Dashboards & Visualizations

Dispatch Directory: Can searches be set to no populate this?

asherman
Path Finder

Hi,

I don't entirely understand the purpose of this directory, but I get a lot of "Too many search jobs found in the dispatch directory..." warnings. None have ever seemed to actually impede the performance, but it does bother alarm users. I believe they are stemming from dropdown menu population searches that are sequences of nested "|set intersect [query] [|set intersect [query] [...]]".

I don't want these constantly filling up the dispatch directory and requiring maintenance - can I stop this (in particular for a dropdown menu population search), or is that a necessary part of the search process? Further, is it possible to hide these warnings from users?

Thanks.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could increase the dispatch_dir_warning_size in limits.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/limitsconf

asherman
Path Finder

I am aware, but I don't want to do that in the event some other app or use starts spawning tons of searches and this could be a valid indicator of an real issue.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>