Deployment Architecture

Have to trigger Alert if search head goes down in SHC

New Member

Can any one help me with the SPL to set up an alert, to be trigger when any of the search head goes down.

I am using this SPL : | rest /services/shcluster/captain/members/ | table label status | where status!="Up"

But it is showing errors occurred while the search was executing. Therefore, search results might be incomplete.

Can anyone help me without using rest command?

THANKS in Advance.

0 Karma



I am assuming you have a Management Console in use? if so, you can just activated the "DMC Alert - Search Peer Not Responding" ( click settings and Alert Setup in your MC). Since all of your server should be search peers of your MC you should be alerted on any missing server :).

Kind Regards



If it helped please accept this answer 🙂 thank you

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!