Splunk Search

DispatchThread: Search auto-finalized after disk usage limit (500mb) reached

Builder

One of our Splunk users is running the following search:

index=customindex fieldip!=10.0.0.0/8 fieldip!="0.0.0.0" | fields fieldip | dedup fieldip|table fieldip | outputlookup outputfiiledip.csv append=true (Time period 7 days)

and getting the following error message: WARN DispatchThread :Search auto-finalized after disk usage limit (500mb) reached

1) Is there any workaround this warning without changing limits.conf by increasing srchDiskQuota ?
2) Is there a limit to what srchDiskQuota can be increased to?

0 Karma

Ultra Champion
0 Karma

Builder

@ddrillic , thank you for a quick reply. Unfortunately, the link doesn't answer my questions.

0 Karma

Ultra Champion

Sorry about that.

-- 2) Is there a limit to what srchDiskQuota can be increased to?
Most likely, the capacity of the specific file system.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!