Dashboards & Visualizations

Dispatch Directory: Can searches be set to no populate this?

asherman
Path Finder

Hi,

I don't entirely understand the purpose of this directory, but I get a lot of "Too many search jobs found in the dispatch directory..." warnings. None have ever seemed to actually impede the performance, but it does bother alarm users. I believe they are stemming from dropdown menu population searches that are sequences of nested "|set intersect [query] [|set intersect [query] [...]]".

I don't want these constantly filling up the dispatch directory and requiring maintenance - can I stop this (in particular for a dropdown menu population search), or is that a necessary part of the search process? Further, is it possible to hide these warnings from users?

Thanks.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could increase the dispatch_dir_warning_size in limits.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/limitsconf

asherman
Path Finder

I am aware, but I don't want to do that in the event some other app or use starts spawning tons of searches and this could be a valid indicator of an real issue.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...