topic Re: Are there limitations on the number of real-time alerts that one user creates? in Alerting

Are there limitations on the number of real-time alerts that one user creates?

benjaminmeyers — Thu, 03 Dec 2015 16:54:21 GMT

Mainly I'm curious because one of my users asked me, but are there limitations on the number of Real-Time alerts that one user creates?

The reason I ask is because there are several users on the search head that can continue to search, but since user A has created 4 Real-Time alerts, whenever he goes to do a manual search, it gets queued. That search will stay queued until he either deletes or disables at least one of the Real-Time alerts.

Re: Are there limitations on the number of real-time alerts that one user creates?

woodcock — Fri, 04 Dec 2015 22:10:40 GMT

You can control the ability overall with the built-in roles but it is binary, not quantitative. Also, the HW itself limits it because every Real-Time search consumes 1 CPU core permanently forever. This is why you should be VERY careful about Real-Time and make sure that you SPECIFICALLY engineer (over-build) your cluster with this in mind or you are going to have VERY big regrets and much pain.