Alerting
Highlighted

Alert Problem

Engager

Why did I get a warning on my real-time rolling windows alert?

mathiasy123_1-1593514193244.png

this is my alert configuration:

mathiasy123_2-1593514230801.png

 

Labels (2)
0 Karma
Highlighted

Re: Alert Problem

SplunkTrust
SplunkTrust
You're running too many real-time searches. Why are you running real-time searches at all? Each one ties up a CPU forever so you're severely limiting the number of searches Splunk can run. Real-time searches should be reserved for alerts that require a real-time response. The alert shown could easily be replaced by a scheduled search that runs every 10 minutes.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Alert Problem

Engager

So, what is the best solution if I want to run real-time alert ?

0 Karma
Highlighted

Re: Alert Problem

SplunkTrust
SplunkTrust
The best solution is to not run real-time alerts. They're rarely the answer.
If you insist on running real-time alerts then you will have to increase the number of CPUs on your search heads and indexers to match the number of real-time searches you want to run.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: Alert Problem

Engager

Ah, I see, so 1 CPU process 1 real-time search alert?, I guess should try schedule alert, thx!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.