topic Re: searching time limit in Splunk Search

searching time limit

yohhpark — Fri, 11 Aug 2023 15:27:51 GMT

I have a search that takes quite some time to run.

*using py to run the search with splunk api

it returns by saying it "role-based disk usage quita of search artifacts for user "test" has been reached (used 192mb quota=100mb)

how can I increase the disk quota?

isoutamo — Fri, 11 Aug 2023 16:17:54 GMT

If you haven't admin access then ask from your admin that you are needing more disk quota.

If you are admin then you should update authorize.cond (actually create new file under local) and increase srchDiskQuota attribute value.

r. Ismo

yohhpark — Fri, 11 Aug 2023 16:25:22 GMT

thank you. if I'd like to perform taht myself, would i use limit.conf?

do you happen to have the link that I can possibly take look at?

thankyou

isoutamo — Fri, 11 Aug 2023 17:12:49 GMT

Another option is use GUI Settings-> Roles

select roles and then resources tab.