One of our Splunk users is running the following search:
index=customindex fieldip!=10.0.0.0/8 fieldip!="0.0.0.0" | fields fieldip | dedup fieldip|table fieldip | outputlookup outputfiiledip.csv append=true
(Time period 7 days)
and getting the following error message: WARN DispatchThread :Search auto-finalized after disk usage limit (500mb) reached
1) Is there any workaround this warning without changing limits.conf by increasing srchDiskQuota ?
2) Is there a limit to what srchDiskQuota can be increased to?
The following can help - Search auto-finalized after disk usage limit (100mb) reached - What does this mean?
@ddrillic , thank you for a quick reply. Unfortunately, the link doesn't answer my questions.
Sorry about that.
-- 2) Is there a limit to what srchDiskQuota can be increased to?
Most likely, the capacity of the specific file system.