Deployment Architecture

Dispatch folder constantly filling up

ajparagas
Engager

We have a question as the dispatch folder seems to be constantly growing. However, our storage for the splunk is 200G and we are still seeing the index error and would like to know how to resolve this issue.

Thanks,

Tags (3)

piebob
Splunk Employee
Splunk Employee

i'm taking a guess here that you're seeing an error about performance possibly being impacted due to the number of jobs in your dispatch directory. if that's the case and what you're asking is to make the error go away, you can change the value of dispatch_dir_warning_size in $SPLUNK_HOME/etc/system/local/limits.conf to something higher.

if that's not it, please be more specific about the 'index error' you're seeing.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...