Hi Splunkers,
we had copied many searches to the search head node from indexer and now we have many errors like this: `DispatchManager - Search not executed: reason="The maximum disk usage quota for this user has been reached.", usage=12513MB, quota=10000MB, user=splunk-system-user`.
In Savedsearch menu all these failed searches are owned by `nobody`.
In Jobs menu there are many searches with status `Done` and size around 128 Mb, but the size of the `dispatch` folder does not correspond to the size of searches in Jobs menu (is it normal?).
We've increased quota up to 30 Gb, and this didn't help.
How can we resolve it or where to look at? Will reassignment to other user help?
↧