Alerting

What happens with tracked alerts during license violation period?

Path Finder

One of the things to remember when designing a Splunk 4.2.x HA environment is the behavior in case of license violations (>4 by midnight of the last 30 days on an Enterprise license). As mentioned here Splunk does not stop indexing data but search will be blocked.

Does this also apply to tracked alerts/scheduled searches? Or are only the searches executed by users via Gui blocked until license violation period ends?

1 Solution

Splunk Employee
Splunk Employee

Since searching is disabled, this would include both ad-hoc and saved searches. Since alerts are based on saved searches, you would not receive any alerts during the period of time in which the number of violations have caused search to be disabled.

You can find some useful searches that you can use to set up an alert on prior to your running into violations, which should help with providing a buffer for you to use for investigation to determine what is causing the violations. For useful searches in determining where the license volume comes from, and how to set up an alert when you get a violation, see the following page:

http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

View solution in original post

Splunk Employee
Splunk Employee

Since searching is disabled, this would include both ad-hoc and saved searches. Since alerts are based on saved searches, you would not receive any alerts during the period of time in which the number of violations have caused search to be disabled.

You can find some useful searches that you can use to set up an alert on prior to your running into violations, which should help with providing a buffer for you to use for investigation to determine what is causing the violations. For useful searches in determining where the license volume comes from, and how to set up an alert when you get a violation, see the following page:

http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!