Alerting

Alerts triggered actions: log events

SplunkExplorer
Contributor

Hi Splunkers, I have a doubt about a specific Splunk Alert triggered actions: the log event one.

From doc I can see, on the end:

"You must also define the destination index on both the search head and the indexers. "

Does it means that, even if I am in a distributed environments, I must created index used to save alerts on both Indexers and search heads?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, especially in distributed environments, the search head must be aware of the index.  No storage needs to be created, however.  The SH merely needs to know the index exists.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, especially in distributed environments, the search head must be aware of the index.  No storage needs to be created, however.  The SH merely needs to know the index exists.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...