Alerting

Problem with the number of search artifacts in the dispatch directory is higher than recommended and could have an impact on search performance.

tinpelayee
Engager

Hello,

I have a problem with this alert,

{The number of search artifacts in the dispatch directory, is higher than recommender (count=7815 , warning threshold=5000) and could have an impact on search performance.}

read other answers and erase the dispatch directory [: /opt/splunk/var/run/splunk/dispatch]

, but this alert is still appearing.

Is any other solution of this alert?

how can i change the time for this alert?

Thanks , sorry for my english!

0 Karma
1 Solution
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.