https://community.splunk.com/t5/Alerting/Alert-skipped-out-of-search-disk-space/m-p/279266#M12554 <P>We are currently running Splunk 6.2.3. One user has created an alert which for some reason is being skipped with the reason "Out of search disk space".</P> <P>04-07-2016 23:55:01.126 -0400 INFO SavedSplunker - savedsearch_id="nobody;custom_app;Watch Team - After Hours", user="user1", app="custom_app", savedsearch_name="Watch Team - After Hours", status=skipped, reason="Out of search disk space.", scheduled_time=1460087700</P> <P>04-07-2016 23:55:01.126 -0400 WARN SavedSplunker - Max alive instance_count=1 reached for savedsearch_id="nobody;custom_app;Watch Team - After Hours"</P> <P>A user who is a member of the admin role cloned and scheduled the search, and it ran without issue.</P> <P>After investigating the issue I found "rtSrchJobsQuota = 6" in the /etc/system/default/authorize.conf file. The user in question had previously configured/scheduled 6 searches/alerts - this would be the 7th. Am I correct in deducing that the rtSrchjobsQuota value is what is preventing this alert from running? If yes, would scheduled searches/alerts be considered "real time"?</P> <P>Thank you.</P> Tue, 29 Sep 2020 09:20:01 GMT adamblock2 2020-09-29T09:20:01Z https://community.splunk.com/t5/Alerting/Alert-skipped-out-of-search-disk-space/m-p/279266#M12554 <P>We are currently running Splunk 6.2.3. One user has created an alert which for some reason is being skipped with the reason "Out of search disk space".</P> <P>04-07-2016 23:55:01.126 -0400 INFO SavedSplunker - savedsearch_id="nobody;custom_app;Watch Team - After Hours", user="user1", app="custom_app", savedsearch_name="Watch Team - After Hours", status=skipped, reason="Out of search disk space.", scheduled_time=1460087700</P> <P>04-07-2016 23:55:01.126 -0400 WARN SavedSplunker - Max alive instance_count=1 reached for savedsearch_id="nobody;custom_app;Watch Team - After Hours"</P> <P>A user who is a member of the admin role cloned and scheduled the search, and it ran without issue.</P> <P>After investigating the issue I found "rtSrchJobsQuota = 6" in the /etc/system/default/authorize.conf file. The user in question had previously configured/scheduled 6 searches/alerts - this would be the 7th. Am I correct in deducing that the rtSrchjobsQuota value is what is preventing this alert from running? If yes, would scheduled searches/alerts be considered "real time"?</P> <P>Thank you.</P> Tue, 29 Sep 2020 09:20:01 GMT https://community.splunk.com/t5/Alerting/Alert-skipped-out-of-search-disk-space/m-p/279266#M12554 adamblock2 2020-09-29T09:20:01Z https://community.splunk.com/t5/Alerting/Alert-skipped-out-of-search-disk-space/m-p/279267#M12555 <P>Hi adamblock2, based on the error it seems likely that the user is running into a srchDiskQuota limitation. Check the spec on authorize.conf for more info <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/authorizeconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/authorizeconf</A></P> <P>Please let me know if this answers your question! <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Fri, 08 Apr 2016 19:23:11 GMT https://community.splunk.com/t5/Alerting/Alert-skipped-out-of-search-disk-space/m-p/279267#M12555 muebel 2016-04-08T19:23:11Z https://community.splunk.com/t5/Alerting/Alert-skipped-out-of-search-disk-space/m-p/279268#M12556 <P>What query could I use to ascertain how close a user is to the srchDiskQuota limit?</P> Mon, 11 Apr 2016 15:30:59 GMT https://community.splunk.com/t5/Alerting/Alert-skipped-out-of-search-disk-space/m-p/279268#M12556 adamblock2 2016-04-11T15:30:59Z