One of our Splunk users is running the following search:
index=customindex fieldip!=10.0.0.0/8 fieldip!="0.0.0.0" | fields fieldip | dedup fieldip|table fieldip | outputlookup outputfiiledip.csv append=true (Time period 7 days)
and getting the following error message: WARN DispatchThread :Search auto-finalized after disk usage limit (500mb) reached
1) Is there any workaround this warning without changing limits.conf by increasing srchDiskQuota ?
2) Is there a limit to what srchDiskQuota can be increased to?