Archive
Highlighted

The splunk-system-user is hitting a quota limit. How do I increase the quota for this user?

Champion

I'm running summary searches and the splunk-system-user keeps hitting a quota limit.

  04-12-2010 16:50:28.436 ERROR SavedSplunker - 
  Maximum disk usage=10422MB quota=10000MB, reached. Search not executed. 
  SearchId=scheduler_nobody_myapp_custom_summary_searchname

I'm only running summary searches on this host so I want to give the splunk-system-user free reign. How can I increase the quota for just the splunk-system-user?

Tags (1)
Highlighted

Re: The splunk-system-user is hitting a quota limit. How do I increase the quota for this user?

Champion

Note that when scheduled search does not have an owner, it is run by splunk-system-user.

The splunk-system-user seems to have a hardcoded quota.

Therefore, you'll need to assign an owner/user to the scheduled search and specify a role for the user. This is because there isn't a way to set a per-user disk quota so you'll have to edit the role to increase this limit. Here are the defaults from $SPLUNK_HOME/etc/system/default/authorize.conf:

[role_admin]
srchDiskQuota = 10000

[role_power]
srchDiskQuota = 500

[role_user]
srchDiskQuota = 100

(System-wide default is 100 MB which will be applied to all roles where a srchDiskQuota is not specified)

Best way is probably to create a custom role and assign it to this user rather than edit the defaults for the canned roles. Create your custom role in $SPLUNK_HOME/etc/system/local/authorize.conf:

[role_quota]
srchDiskQuota = 5000

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.