Knowledge Management

How to nail it down The number of search artifacts in the dispatch directory is higher than recommended

orca
Explorer

 

I am experiencing this as a continues notification in my environment:

Search peer  has the following message: The number of search artifacts in the dispatch directory is higher than recommended (count=12025, warning threshold=10000) and could have an impact on search performance. Remove excess search artifacts using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf and savedsearches.conf. You can also raise this warning threshold in limits.conf

what could be the key checkpoints for this investigation. I would like to find out the root cause as which user is triggering those searches or which dashboards are not optimized or any other specific reason for this?

I am already running rest searches and checking schedule searches running every min but Any pointers will be helpful to make sure what are the solutions available for this. 

Labels (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.