Splunk Search

Is there a permanent solution for handling too many search jobs found in the dispatch directory?



I am getting this error:

Too many search jobs found in the dispatch directory (found=7079, warning level = 5000)

So I ran a script via CLI multiple times to delete all the search jobs in the dispatch folder, but it seems that it keeps repopulating back to ~7k search jobs the day after. Is there a permanent way to resolve this issue?

0 Karma

Community Manager
Community Manager

Hi @sunhoo

There have been several questions in the forum on this very topic lately, but one of them has been particularly helpful. Check out the answers by sowings_splunk and yannK in this post:

Here's the page from Splunk documentation that covers maintenance of the dispatch directory by tuning the TTL for different search artifacts:

0 Karma