Splunk Search

Problem with quota for splunk-system-user- Why does size of dispatch folder not correspond to searches in Jobs menu?

evelenke
Contributor

Hi Splunkers,

we had copied many searches to the search head node from indexer and now we have many errors like this: DispatchManager - Search not executed: reason="The maximum disk usage quota for this user has been reached.", usage=12513MB, quota=10000MB, user=splunk-system-user.
In Savedsearch menu all these failed searches are owned by nobody.
In Jobs menu there are many searches with status Done and size around 128 Mb, but the size of the dispatch folder does not correspond to the size of searches in Jobs menu (is it normal?).

We've increased quota up to 30 Gb, and this didn't help.

How can we resolve it or where to look at? Will reassignment to other user help?

Labels (1)
0 Karma

effem2
Path Finder

This issue can be caused by a static blocksize in the filesystem.  Indications ist the regular occurance of 128M or 250/255/256M sizes across search-results. Splunk does read the blocksizes in full. 

Run "mount" on your cli to see what the mount options are for your filesystem.

In example if you use XFS and you see an option like allocsize=<a big number>, then just get rid of this option. 

Usually the default option are sufficient anyways.

0 Karma

andygerberkp
Explorer

We had this problem on our monitoring console after an upgrade to 8.1.5. Root cause was the DMC Alert - Missing forwarders search - in our very large environment, it was running every 15 minutes and generating 250M of results. This search is set to keep results for 24 hours.  So that's 24G of results in a day.  Changed the settings to keep results for only one hour, and the solved the problem.

In any case, look at the "jobs" on the host and sort by size. You may see something similar - a frequently running job that is saving all results for too long.

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...