Hi,
I don't entirely understand the purpose of this directory, but I get a lot of "Too many search jobs found in the dispatch directory..." warnings. None have ever seemed to actually impede the performance, but it does bother alarm users. I believe they are stemming from dropdown menu population searches that are sequences of nested "|set intersect [query] [|set intersect [query] [...]]".
I don't want these constantly filling up the dispatch directory and requiring maintenance - can I stop this (in particular for a dropdown menu population search), or is that a necessary part of the search process? Further, is it possible to hide these warnings from users?
Thanks.
You could increase the dispatch_dir_warning_size
in limits.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/limitsconf
I am aware, but I don't want to do that in the event some other app or use starts spawning tons of searches and this could be a valid indicator of an real issue.