InterviewSolution
| 1. |
What Is Dispatch Directory? |
|
Answer» $SPLUNK_HOME/var/run/splunk/dispatch contains a directory for each search that is running or has COMPLETED. For example, a directory NAMED 1434308943.358 will contain a CSV file of its search RESULTS, a search.log with details about the search execution, and other stuff. Using the defaults (which you can override in limits.conf), these directories will be deleted 10 minutes after the search completes – unless the user saves the search results, in which case the results will be deleted after 7 DAYS. $SPLUNK_HOME/var/run/splunk/dispatch contains a directory for each search that is running or has completed. For example, a directory named 1434308943.358 will contain a CSV file of its search results, a search.log with details about the search execution, and other stuff. Using the defaults (which you can override in limits.conf), these directories will be deleted 10 minutes after the search completes – unless the user saves the search results, in which case the results will be deleted after 7 days. |
|