Dashboards & Visualizations
Highlighted

Dispatch Directory: Can searches be set to no populate this?

Path Finder

Hi,

I don't entirely understand the purpose of this directory, but I get a lot of "Too many search jobs found in the dispatch directory..." warnings. None have ever seemed to actually impede the performance, but it does bother alarm users. I believe they are stemming from dropdown menu population searches that are sequences of nested "|set intersect [query] [|set intersect [query] [...]]".

I don't want these constantly filling up the dispatch directory and requiring maintenance - can I stop this (in particular for a dropdown menu population search), or is that a necessary part of the search process? Further, is it possible to hide these warnings from users?

Thanks.

0 Karma
Highlighted

Re: Dispatch Directory: Can searches be set to no populate this?

SplunkTrust
SplunkTrust

You could increase the dispatch_dir_warning_size in limits.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/limitsconf

Highlighted

Re: Dispatch Directory: Can searches be set to no populate this?

Path Finder

I am aware, but I don't want to do that in the event some other app or use starts spawning tons of searches and this could be a valid indicator of an real issue.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.