Re: Dispatch Runner: This typically reflects under...

verbal_666 · ‎07-09-2021

Hi all.

I would like to know if there is a method to avoid displaying the boring messages,

[INDEXER] Dispatch Runner: Configuration initialization for /opt/splunk/var/run/searchpeers/81F8C272-511D-4FBA-A2EA-F87129051744-1625835689 took longer than expected (3260ms) when dispatching a search (search ID: remote_SH_xxx__xxx__xxx__xxx_1625837471.443922_07316CBA-2692-4C41-B9C4-89500E9141D2); this typically reflects underlying storage performance issues

inside the SearchHead(s) Environment, FROM Indexer(s) Environment.

System is up & running, heavy load, i know, and disks are very sollecitated.
This message is really annoing, i know it's not a blocking-warning (storage is under "stress"), since there are many dashboards with some panels in which the warnings completely break the visual layout.

I tried to search, but seems there's no "solution".

Any idea? I CAN'T upgrade storage and disks!

Thanks.

verbal_666 · ‎04-01-2022

If someone else has the same problem, and the same annoying warning icon, it can by bypassed by hiding the corrispective css object,

<html><style>#style, .error-details {display: none !important;}</style></html>

For me, this way, makes the job 👍

Dispatch Runner: This typically reflects underlying storage performance issues

Linux

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Splunk Life | Happy Pride Month!

SplunkTrust | Where Are They Now - Michael Uschmann