Security

Monitoring Splunk Users Search Disk Usage

sanderso67
New Member

I would like to understand the profile our users have for their searches in order to determine the optimal value to place the default search disk quota at. Where would that type of information be logged in the internal tables?

Tags (2)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

A quick way to determine a user's quota is to run the following search on the search head:

| rest splunk_server=local /services/search/jobs | eval diskUsageMB=diskUsage/1024/1024 | stats sum(diskUsageMB) by eai:acl.owner

Hope this helps.

d.

View solution in original post

_d_
Splunk Employee
Splunk Employee

A quick way to determine a user's quota is to run the following search on the search head:

| rest splunk_server=local /services/search/jobs | eval diskUsageMB=diskUsage/1024/1024 | stats sum(diskUsageMB) by eai:acl.owner

Hope this helps.

d.

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>