Archive

Too many search jobs found in the dispatch directory (found=28834, warning level=2000). This could negatively impact Splunk's performance, consider removing some of the old search jobs.

Path Finder

The above warning message is displayed in th GUI with the following error message:

[JobManager module] Splunkd daemon is not responding:

I am running Splunk version 6.0. Can someone assist in locating this dispatch folder in Ubuntu and how to fix this issue automatically.

Thanks

UA

Tags (1)
0 Karma

Builder

There are some more things you can do to try to aviod this;
(in addition to bwooden:s suggestion)

In limits.conf increase the following ;
[search]
dispatch_dir_warning_size =

For your searches / savedsearches.conf add the following or decrese these accordingly;
[NameOfSearch]
dispatch.ttl = 1h

In the UI for your search set the expiration shortest possible .

Splunk Employee
Splunk Employee

The dispatch folder is traditionally found in $SPLUNK_HOME/var/run/splunk/dispatch

To clean it safely, you may use the clean-dispatch command.