Splunk Alert manager

[indreshdowjones]

We have installed the following Splunk alert manager app on our search head. During the installation we created new index on search head to store the fired alert data 

• https://splunkbase.splunk.com/app/2665/ 
• https://splunkbase.splunk.com/app/3365/

  We are running all our saved searches/alerts from Search head not from the indexers.

  Can you please tell me do we need to create index(alerts) on indexers as well?

  We started receiving lic warnings on search head.

  Mar 21, 2022, 12:00:00 AM (8 hours ago)

  This pool has exceeded its configured poolsize=1 bytes. A CLE warning has been recorded for all members

  server_namexxx

  auto_generated_pool_enterprise

  enterprise

  cle_pool_over_quota Licensing warnings will be generated today. See License Manager for details. Learn more.3/21/2022, 8:03:41 AM License warning issued within past 24 hours: Mon Mar 21 00:00:00 2022 EDT. Refer to the License Usage Report view on license master '' to find out more.3/21/2022, 8:03:41 AM Daily indexing volume limit exceeded. Per the Splunk Enterprise license policy in effect, search is disabled after 45 warnings over a 60-day window. Your Splunk deployment is subject to license enforcement. See License Manager for details.

[richgalloway · Accepted solution]

You can create the index on your indexers the same way you created it on the search head.  However, the best practice is to define all of your indexes in an app and deploy that app to all search heads and indexers so all instances have the same list of indexes.