[报错解决] ERROR: “The number of search artifacts in the dispatch directory is higher than recommended“

shenghuiping2001

已于 2023-11-15 20:09:27 修改

阅读量134

点赞数

分类专栏： splunk 文章标签： splunk limits dispatch

于 2023-11-15 20:08:32 首次发布

本文链接：https://blog.csdn.net/shenghuiping2001/article/details/134428337

版权

splunk 专栏收录该内容

206 篇文章 16 订阅 ¥39.90 ¥99.00

订阅专栏

超级会员免费看

当dispatch目录中的搜索工件数量超过推荐值（默认阈值为5000）时，会出现错误消息，影响搜索性能。解决方法包括：访问limits.conf文件，修改dispatch_dir_warning_size属性至更高值，然后重启Splunk。

摘要由CSDN通过智能技术生成

Description

Message on Search Head GUI:

"The number of search artifacts in the dispatch directory is higher than recommended (count=11200, 
warning threshold=5000) and could have an impact on search performance. Remove excess search artifacts
using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf 
and savedsearches.conf. You can also raise this warning threshold in limits.conf / 
dispatch_dir_warning_size. Learn more."

Investigation

The message is related to dispatch_dir_warni ng_size attribute in limits.conf file, it happens when the number of search artifacts in the dispatch directory is higher than recommended (defaul