Alerting

What happens with tracked alerts during license violation period?

meno
Path Finder

One of the things to remember when designing a Splunk 4.2.x HA environment is the behavior in case of license violations (>4 by midnight of the last 30 days on an Enterprise license). As mentioned here Splunk does not stop indexing data but search will be blocked.

Does this also apply to tracked alerts/scheduled searches? Or are only the searches executed by users via Gui blocked until license violation period ends?

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Since searching is disabled, this would include both ad-hoc and saved searches. Since alerts are based on saved searches, you would not receive any alerts during the period of time in which the number of violations have caused search to be disabled.

You can find some useful searches that you can use to set up an alert on prior to your running into violations, which should help with providing a buffer for you to use for investigation to determine what is causing the violations. For useful searches in determining where the license volume comes from, and how to set up an alert when you get a violation, see the following page:

http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

Since searching is disabled, this would include both ad-hoc and saved searches. Since alerts are based on saved searches, you would not receive any alerts during the period of time in which the number of violations have caused search to be disabled.

You can find some useful searches that you can use to set up an alert on prior to your running into violations, which should help with providing a buffer for you to use for investigation to determine what is causing the violations. For useful searches in determining where the license volume comes from, and how to set up an alert when you get a violation, see the following page:

http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...