Alerting

Problem with the number of search artifacts in the dispatch directory is higher than recommended and could have an impact on search performance.

tinpelayee
Engager

Hello,

I have a problem with this alert,

{The number of search artifacts in the dispatch directory, is higher than recommender (count=7815 , warning threshold=5000) and could have an impact on search performance.}

read other answers and erase the dispatch directory [: /opt/splunk/var/run/splunk/dispatch]

, but this alert is still appearing.

Is any other solution of this alert?

how can i change the time for this alert?

Thanks , sorry for my english!

0 Karma
1 Solution
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!