topic Re: DispatchThread: Search auto-finalized after disk usage limit (500mb) reached in Splunk Search

DispatchThread: Search auto-finalized after disk usage limit (500mb) reached

mlevsh — Fri, 06 Jul 2018 17:02:08 GMT

One of our Splunk users is running the following search:

index=customindex fieldip!=10.0.0.0/8 fieldip!="0.0.0.0" | fields fieldip | dedup fieldip|table fieldip | outputlookup outputfiiledip.csv append=true (Time period 7 days)

and getting the following error message: WARN DispatchThread :Search auto-finalized after disk usage limit (500mb) reached

1) Is there any workaround this warning without changing limits.conf by increasing srchDiskQuota ?
2) Is there a limit to what srchDiskQuota can be increased to?

Re: DispatchThread: Search auto-finalized after disk usage limit (500mb) reached

ddrillic — Fri, 06 Jul 2018 17:38:00 GMT

The following can help - Search auto-finalized after disk usage limit (100mb) reached - What does this mean?

Re: DispatchThread: Search auto-finalized after disk usage limit (500mb) reached

mlevsh — Fri, 06 Jul 2018 18:14:21 GMT

@ddrillic , thank you for a quick reply. Unfortunately, the link doesn't answer my questions.

Re: DispatchThread: Search auto-finalized after disk usage limit (500mb) reached

ddrillic — Fri, 06 Jul 2018 18:19:49 GMT

Sorry about that.

-- 2) Is there a limit to what srchDiskQuota can be increased to?
Most likely, the capacity of the specific file system.