Alerting

How to move alerts on different server

arkonner
Path Finder

In order to improve the Splunk performance in a single server installation I added a search head - The new server is now also a master licensing server and the previous one is configured as slave -

Should be possible to move from the old index server to the new search head the alerts generation or is a role/function that runs only on the index server.

0 Karma

gcusello
SplunkTrust
SplunkTrust

You can run alerts both in search head and indexer until you have only one indexer (or an indexer cluster).
To move them from indexer to search head, you have to copy app that contains alerts and disable alerts in indexer.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...