今天客户的搜索量很大,碰到搜索限制的警告:
后来研究了一下:
这种解决方法:
1: In search head $SPLUNK_HOME/etc/system/local/authorize.conf put [your_role]
srchDiskQuota = 500 MB(currently)
The maximum amount of disk space (MB) that can be used by search jobs of a user that belongs to this role will take this value.
your_role is allowed to take up 500 megabytes total on disk for now on all their jobs.
2: Please restart the Splunk service once the changes are done.
结果按照上面的方法试了就可以了。
参照splunk :