Alerts triggered actions: log events

[SplunkExplorer]

Hi Splunkers, I have a doubt about a specific Splunk Alert triggered actions: the log event one.

From doc I can see, on the end:

"You must also define the destination index on both the search head and the indexers. "

Does it means that, even if I am in a distributed environments, I must created index used to save alerts on both Indexers and search heads?

[richgalloway · Accepted solution]

Yes, especially in distributed environments, the search head must be aware of the index.  No storage needs to be created, however.  The SH merely needs to know the index exists.