Splunk Enterprise

Splunk Alert manager

indreshdowjones
Explorer

We have installed the following Splunk alert manager app on our search head. During the installation we created new index on search head to store the fired alert data 

  • https://splunkbase.splunk.com/app/2665/ 
  • https://splunkbase.splunk.com/app/3365/

    We are running all our saved searches/alerts from Search head not from the indexers.

    Can you please tell me do we need to create index(alerts) on indexers as well?

    We started receiving lic warnings on search head.

    Mar 21, 2022, 12:00:00 AM
    (8 hours ago)
    This pool has exceeded its configured poolsize=1 bytes. A CLE warning has been recorded for all membersserver_namexxxauto_generated_pool_enterpriseenterprisecle_pool_over_quota

     

    Licensing warnings will be generated today. See License Manager for details. Learn more.3/21/2022, 8:03:41 AM
    License warning issued within past 24 hours: Mon Mar 21 00:00:00 2022 EDT. Refer to the License Usage Report view on license master '' to find out more.3/21/2022, 8:03:41 AM
    Daily indexing volume limit exceeded. Per the Splunk Enterprise license policy in effect, search is disabled after 45 warnings over a 60-day window. Your Splunk deployment is subject to license enforcement. See License Manager for details.

     

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can create the index on your indexers the same way you created it on the search head.  However, the best practice is to define all of your indexes in an app and deploy that app to all search heads and indexers so all instances have the same list of indexes.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can create the index on your indexers the same way you created it on the search head.  However, the best practice is to define all of your indexes in an app and deploy that app to all search heads and indexers so all instances have the same list of indexes.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...