https://community.splunk.com/t5/Splunk-Search/The-splunk-system-user-is-hitting-a-quota-limit-How-do-I/m-p/11306#M145107 <P>Note that when scheduled search does not have an owner, it is run by splunk-system-user.</P> <P>The splunk-system-user seems to have a hardcoded quota. </P> <P>Therefore, you'll need to assign an owner/user to the scheduled search and specify a role for the user. This is because there isn't a way to set a per-user disk quota so you'll have to edit the role to increase this limit. Here are the defaults from $SPLUNK_HOME/etc/system/default/authorize.conf:</P> <PRE><CODE>[role_admin] srchDiskQuota = 10000 [role_power] srchDiskQuota = 500 [role_user] srchDiskQuota = 100 </CODE></PRE> <P>(System-wide default is 100 MB which will be applied to all roles where a srchDiskQuota is not specified)</P> <P>Best way is probably to create a custom role and assign it to this user rather than edit the defaults for the canned roles. Create your custom role in $SPLUNK_HOME/etc/system/local/authorize.conf:</P> <PRE><CODE>[role_quota] srchDiskQuota = 5000 </CODE></PRE> Tue, 13 Apr 2010 18:48:17 GMT the_wolverine 2010-04-13T18:48:17Z https://community.splunk.com/t5/Splunk-Search/The-splunk-system-user-is-hitting-a-quota-limit-How-do-I/m-p/11305#M145106 <P>I'm running summary searches and the splunk-system-user keeps hitting a quota limit. </P> <PRE><CODE> 04-12-2010 16:50:28.436 ERROR SavedSplunker - Maximum disk usage=10422MB quota=10000MB, reached. Search not executed. SearchId=scheduler_nobody_myapp_custom_summary_searchname </CODE></PRE> <P>I'm only running summary searches on this host so I want to give the splunk-system-user free reign. How can I increase the quota for just the splunk-system-user?</P> Tue, 13 Apr 2010 18:29:37 GMT https://community.splunk.com/t5/Splunk-Search/The-splunk-system-user-is-hitting-a-quota-limit-How-do-I/m-p/11305#M145106 the_wolverine 2010-04-13T18:29:37Z https://community.splunk.com/t5/Splunk-Search/The-splunk-system-user-is-hitting-a-quota-limit-How-do-I/m-p/11306#M145107 <P>Note that when scheduled search does not have an owner, it is run by splunk-system-user.</P> <P>The splunk-system-user seems to have a hardcoded quota. </P> <P>Therefore, you'll need to assign an owner/user to the scheduled search and specify a role for the user. This is because there isn't a way to set a per-user disk quota so you'll have to edit the role to increase this limit. Here are the defaults from $SPLUNK_HOME/etc/system/default/authorize.conf:</P> <PRE><CODE>[role_admin] srchDiskQuota = 10000 [role_power] srchDiskQuota = 500 [role_user] srchDiskQuota = 100 </CODE></PRE> <P>(System-wide default is 100 MB which will be applied to all roles where a srchDiskQuota is not specified)</P> <P>Best way is probably to create a custom role and assign it to this user rather than edit the defaults for the canned roles. Create your custom role in $SPLUNK_HOME/etc/system/local/authorize.conf:</P> <PRE><CODE>[role_quota] srchDiskQuota = 5000 </CODE></PRE> Tue, 13 Apr 2010 18:48:17 GMT https://community.splunk.com/t5/Splunk-Search/The-splunk-system-user-is-hitting-a-quota-limit-How-do-I/m-p/11306#M145107 the_wolverine 2010-04-13T18:48:17Z