I recently ran into some issues with user's disk quota. I've increased the defaults a bit, but I can't seem to find an easy way to determine a users current usage. (Actually, I couldn't find any jobs for the user, so something weird was happening.)
Is there a REST call for this? Obviously this information is somewhere, because I can see in splunkd.log
the current disk space used when a user violates their limits. It would be nice to be able to know if a user is getting close to their limit. Or, after they've hit a limit to know how much spaces they've cleaned up.
Is there any way to do this (preferable, from within Splunk)?
Try this search on your search head:
| rest splunk_server=local /services/search/jobs | eval diskUsageMB=diskUsage/1024/1024 | stats sum(diskUsageMB) by eai:acl.owner
Hope this helps.
d.
Try this search on your search head:
| rest splunk_server=local /services/search/jobs | eval diskUsageMB=diskUsage/1024/1024 | stats sum(diskUsageMB) by eai:acl.owner
Hope this helps.
d.
In my initial use case, there were no jobs listed for the user who supposedly used up their quota when I looked in the "Job Manager", which is why I was wondering if there was a more direct way to get at this value. (But perhaps, internally, each splunk process iterates the entire dispatch folder and sums it up as you search does. I'm not sure.) I had created that user only earlier that afternoon.
The rest
search shown here never seems to return more than 500 results. But there are more than 500 directories under $SPLUNK_HOME/var/run/splunk/dispatch
so I must be hitting some kind of limit somewhere.