https://community.splunk.com/t5/Alerting/How-to-move-alerts-on-different-server/m-p/241973#M4495 <P>You can run alerts both in search head and indexer until you have only one indexer (or an indexer cluster).<BR /> To move them from indexer to search head, you have to copy app that contains alerts and disable alerts in indexer.<BR /> Bye.<BR /> Giuseppe </P> Tue, 11 Oct 2016 11:46:42 GMT gcusello 2016-10-11T11:46:42Z https://community.splunk.com/t5/Alerting/How-to-move-alerts-on-different-server/m-p/241972#M4494 <P>In order to improve the Splunk performance in a single server installation I added a search head - The new server is now also a master licensing server and the previous one is configured as slave - </P> <P>Should be possible to move from the old index server to the new search head the alerts generation or is a role/function that runs only on the index server. </P> Tue, 11 Oct 2016 09:40:18 GMT https://community.splunk.com/t5/Alerting/How-to-move-alerts-on-different-server/m-p/241972#M4494 arkonner 2016-10-11T09:40:18Z https://community.splunk.com/t5/Alerting/How-to-move-alerts-on-different-server/m-p/241973#M4495 <P>You can run alerts both in search head and indexer until you have only one indexer (or an indexer cluster).<BR /> To move them from indexer to search head, you have to copy app that contains alerts and disable alerts in indexer.<BR /> Bye.<BR /> Giuseppe </P> Tue, 11 Oct 2016 11:46:42 GMT https://community.splunk.com/t5/Alerting/How-to-move-alerts-on-different-server/m-p/241973#M4495 gcusello 2016-10-11T11:46:42Z