topic Re: WARN: Search auto-finalized after disk usage limit (500MB) reached. WARN: Search auto-finalized after disk usage limit (500MB) reached. in Splunk Search https://community.splunk.com/t5/Splunk-Search/WARN-Search-auto-finalized-after-disk-usage-limit-500MB-reached/m-p/89065#M22810 <P>I think that authorize.conf need to be on each Search Head splunk/etc/system/local not on shared folder or inside an app...</P> Mon, 12 Mar 2012 18:50:37 GMT MarioM 2012-03-12T18:50:37Z WARN: Search auto-finalized after disk usage limit (500MB) reached. WARN: Search auto-finalized after disk usage limit (500MB) reached. https://community.splunk.com/t5/Splunk-Search/WARN-Search-auto-finalized-after-disk-usage-limit-500MB-reached/m-p/89062#M22807 <P>I'm running a cli search via command line in a search server.</P> <P>I've already updated srchDiskQuota = 3000 to the role of the user running this query.<BR /> But I'm still getting this error, and only get 1/4 size of a full day's worth of events.</P> <P>WARN: Search auto-finalized after disk usage limit (500MB) reached.</P> <P>Is there anything else I need to check? How can I resolve this warning?</P> Sat, 10 Mar 2012 02:06:53 GMT https://community.splunk.com/t5/Splunk-Search/WARN-Search-auto-finalized-after-disk-usage-limit-500MB-reached/m-p/89062#M22807 suhprano 2012-03-10T02:06:53Z Re: WARN: Search auto-finalized after disk usage limit (500MB) reached. WARN: Search auto-finalized after disk usage limit (500MB) reached. https://community.splunk.com/t5/Splunk-Search/WARN-Search-auto-finalized-after-disk-usage-limit-500MB-reached/m-p/89063#M22808 <P>where did you put the authorize.conf with the srchDiskQuota parameter? it needs to be in <CODE>splunk/etc/system/local</CODE></P> <P>Did you restart splunk service?</P> <P>could you post your authorize.conf?</P> <P><A href="http://wiki.splunk.com/Community:TroubleshootingSearchQuotas">Troubleshooting Search Quotas</A></P> Sun, 11 Mar 2012 10:10:03 GMT https://community.splunk.com/t5/Splunk-Search/WARN-Search-auto-finalized-after-disk-usage-limit-500MB-reached/m-p/89063#M22808 MarioM 2012-03-11T10:10:03Z Re: WARN: Search auto-finalized after disk usage limit (500MB) reached. WARN: Search auto-finalized after disk usage limit (500MB) reached. https://community.splunk.com/t5/Splunk-Search/WARN-Search-auto-finalized-after-disk-usage-limit-500MB-reached/m-p/89064#M22809 <P>Couple of details...<BR /> I'm running a 2 search server model, but only running the query on search01.<BR /> Both search servers are pulling configs in a shared nfs directory, and I can verify it has the right configs when I run ./splunk cmd btool authorize list</P> <P>Authorize.conf is in <BR /> /opt/splunk/(nfs symlink dir)/etc/apps/search_base/local/</P> <P>I restarted the service.</P> <P>Here's my authorize.conf for this particular user's role:<BR /> [role_bot-bi]<BR /> importRoles = bi<BR /> rtSrchJobsQuota = 0<BR /> srchDiskQuota = 3000<BR /> srchJobsQuota = 0</P> Sun, 11 Mar 2012 17:55:00 GMT https://community.splunk.com/t5/Splunk-Search/WARN-Search-auto-finalized-after-disk-usage-limit-500MB-reached/m-p/89064#M22809 suhprano 2012-03-11T17:55:00Z Re: WARN: Search auto-finalized after disk usage limit (500MB) reached. WARN: Search auto-finalized after disk usage limit (500MB) reached. https://community.splunk.com/t5/Splunk-Search/WARN-Search-auto-finalized-after-disk-usage-limit-500MB-reached/m-p/89065#M22810 <P>I think that authorize.conf need to be on each Search Head splunk/etc/system/local not on shared folder or inside an app...</P> Mon, 12 Mar 2012 18:50:37 GMT https://community.splunk.com/t5/Splunk-Search/WARN-Search-auto-finalized-after-disk-usage-limit-500MB-reached/m-p/89065#M22810 MarioM 2012-03-12T18:50:37Z