are not being used

                            OR 

   Archive them to some other location/directory

5. Now, you should start the splunk :

   /opt/splunk/bin/splunk restart <enter>

Note : Hope whenever you encounter :

IOError: [Errno 49] Disc quota exceeded: '/opt/splunk/var/run/splunk/session-'

the above error, you will be able to solve it immediately !!

Happy Splunking !