Alerting

Using Alerts with Splunk Enterprise Per Sourcetype License

Path Finder

Hi,

When creating alerts and choosing action as logevent, by default it chooses sourcetype as generic_single_line
But I also get License warning in my license master.
I have Splunk enterprise per sourcetype license. Why can't I use the in-built alerts feature ?

04-03-2019 09:51:50.366 +0000 WARN LicenseUsage - type=Usage s="alert:myalert" st=generic_single_line h="127.0.0.1" o="" idx="my_alerts" i="1473278A-8BE2-4B8B-9FC5-BE63d627E13C" pool="null" b=303

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!