https://community.splunk.com/t5/Splunk-Search/Dispatch-Alert-Question/m-p/445494#M126368 <P>all, </P> <P>I am getting a dispatch count alert . Indexers and search heads have plenty of RAM, CPU and IO is almost nothing. I can't think of a reason for this to start to backup. Honestly the environment is under almost no load. </P> <P>My knee jerk here is to increase the jobs per CPU count. But wondering what others think here?</P> <PRE><CODE>Dispatch Command: The number of search artifacts in the dispatch directory is higher than recommended (count=6444, warning threshold=5000) and could have an impact on search performance. Remove excess search artifacts using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf and savedsearches.conf. You can also raise this warning threshold in limits.conf / dispatch_dir_warning_size. </CODE></PRE> Wed, 26 Dec 2018 17:34:17 GMT daniel333 2018-12-26T17:34:17Z https://community.splunk.com/t5/Splunk-Search/Dispatch-Alert-Question/m-p/445494#M126368 <P>all, </P> <P>I am getting a dispatch count alert . Indexers and search heads have plenty of RAM, CPU and IO is almost nothing. I can't think of a reason for this to start to backup. Honestly the environment is under almost no load. </P> <P>My knee jerk here is to increase the jobs per CPU count. But wondering what others think here?</P> <PRE><CODE>Dispatch Command: The number of search artifacts in the dispatch directory is higher than recommended (count=6444, warning threshold=5000) and could have an impact on search performance. Remove excess search artifacts using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf and savedsearches.conf. You can also raise this warning threshold in limits.conf / dispatch_dir_warning_size. </CODE></PRE> Wed, 26 Dec 2018 17:34:17 GMT https://community.splunk.com/t5/Splunk-Search/Dispatch-Alert-Question/m-p/445494#M126368 daniel333 2018-12-26T17:34:17Z https://community.splunk.com/t5/Splunk-Search/Dispatch-Alert-Question/m-p/445495#M126369 <P>Did you try cleaning dispatch directory?</P> Thu, 27 Dec 2018 07:36:33 GMT https://community.splunk.com/t5/Splunk-Search/Dispatch-Alert-Question/m-p/445495#M126369 p_gurav 2018-12-27T07:36:33Z https://community.splunk.com/t5/Splunk-Search/Dispatch-Alert-Question/m-p/445496#M126370 <P><STRONG>this solution i think work buddy</STRONG><BR /> ./splunk clean-dispatch run the command<BR /> splunkd clean-dispatch '' ''</P> Wed, 16 Oct 2019 06:21:05 GMT https://community.splunk.com/t5/Splunk-Search/Dispatch-Alert-Question/m-p/445496#M126370 zippyopsadmin 2019-10-16T06:21:05Z https://community.splunk.com/t5/Splunk-Search/Dispatch-Alert-Question/m-p/445497#M126371 <P>could you please let me know where should i clean is it in indexer or search head ? i got message on one of the dev search head saying that "search peer has following message " . so , where should i run the below command if clean dispatch is it impacts anything ?</P> Sat, 16 May 2020 16:14:42 GMT https://community.splunk.com/t5/Splunk-Search/Dispatch-Alert-Question/m-p/445497#M126371 90509 2020-05-16T16:14:42Z