If a search head goes down do alerts queue until it returns?

[Munju1]

We have one ES search head in a distributed environment.

1. If the search head goes down, do alerts queue up and trigger actions once Splunk is back up?

2. If yes, for what period of time are alerts retained for?

Thank you. 

[richgalloway · Accepted solution]

If a search head goes down no Splunk work can be done so there is no queuing of searches/alerts.  Once the SH comes back up then searches will execute at their next interval.  There is no "catch-up".