https://community.splunk.com/t5/Security/Monitoring-Splunk-Users-Search-Disk-Usage/m-p/36326#M1212 <P>A quick way to determine a user's quota is to run the following search on the search head:</P> <P><CODE>| rest splunk_server=local /services/search/jobs | eval diskUsageMB=diskUsage/1024/1024 | stats sum(diskUsageMB) by eai:acl.owner</CODE></P> <P>Hope this helps.</P> <P>d.</P> Sat, 25 Aug 2012 19:06:48 GMT _d_ 2012-08-25T19:06:48Z https://community.splunk.com/t5/Security/Monitoring-Splunk-Users-Search-Disk-Usage/m-p/36325#M1211 <P>I would like to understand the profile our users have for their searches in order to determine the optimal value to place the default search disk quota at. Where would that type of information be logged in the internal tables?</P> Wed, 15 Aug 2012 21:33:56 GMT https://community.splunk.com/t5/Security/Monitoring-Splunk-Users-Search-Disk-Usage/m-p/36325#M1211 sanderso67 2012-08-15T21:33:56Z https://community.splunk.com/t5/Security/Monitoring-Splunk-Users-Search-Disk-Usage/m-p/36326#M1212 <P>A quick way to determine a user's quota is to run the following search on the search head:</P> <P><CODE>| rest splunk_server=local /services/search/jobs | eval diskUsageMB=diskUsage/1024/1024 | stats sum(diskUsageMB) by eai:acl.owner</CODE></P> <P>Hope this helps.</P> <P>d.</P> Sat, 25 Aug 2012 19:06:48 GMT https://community.splunk.com/t5/Security/Monitoring-Splunk-Users-Search-Disk-Usage/m-p/36326#M1212 _d_ 2012-08-25T19:06:48Z