topic Re: How do I determine a users current disk quota? in Monitoring Splunk

How do I determine a users current disk quota?

Lowell — Fri, 24 Aug 2012 21:19:54 GMT

I recently ran into some issues with user's disk quota. I've increased the defaults a bit, but I can't seem to find an easy way to determine a users current usage. (Actually, I couldn't find any jobs for the user, so something weird was happening.)

Is there a REST call for this? Obviously this information is somewhere, because I can see in splunkd.log the current disk space used when a user violates their limits. It would be nice to be able to know if a user is getting close to their limit. Or, after they've hit a limit to know how much spaces they've cleaned up.

Is there any way to do this (preferable, from within Splunk)?

Re: How do I determine a users current disk quota?

_d_ — Sat, 25 Aug 2012 16:05:04 GMT

Try this search on your search head:

| rest splunk_server=local /services/search/jobs | eval diskUsageMB=diskUsage/1024/1024 | stats sum(diskUsageMB) by eai:acl.owner

Hope this helps.

Re: How do I determine a users current disk quota?

Lowell — Tue, 28 Aug 2012 22:21:28 GMT

The rest search shown here never seems to return more than 500 results. But there are more than 500 directories under $SPLUNK_HOME/var/run/splunk/dispatch so I must be hitting some kind of limit somewhere.

Re: How do I determine a users current disk quota?

Lowell — Tue, 28 Aug 2012 22:25:41 GMT

In my initial use case, there were no jobs listed for the user who supposedly used up their quota when I looked in the "Job Manager", which is why I was wondering if there was a more direct way to get at this value. (But perhaps, internally, each splunk process iterates the entire dispatch folder and sums it up as you search does. I'm not sure.) I had created that user only earlier that afternoon.