Hi,
For trouble shooting and Alerting purposes, i would like to be able to monitor the number of current active artefacts objects in the dispatch directory of our search heads ($SPLUNK_HOME/var/run/splunk/dispatch) in a sh cluster deployment.
As Splunk warns when there more artefacts than the default limits i guess it should be able to retrieve the number of artefacts in internal Splunk logs, _internal, _audit, _introspection or | rest command ?
Could not find the good search yet, is it possible ?
Thank you in advance.
Guilhem
↧