https://community.splunk.com/t5/Alerting/Alert-sending-multiple-emails/m-p/55831#M781 <P>Have a configuration with two splunk servers(logging01 and logging02) configured with shared configuration processing syslog data. The two servers are behind a load balancer.</P> <P>Created an alert which sends an email.</P> <P>Everytime a single alert fires I receive two emails. </P> <P>From the smtp server's logs I see both servers sending the same email.</P> <P>Is there anyway to prevents this, so only a single email is sent?</P> Thu, 05 Sep 2013 20:58:39 GMT penguincrow 2013-09-05T20:58:39Z https://community.splunk.com/t5/Alerting/Alert-sending-multiple-emails/m-p/55831#M781 <P>Have a configuration with two splunk servers(logging01 and logging02) configured with shared configuration processing syslog data. The two servers are behind a load balancer.</P> <P>Created an alert which sends an email.</P> <P>Everytime a single alert fires I receive two emails. </P> <P>From the smtp server's logs I see both servers sending the same email.</P> <P>Is there anyway to prevents this, so only a single email is sent?</P> Thu, 05 Sep 2013 20:58:39 GMT https://community.splunk.com/t5/Alerting/Alert-sending-multiple-emails/m-p/55831#M781 penguincrow 2013-09-05T20:58:39Z https://community.splunk.com/t5/Alerting/Alert-sending-multiple-emails/m-p/55832#M782 <P>If you have 2 Search-heads with the same configuration, then all your searches will run twice (one on each)</P> <P>The proper ways to proceed are :</P> <UL> <LI>dedicate a single search-head to run your jobs/scheduled searches</LI> <LI>or use search-head pooling to actually load balance the search jobs.</LI> </UL> Thu, 05 Sep 2013 21:13:31 GMT https://community.splunk.com/t5/Alerting/Alert-sending-multiple-emails/m-p/55832#M782 yannK 2013-09-05T21:13:31Z