https://community.splunk.com/t5/Deployment-Architecture/Alert-for-Master-License-Server-down/m-p/57990#M1929 <P>I want to set up an alert to notify when the master license server (one search head) goes down. What should I query for finding this out from an indexer that is pointing to it?</P> Mon, 10 Dec 2012 05:01:51 GMT pdash 2012-12-10T05:01:51Z https://community.splunk.com/t5/Deployment-Architecture/Alert-for-Master-License-Server-down/m-p/57990#M1929 <P>I want to set up an alert to notify when the master license server (one search head) goes down. What should I query for finding this out from an indexer that is pointing to it?</P> Mon, 10 Dec 2012 05:01:51 GMT https://community.splunk.com/t5/Deployment-Architecture/Alert-for-Master-License-Server-down/m-p/57990#M1929 pdash 2012-12-10T05:01:51Z https://community.splunk.com/t5/Deployment-Architecture/Alert-for-Master-License-Server-down/m-p/57991#M1930 <P>Check out:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Aboutlicenseviolations#About_the_connection_between_the_license_master_and_license_slaves">http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Aboutlicenseviolations#About_the_connection_between_the_license_master_and_license_slaves</A></P> <P>The following search should work:<BR /> index="_internal" source="*splunkd.log" "failed to transfer rows"</P> Mon, 10 Dec 2012 19:05:34 GMT https://community.splunk.com/t5/Deployment-Architecture/Alert-for-Master-License-Server-down/m-p/57991#M1930 dmillis 2012-12-10T19:05:34Z https://community.splunk.com/t5/Deployment-Architecture/Alert-for-Master-License-Server-down/m-p/57992#M1931 <P>Correction: Its<BR /> index="_internal" source="*splunkd.log" "failed to send rows"</P> Wed, 12 Dec 2012 00:02:44 GMT https://community.splunk.com/t5/Deployment-Architecture/Alert-for-Master-License-Server-down/m-p/57992#M1931 pdash 2012-12-12T00:02:44Z