I am experiencing this as a continues notification in my environment:
Search peer has the following message: The number of search artifacts in the dispatch directory is higher than recommended (count=12025, warning threshold=10000) and could have an impact on search performance. Remove excess search artifacts using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf and savedsearches.conf. You can also raise this warning threshold in limits.conf
what could be the key checkpoints for this investigation. I would like to find out the root cause as which user is triggering those searches or which dashboards are not optimized or any other specific reason for this?
I am already running rest searches and checking schedule searches running every min but Any pointers will be helpful to make sure what are the solutions available for this.
