Splunk Search

Dispatch Alert Question

daniel333
Builder

all,

I am getting a dispatch count alert . Indexers and search heads have plenty of RAM, CPU and IO is almost nothing. I can't think of a reason for this to start to backup. Honestly the environment is under almost no load.

My knee jerk here is to increase the jobs per CPU count. But wondering what others think here?

Dispatch Command: The number of search artifacts in the dispatch directory is higher than recommended (count=6444, warning threshold=5000) and could have an impact on search performance. Remove excess search artifacts using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf and savedsearches.conf. You can also raise this warning threshold in limits.conf / dispatch_dir_warning_size.
0 Karma

zippyopsadmin
New Member

this solution i think work buddy
./splunk clean-dispatch run the command
splunkd clean-dispatch '' ''

0 Karma

p_gurav
Champion

Did you try cleaning dispatch directory?

0 Karma

90509
Engager

could you please let me know where should i clean is it in indexer or search head ? i got message on one of the dev search head saying that "search peer has following message " . so , where should i run the below command if clean dispatch is it impacts anything ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...