Deployment Architecture

How can I increase the disk usage quota for one user?

ddrillic
Ultra Champion

One particular user keeps getting the following message -

Your search has been queued: The maximum disk usage quota for this user has been reached.

How can I increase it for him?

Tags (2)
0 Karma
1 Solution

adonio
Ultra Champion

this settings controls it on a role level basis: authorize.conf
links:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Addandeditroleswithauthorizeconf

srchDiskQuota = <number>
* Maximum amount of disk space (MB) that can be used by search jobs of a
  user that belongs to this role
* In search head clustering environments, this setting takes effect on a per-member basis.
  There is no cluster-wide accounting.
* The dispatch manager checks the quota at the dispatch time of a search
  and additionally the search process will check at intervals that are defined
  in the 'disk_usage_update_period' setting in limits.conf as long as the
  search is active.
* The quota can be exceeded at times, since the search process does not check
  the quota constantly.
* Exceeding this quota causes the search to be auto-finalized immediately,
  even if there are results that have not yet been returned.
* Defaults to '100', for 100 MB.

see screenshot
alt text

View solution in original post

adonio
Ultra Champion

this settings controls it on a role level basis: authorize.conf
links:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Addandeditroleswithauthorizeconf

srchDiskQuota = <number>
* Maximum amount of disk space (MB) that can be used by search jobs of a
  user that belongs to this role
* In search head clustering environments, this setting takes effect on a per-member basis.
  There is no cluster-wide accounting.
* The dispatch manager checks the quota at the dispatch time of a search
  and additionally the search process will check at intervals that are defined
  in the 'disk_usage_update_period' setting in limits.conf as long as the
  search is active.
* The quota can be exceeded at times, since the search process does not check
  the quota constantly.
* Exceeding this quota causes the search to be auto-finalized immediately,
  even if there are results that have not yet been returned.
* Defaults to '100', for 100 MB.

see screenshot
alt text

ddrillic
Ultra Champion

Thank you @adonio.

0 Karma

adonio
Ultra Champion

i think that this settings in on a role base level.
you can create a role just for this user and add it to him / her

ddrillic
Ultra Champion

no worries @adonio - I can do it for the role. Which setting is it?

0 Karma

ddrillic
Ultra Champion

Is it what we see at Your maximum disk usage quota has been reached - WHat does this mean?

It says -

 [role_admin]
srchDiskQuota = 100000
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...