I am trying to clean out the dispatch directory on our search head. I am using the command:
splunkd clean-dispatch D:\temp -1day
when the above is used splunk returns the below message:
SPLUNK_HOME must be set. Stopping.
I cannot get it to clean the dispatch directory. Has anyone had a similar issue? How did you resolve?
We are running slunk version 4.3.4 on a windows machine.
C:\Documents and Settings\Administrator>cd "\Program Files\Splunk\bin"
C:\Program Files\Splunk\bin>mkdir %TEMP%\splunk_dispatch
C:\Program Files\Splunk\bin>splunk cmd splunkd clean-dispatch %TEMP%\splunk_dispatch -1d
Using logging configuration at C:\Program Files\Splunk\etc\log-cmdline.cfg.
dispatch dir: C:\Program Files\Splunk\var\run\splunk\dispatch
destination dir: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\splunk_dispatch
earliest mod time: 2013-10-14T09:32:31.000-07:00
total: 0, moved: 0, failed: 0, remaining: 0 job directories from C:\Program Files\Splunk\var\run\splunk\dispatch to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\splunk_dispatch
C:\Program Files\Splunk\bin>
C:\Documents and Settings\Administrator>cd "\Program Files\Splunk\bin"
C:\Program Files\Splunk\bin>mkdir %TEMP%\splunk_dispatch
C:\Program Files\Splunk\bin>splunk cmd splunkd clean-dispatch %TEMP%\splunk_dispatch -1d
Using logging configuration at C:\Program Files\Splunk\etc\log-cmdline.cfg.
dispatch dir: C:\Program Files\Splunk\var\run\splunk\dispatch
destination dir: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\splunk_dispatch
earliest mod time: 2013-10-14T09:32:31.000-07:00
total: 0, moved: 0, failed: 0, remaining: 0 job directories from C:\Program Files\Splunk\var\run\splunk\dispatch to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\splunk_dispatch
C:\Program Files\Splunk\bin>