We have a single searchhead that continually fills up the dispatch directory. I manually have to go in and clear it out. There's nothing special about this searchhead and I've even gone so far as to take it out of our load balancer such that only scheduled searches are being ran against it, yet still the dispatch directory continually ends up filling back up.
What could be some areas I can look into to try and troubleshoot why a single searchhead would have such trouble clearing out its dispatch directory?
Can you check if some user schedule real-time search for longer time range?
real-time searches fill up dispatch directory very fast.