Alerting

How to set 1 Search Head cluster member to send all alerts?

sidekix24
Path Finder

We currently have a Search Head (SH) cluster with members at 2 different sites. 1 site is failing to send emails and create Jira tickets successfully. We are looking into the network changes that need to be made to fix this but in the mean time, is there a setting we can change so all alerts come from the SH members at the working site or even just delegate 1 member to send out all alerts?

Thanks

1 Solution

skoelpin
SplunkTrust
SplunkTrust

This is a good question.. I've never done this before, but there is an attribute to dedicate a member of the cluster to only adhoc searches..

[shclustering]
adhoc_searchhead = true

https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Adhocclustermember

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This is a good question.. I've never done this before, but there is an attribute to dedicate a member of the cluster to only adhoc searches..

[shclustering]
adhoc_searchhead = true

https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Adhocclustermember

0 Karma

sidekix24
Path Finder

Thanks skoelpin,

I'll try that and see if that works. I think that should fix our issue while the networking team does their thing at the other site.

I'll let you know

Thanks again

skoelpin
SplunkTrust
SplunkTrust

We're you able to confirm if this worked or not?

If so can you please accept the answer?

0 Karma

sidekix24
Path Finder

Thanks skoelpin,

That looks like it fixed our issue.

Thanks again

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...