In 6.5 it looks like there is a new metric event that tracks the dispatch reaper. You can view it with
index=_internal sourcetype=splunkd dispatch_dir_reaper_mean_ms
Consistently the value for dispatch_dir_reaper_mean_ms is several orders of magnitude higher than dispatch_dir_reaper_max_ms, which is strange considereing the field names
Has anyone else seen this or know if it signifies anything?
From the 6.5.3 release notes, it appears that this is a known issue:
2016-09-15 SPL-128845, SPL-131108, SPL-131106 Distributed Search: Deployment -- Time to Reap : Dispatch Directory ... max < average time
View solution in original post