Alerting

Alert Problem

mathiasy123
Path Finder

Why did I get a warning on my real-time rolling windows alert?

mathiasy123_1-1593514193244.png

this is my alert configuration:

mathiasy123_2-1593514230801.png

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
The best solution is to not run real-time alerts. They're rarely the answer.
If you insist on running real-time alerts then you will have to increase the number of CPUs on your search heads and indexers to match the number of real-time searches you want to run.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
You're running too many real-time searches. Why are you running real-time searches at all? Each one ties up a CPU forever so you're severely limiting the number of searches Splunk can run. Real-time searches should be reserved for alerts that require a real-time response. The alert shown could easily be replaced by a scheduled search that runs every 10 minutes.
---
If this reply helps you, Karma would be appreciated.
0 Karma

mathiasy123
Path Finder

So, what is the best solution if I want to run real-time alert ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust
The best solution is to not run real-time alerts. They're rarely the answer.
If you insist on running real-time alerts then you will have to increase the number of CPUs on your search heads and indexers to match the number of real-time searches you want to run.
---
If this reply helps you, Karma would be appreciated.
0 Karma

mathiasy123
Path Finder

Ah, I see, so 1 CPU process 1 real-time search alert?, I guess should try schedule alert, thx!

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...