topic If a search head goes down do alerts queue until it returns? in Alerting https://community.splunk.com/t5/Alerting/If-a-search-head-goes-down-do-alerts-queue-until-it-returns/m-p/560500#M10673 <P>We have one ES search head in a distributed environment.</P><P>1. If the search head goes down, do alerts queue up and trigger actions once Splunk is back up?</P><P>2. If yes, for what period of time are alerts retained for?</P><P>Thank you.&nbsp;</P> Thu, 22 Jul 2021 15:58:12 GMT Munju1 2021-07-22T15:58:12Z If a search head goes down do alerts queue until it returns? https://community.splunk.com/t5/Alerting/If-a-search-head-goes-down-do-alerts-queue-until-it-returns/m-p/560500#M10673 <P>We have one ES search head in a distributed environment.</P><P>1. If the search head goes down, do alerts queue up and trigger actions once Splunk is back up?</P><P>2. If yes, for what period of time are alerts retained for?</P><P>Thank you.&nbsp;</P> Thu, 22 Jul 2021 15:58:12 GMT https://community.splunk.com/t5/Alerting/If-a-search-head-goes-down-do-alerts-queue-until-it-returns/m-p/560500#M10673 Munju1 2021-07-22T15:58:12Z Re: If a search head goes down do alerts queue until it returns? https://community.splunk.com/t5/Alerting/If-a-search-head-goes-down-do-alerts-queue-until-it-returns/m-p/560507#M10674 <P>If a search head goes down no Splunk work can be done so there is no queuing of searches/alerts.&nbsp; Once the SH comes back up then searches will execute at their next interval.&nbsp; There is no "catch-up".</P> Thu, 22 Jul 2021 17:14:10 GMT https://community.splunk.com/t5/Alerting/If-a-search-head-goes-down-do-alerts-queue-until-it-returns/m-p/560507#M10674 richgalloway 2021-07-22T17:14:10Z