How to move alerts on different server

Path Finder

In order to improve the Splunk performance in a single server installation I added a search head - The new server is now also a master licensing server and the previous one is configured as slave -

Should be possible to move from the old index server to the new search head the alerts generation or is a role/function that runs only on the index server.

0 Karma


You can run alerts both in search head and indexer until you have only one indexer (or an indexer cluster).
To move them from indexer to search head, you have to copy app that contains alerts and disable alerts in indexer.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!