Splunk Search

Maximun disk usage quota- Why are alerts not sending?

bolopez
Explorer

Hello,

I have a Splunk Cloud deployment and the alerts are not firing. I have searched for information and using the search index=_internal sourcetype=scheduler status="skipped" savedsearch_name="search_name" you can see why the alerts are not going off. It says that the maximum disk usage quota for this user has been reached. The thing is that these alerts have no owner, the owner is "nobody", so if I am not mistaken the maximum disk usage quota is the default one. I think they don't recommend to change the default maximum disk usage quota.

I need these alerts to trigger, what can I do to fix this problem?

Thanks in advance and best regards.

0 Karma
1 Solution

bolopez
Explorer

Hi @effem2,

Thank you for your response! The truth is that I already solved the problem and I forgot that I had this question open. The reason this happened was that the alerts not having an owner was using the default maximum disk usage quota. It was solved by adding an owner to the alerts.

Regards

View solution in original post

0 Karma

effem2
Path Finder

Its hard to say without a search-example.  Could you post an example-search, which has the issue?

Usually 

|fields - _raw

does help already.

0 Karma

bolopez
Explorer

Hi @effem2,

Thank you for your response! The truth is that I already solved the problem and I forgot that I had this question open. The reason this happened was that the alerts not having an owner was using the default maximum disk usage quota. It was solved by adding an owner to the alerts.

Regards

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...