Each search or alert that run creates a search artifact that must be saved to disk. The artifacts are stored in directories under the dispatch directory. For each search job, there is one search-specific directory.  A directory is included in the Dispatch Directory for each search that is running or has been completed. When the job expires, the search-specific directory is deleted. The Dispatch Directory is configured as follows:   $SPLUNK_HOME/var/run/splunk/dispatch   We can take an example of a directory something named like 1346978195.13.   This directory includes a CSV file of all search results, a search.log containing details/information about the search execution, as well as other pertinent information