https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/700580#M237708 <P>Hi</P><P><A href="https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/48389" target="_blank">https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/48389</A></P><P>This gives me the current dispatch count - I am looking to make a time chart. Using rest _time does not come back so I can't make a time chart.</P><P>I am thinking if I run the command each minute in a saved search and output to a .csv with a timestamp that might work!</P> Mon, 30 Sep 2024 16:07:57 GMT robertlynch2020 2024-09-30T16:07:57Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/700558#M237704 <P>Hi&nbsp;</P><P>I am looking to monitor the dispatch directory over time.</P><P>I know I can get the current results by using this</P><PRE>| rest /services/search/jobs | stats count</PRE><P>But I am looking to run the test over 1 minute and have a breakdown per minute of the increase in dispatch over time.</P><P>Rob&nbsp;</P> Mon, 30 Sep 2024 15:05:13 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/700558#M237704 robertlynch2020 2024-09-30T15:05:13Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/700567#M237706 <P>This has been answered here:&nbsp;<A href="https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/48389" target="_blank">https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/48389</A><BR /><BR />You can leverage this search and see if that helps for your monitoring.<BR /><BR /></P><LI-CODE lang="markup">index=_internal sourcetype=splunkd The number of search artifacts in the dispatch directory is higher than recommended TERM(count=*) | timechart span=1h max(count)</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Please upvote if this is helpful.</P> Mon, 30 Sep 2024 15:36:40 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/700567#M237706 sainag_splunk 2024-09-30T15:36:40Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/700580#M237708 <P>Hi</P><P><A href="https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/48389" target="_blank">https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/48389</A></P><P>This gives me the current dispatch count - I am looking to make a time chart. Using rest _time does not come back so I can't make a time chart.</P><P>I am thinking if I run the command each minute in a saved search and output to a .csv with a timestamp that might work!</P> Mon, 30 Sep 2024 16:07:57 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/700580#M237708 robertlynch2020 2024-09-30T16:07:57Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/700583#M237710 Are you looking dispatch directory or how many search jobs are running? If later then you can use _audit index to get number of jobs. Mon, 30 Sep 2024 16:38:19 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/700583#M237710 isoutamo 2024-09-30T16:38:19Z