Deployment Architecture

Have to trigger Alert if search head goes down in SHC

New Member

Can any one help me with the SPL to set up an alert, to be trigger when any of the search head goes down.

I am using this SPL : | rest /services/shcluster/captain/members/ | table label status | where status!="Up"

But it is showing errors occurred while the search was executing. Therefore, search results might be incomplete.

Can anyone help me without using rest command?

THANKS in Advance.

0 Karma



I am assuming you have a Management Console in use? if so, you can just activated the "DMC Alert - Search Peer Not Responding" ( click settings and Alert Setup in your MC). Since all of your server should be search peers of your MC you should be alerted on any missing server :).

Kind Regards



If it helped please accept this answer 🙂 thank you

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...