Problem with the number of search artifacts in the dispatch directory is higher than recommended and could have an impact on search performance.

[tinpelayee]

Hello,

I have a problem with this alert,

{The number of search artifacts in the dispatch directory, is higher than recommender (count=7815 , warning threshold=5000) and could have an impact on search performance.}

read other answers and erase the dispatch directory [: /opt/splunk/var/run/splunk/dispatch]

, but this alert is still appearing.

Is any other solution of this alert?

how can i change the time for this alert?

Thanks , sorry for my english!

[adonio · Accepted solution]

many answers here:
https://answers.splunk.com/answers/29551/too-many-search-jobs-found-in-the-dispatch-directory.html
https://answers.splunk.com/answers/558452/too-many-search-jobs-found-in-the-dispatch-directo-3.html
https://answers.splunk.com/answers/418580/too-many-search-jobs-found-in-the-dispatch-directo-5.html

hope it helps