Alert Problem

[mathiasy123]

Why did I get a warning on my real-time rolling windows alert?

mathiasy123_1-1593514193244.png

this is my alert configuration:

mathiasy123_2-1593514230801.png

[richgalloway]

You're running too many real-time searches. Why are you running real-time searches at all? Each one ties up a CPU forever so you're severely limiting the number of searches Splunk can run. Real-time searches should be reserved for alerts that require a real-time response. The alert shown could easily be replaced by a scheduled search that runs every 10 minutes.

[mathiasy123]

So, what is the best solution if I want to run real-time alert ?

[richgalloway · Accepted solution]

The best solution is to not run real-time alerts. They're rarely the answer.
If you insist on running real-time alerts then you will have to increase the number of CPUs on your search heads and indexers to match the number of real-time searches you want to run.

[mathiasy123]

Ah, I see, so 1 CPU process 1 real-time search alert?, I guess should try schedule alert, thx!