Deployment Architecture

Increasing the dispatch_dir_warning_size

ssankeneni
Communicator

I am getting this warning on my search heads and I have increased my search limit to 30,000 on limits.conf file
[search]
dispatch_dir_warning_size = 30000

Is this going to have any issues ? The default one is 2000

Tags (2)
0 Karma

jbsplunk
Splunk Employee
Splunk Employee

If you've got a lot of results in the dispatch folder, your search performance is going to degrade. The downside of making the warning size so large is that your search performance is likely going to be negatively effected before you've been warned about the size of the folder.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...