I don't know why the DispatchReaper quits doing it's job, but restarting the Splunk daemon puts it back in order. I've created an alert which looks for the warnings about expired and unreaped artifacts and added some instructions about restarting Splunk. index=_internal "WARN DispatchReaper - Found" "expired and unreaped" AND NOT "StreamedSearch" I guess that's good enough. I'm still curious why the DispatchReaper just stops reaping. ... View more