Solved: Monitoring Splunk Users Search Disk Usage

sanderso67 · ‎08-15-2012

I would like to understand the profile our users have for their searches in order to determine the optimal value to place the default search disk quota at. Where would that type of information be logged in the internal tables?

_d_ · ‎08-25-2012

A quick way to determine a user's quota is to run the following search on the search head:

| rest splunk_server=local /services/search/jobs | eval diskUsageMB=diskUsage/1024/1024 | stats sum(diskUsageMB) by eai:acl.owner

Hope this helps.

d.

View solution in original post

_d_ · ‎08-25-2012

A quick way to determine a user's quota is to run the following search on the search head:

| rest splunk_server=local /services/search/jobs | eval diskUsageMB=diskUsage/1024/1024 | stats sum(diskUsageMB) by eai:acl.owner

Hope this helps.

d.

Monitoring Splunk Users Search Disk Usage

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Build and Launch AI Agents from Your Splunk Workflows

index This | What kind of room has no doors?

Join the Conversation