Alerting

Alerts triggered actions: log events

SplunkExplorer
Contributor

Hi Splunkers, I have a doubt about a specific Splunk Alert triggered actions: the log event one.

From doc I can see, on the end:

"You must also define the destination index on both the search head and the indexers. "

Does it means that, even if I am in a distributed environments, I must created index used to save alerts on both Indexers and search heads?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, especially in distributed environments, the search head must be aware of the index.  No storage needs to be created, however.  The SH merely needs to know the index exists.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, especially in distributed environments, the search head must be aware of the index.  No storage needs to be created, however.  The SH merely needs to know the index exists.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...