Where does batch search write temp files?

[lycollicott]

I am seeing this error on panels:

[indexer01]  Streamed search execute failed because: Error in 'BatchSearch': The search failed. Unable to write temp files to disk.

Where is it trying to write? (Yes, it's Windows and I know that Windows permissions suck.)

[jkat54 · Accepted solution]

Depends on your splunk version but usually its here or somewhere within: C:\Program Files\Splunk\var\run

[jkat54]

I think its talking about the dispatch dir though:

C:\Program Files\Splunk\var\run\splunk\dispatch

[lycollicott]

Thanks for confirming.

[jkat54]

Anytime! 🙂