Archive2

how do i resolve a Maximum disk usage error?

Motivator

We have a single user getting this error: Maximum disk usage=814MB quota=100MB, reached. Search not executed

It is causing him not to be able to run any queries.

Has anyone seen this? What causes this and how do we fix? Thanks in Advance!!

Tags (3)
1 Solution

Motivator

If a single user in a role is getting this error it means they have persisted a a lot of search results to disk. Most likely they ran a '*' over all time search (or something like that) and have millions of results saved. If you want to bump up the disk quota for all users in the role, you must modify Create a capability in a copy of authorize.conf as described in the previous section.

If you are logged in as an admin, you can go to the Jobs menu and search for the user in the Owner column and delete the offending saved data. (Most likely, there will be a few searches with massive numbers of results).

Or you can go to $SPLUNK_HOME$/var/run/splunk/dispatch and type:

$ find . -name info.csv -exec grep username_in_question {} \; -print

and then delete all of the directories that come back.

more info here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Aboutsearchjobsandsearchjobmanagement#Rest...

View solution in original post

Motivator

If a single user in a role is getting this error it means they have persisted a a lot of search results to disk. Most likely they ran a '*' over all time search (or something like that) and have millions of results saved. If you want to bump up the disk quota for all users in the role, you must modify Create a capability in a copy of authorize.conf as described in the previous section.

If you are logged in as an admin, you can go to the Jobs menu and search for the user in the Owner column and delete the offending saved data. (Most likely, there will be a few searches with massive numbers of results).

Or you can go to $SPLUNK_HOME$/var/run/splunk/dispatch and type:

$ find . -name info.csv -exec grep username_in_question {} \; -print

and then delete all of the directories that come back.

more info here: http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Aboutsearchjobsandsearchjobmanagement#Rest...

View solution in original post

Contributor

does anybody have more suggestions. I'm a admin and many users are reporting quota exhausted issue. I dont find anything in job manager. But I do see sometimes in the dispatch folder. I delete jobs in dispatch. Even after all these. When a users gets stuck, we are not able to recover. we are using splunk in a pooled way.

Motivator

Just ran into the same problem and I could resolve it with this answer.

0 Karma
Reply
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!