https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506677#M9215 <P>So, what is the best solution if I want to run real-time alert ?</P> Tue, 30 Jun 2020 13:10:54 GMT mathiasy123 2020-06-30T13:10:54Z https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506660#M9212 <P>Why did I get a warning on my real-time rolling windows alert?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="mathiasy123_1-1593514193244.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9391iB1B97D8AA8CD915C/image-size/medium?v=v2&amp;px=400" role="button" title="mathiasy123_1-1593514193244.png" alt="mathiasy123_1-1593514193244.png" /></span></P><P>this is my alert configuration:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="mathiasy123_2-1593514230801.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9392i37E9BD126A0A2DB1/image-size/medium?v=v2&amp;px=400" role="button" title="mathiasy123_2-1593514230801.png" alt="mathiasy123_2-1593514230801.png" /></span></P><P>&nbsp;</P> Tue, 30 Jun 2020 10:51:28 GMT https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506660#M9212 mathiasy123 2020-06-30T10:51:28Z https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506670#M9214 You're running too many real-time searches. Why are you running real-time searches at all? Each one ties up a CPU forever so you're severely limiting the number of searches Splunk can run. Real-time searches should be reserved for alerts that require a real-time response. The alert shown could easily be replaced by a scheduled search that runs every 10 minutes. Tue, 30 Jun 2020 12:38:14 GMT https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506670#M9214 richgalloway 2020-06-30T12:38:14Z https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506677#M9215 <P>So, what is the best solution if I want to run real-time alert ?</P> Tue, 30 Jun 2020 13:10:54 GMT https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506677#M9215 mathiasy123 2020-06-30T13:10:54Z https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506680#M9216 The best solution is to not run real-time alerts. They're rarely the answer.<BR />If you insist on running real-time alerts then you will have to increase the number of CPUs on your search heads and indexers to match the number of real-time searches you want to run. Tue, 30 Jun 2020 13:14:32 GMT https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506680#M9216 richgalloway 2020-06-30T13:14:32Z https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506681#M9217 <P>Ah, I see, so 1 CPU process 1 real-time search alert?, I guess should try schedule alert, thx!</P> Tue, 30 Jun 2020 13:16:52 GMT https://community.splunk.com/t5/Alerting/Alert-Problem/m-p/506681#M9217 mathiasy123 2020-06-30T13:16:52Z