Alerting
Highlighted

Can my license-master still email license alerts if it is in violation

Communicator

Here is my problem, I have an enterprise license-master and some scheduled searches triggering email alerts if it records license warnings or violations.
(based on index=_internal source=*license_audit.log* )

But I wonder what will happen when it will be in violation (after reaching 5 warnings), because the search is supposed to be disabled. Will the server silently be locked ?

Highlighted

Re: Can my license-master still email license alerts if it is in violation

Splunk Employee
Splunk Employee

Good concern.

Hopefully, when you are in violation, the search on the _internal index is not disabled, and the scheduling is still running. So the alert email will be sent even if the other indexed cannot be searched.

View solution in original post

0 Karma
Highlighted

Re: Can my license-master still email license alerts if it is in violation

Builder

When you reach 5 license violations, search is disabled. But the _internal index is not blocked for exactly this kind of reason. You need to be able to tell if you are still getting violations and if so where the data is coming from.

0 Karma