Alert sending multiple emails

[penguincrow]

Have a configuration with two splunk servers(logging01 and logging02) configured with shared configuration processing syslog data. The two servers are behind a load balancer.

Created an alert which sends an email.

Everytime a single alert fires I receive two emails.

From the smtp server's logs I see both servers sending the same email.

Is there anyway to prevents this, so only a single email is sent?

[yannK · Accepted solution]

If you have 2 Search-heads with the same configuration, then all your searches will run twice (one on each)

The proper ways to proceed are :

• dedicate a single search-head to run your jobs/scheduled searches
• or use search-head pooling to actually load balance the search jobs.