Monitoring Splunk

How to fetch details when users exhaust Splunk search quota?


Hello All,

I need your help to write SPL for fetching details of events that occur when users reach or cross the threshold limit defined as per their role for executing Splunk searches.

Any information would be very helpful.

Thank you

Labels (3)
0 Karma


Information fetched so far: -

I asked it earlier on a separate forum and got following details from Jason Buxton: -

To get details of roles and and their configurations: -

|rest /services/authorization/roles splunk_server=local

To fetch my details: -

|rest /services/authentication/users splunk_server=local


I got following information from Miachael Camp Bentley: -

index=_internal reason=*

I tried to modify it as: -

index=_internal reason="*quota*"

 And I got output with string: - The maximum number of concurrent historical searches for this user based on their role quota has been reached.

Although there were many empty fields, I fetched data from below fields: -

* event_message

* _raw

* reason

* search_id

* splunk_server

* splunk_server_group


However, it would be helpful if you could guide on getting more details related to events and errors along with related attributes which occur when users exceed their search quota.

Thank you

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...