Splunk Search

Problem with quota for splunk-system-user


Hi Splunkers,

we had copied many searches to the search head node from indexer and now we have many errors like this: DispatchManager - Search not executed: reason="The maximum disk usage quota for this user has been reached.", usage=12513MB, quota=10000MB, user=splunk-system-user.
In Savedsearch menu all these failed searches are owned by nobody.
In Jobs menu there are many searches with status Done and size around 128 Mb, but the size of the dispatch folder does not correspond to the size of searches in Jobs menu (is it normal?).

We've increased quota up to 30 Gb, and this didn't help.

How can we resolve it or where to look at? Will reassignment to other user help?

0 Karma