Hello,
I have a problem with this alert,
{The number of search artifacts in the dispatch directory, is higher than recommender (count=7815 , warning threshold=5000) and could have an impact on search performance.}
read other answers and erase the dispatch directory [: /opt/splunk/var/run/splunk/dispatch]
, but this alert is still appearing.
Is any other solution of this alert?
how can i change the time for this alert?
Thanks , sorry for my english!
many answers here:
https://answers.splunk.com/answers/29551/too-many-search-jobs-found-in-the-dispatch-directory.html
https://answers.splunk.com/answers/558452/too-many-search-jobs-found-in-the-dispatch-directo-3.html
https://answers.splunk.com/answers/418580/too-many-search-jobs-found-in-the-dispatch-directo-5.html
hope it helps
many answers here:
https://answers.splunk.com/answers/29551/too-many-search-jobs-found-in-the-dispatch-directory.html
https://answers.splunk.com/answers/558452/too-many-search-jobs-found-in-the-dispatch-directo-3.html
https://answers.splunk.com/answers/418580/too-many-search-jobs-found-in-the-dispatch-directo-5.html
hope it helps