Dashboards & Visualizations

The maximum disk usage quota for this user has been reached. Use the Job Manager to delete some of your saved search results.

mbagali_splunk
Splunk Employee
Splunk Employee

Dashboards loading slow and waiting for queued job. Getting below errors:

Error 1: The maximum disk usage quota for this user has been reached. Use the Job Manager to delete some of your saved search results.

Error 2: The maximum number of concurrent historical searches for this user based on their role quota has been reached

Tags (1)
0 Karma
1 Solution

mbagali_splunk
Splunk Employee
Splunk Employee

For Error 1: The maximum disk usage quota for this user has been reached. Use the Job Manager to delete some of your saved search results.

Work around would be to increase disk usage quota for user in authorize.conf .

srchDiskQuota =

By default it is 100 MB, you can set it to higher value.

For Error 2: The maximum number of concurrent historical searches for this user based on their role quota has been reached

Work around would be to increase search job quota for the user:

srchJobsQuota =

* Maximum number of concurrently running historical searches a member of this role can have. * This excludes real-time searches, see rtSrchJobsQuota. * Defaults to 3.

Increase it to a higher value

View solution in original post

mbagali_splunk
Splunk Employee
Splunk Employee

For Error 1: The maximum disk usage quota for this user has been reached. Use the Job Manager to delete some of your saved search results.

Work around would be to increase disk usage quota for user in authorize.conf .

srchDiskQuota =

By default it is 100 MB, you can set it to higher value.

For Error 2: The maximum number of concurrent historical searches for this user based on their role quota has been reached

Work around would be to increase search job quota for the user:

srchJobsQuota =

* Maximum number of concurrently running historical searches a member of this role can have. * This excludes real-time searches, see rtSrchJobsQuota. * Defaults to 3.

Increase it to a higher value

Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...