Splunk Enterprise

Splunk Alert manager

indreshdowjones
Explorer

We have installed the following Splunk alert manager app on our search head. During the installation we created new index on search head to store the fired alert data 

  • https://splunkbase.splunk.com/app/2665/ 
  • https://splunkbase.splunk.com/app/3365/

    We are running all our saved searches/alerts from Search head not from the indexers.

    Can you please tell me do we need to create index(alerts) on indexers as well?

    We started receiving lic warnings on search head.

    Mar 21, 2022, 12:00:00 AM
    (8 hours ago)
    This pool has exceeded its configured poolsize=1 bytes. A CLE warning has been recorded for all membersserver_namexxxauto_generated_pool_enterpriseenterprisecle_pool_over_quota

     

    Licensing warnings will be generated today. See License Manager for details. Learn more.3/21/2022, 8:03:41 AM
    License warning issued within past 24 hours: Mon Mar 21 00:00:00 2022 EDT. Refer to the License Usage Report view on license master '' to find out more.3/21/2022, 8:03:41 AM
    Daily indexing volume limit exceeded. Per the Splunk Enterprise license policy in effect, search is disabled after 45 warnings over a 60-day window. Your Splunk deployment is subject to license enforcement. See License Manager for details.

     

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can create the index on your indexers the same way you created it on the search head.  However, the best practice is to define all of your indexes in an app and deploy that app to all search heads and indexers so all instances have the same list of indexes.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can create the index on your indexers the same way you created it on the search head.  However, the best practice is to define all of your indexes in an app and deploy that app to all search heads and indexers so all instances have the same list of indexes.

---
If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...