Dispatch Directory: Can searches be set to no populate this?

[asherman]

Hi,

I don't entirely understand the purpose of this directory, but I get a lot of "Too many search jobs found in the dispatch directory..." warnings. None have ever seemed to actually impede the performance, but it does bother alarm users. I believe they are stemming from dropdown menu population searches that are sequences of nested "|set intersect [query] [|set intersect [query] [...]]".

I don't want these constantly filling up the dispatch directory and requiring maintenance - can I stop this (in particular for a dropdown menu population search), or is that a necessary part of the search process? Further, is it possible to hide these warnings from users?

Thanks.

[martin_mueller]

You could increase the dispatch_dir_warning_size in limits.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/limitsconf

[asherman]

I am aware, but I don't want to do that in the event some other app or use starts spawning tons of searches and this could be a valid indicator of an real issue.