Deployment Architecture

How can I increase the disk usage quota for one user?

ddrillic
Ultra Champion

One particular user keeps getting the following message -

Your search has been queued: The maximum disk usage quota for this user has been reached.

How can I increase it for him?

Tags (2)
0 Karma
1 Solution

adonio
Ultra Champion

this settings controls it on a role level basis: authorize.conf
links:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Addandeditroleswithauthorizeconf

srchDiskQuota = <number>
* Maximum amount of disk space (MB) that can be used by search jobs of a
  user that belongs to this role
* In search head clustering environments, this setting takes effect on a per-member basis.
  There is no cluster-wide accounting.
* The dispatch manager checks the quota at the dispatch time of a search
  and additionally the search process will check at intervals that are defined
  in the 'disk_usage_update_period' setting in limits.conf as long as the
  search is active.
* The quota can be exceeded at times, since the search process does not check
  the quota constantly.
* Exceeding this quota causes the search to be auto-finalized immediately,
  even if there are results that have not yet been returned.
* Defaults to '100', for 100 MB.

see screenshot
alt text

View solution in original post

adonio
Ultra Champion

this settings controls it on a role level basis: authorize.conf
links:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Addandeditroleswithauthorizeconf

srchDiskQuota = <number>
* Maximum amount of disk space (MB) that can be used by search jobs of a
  user that belongs to this role
* In search head clustering environments, this setting takes effect on a per-member basis.
  There is no cluster-wide accounting.
* The dispatch manager checks the quota at the dispatch time of a search
  and additionally the search process will check at intervals that are defined
  in the 'disk_usage_update_period' setting in limits.conf as long as the
  search is active.
* The quota can be exceeded at times, since the search process does not check
  the quota constantly.
* Exceeding this quota causes the search to be auto-finalized immediately,
  even if there are results that have not yet been returned.
* Defaults to '100', for 100 MB.

see screenshot
alt text

ddrillic
Ultra Champion

Thank you @adonio.

0 Karma

adonio
Ultra Champion

i think that this settings in on a role base level.
you can create a role just for this user and add it to him / her

ddrillic
Ultra Champion

no worries @adonio - I can do it for the role. Which setting is it?

0 Karma

ddrillic
Ultra Champion

Is it what we see at Your maximum disk usage quota has been reached - WHat does this mean?

It says -

 [role_admin]
srchDiskQuota = 100000
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...