Dear All, I have a Search Head, Deployment Server, Monitoring Console, a Cluster Manager, an Indexer Cluster and two unclustered Indexers. On the Monitoring Console, I get alerts about the IOWaits being high on the two unclustered indexers and this has been happening only since we upgraded to 8.2.5. There is no evidence of any issues, other than this alert in SplunkWeb and I want to disable it. I am using the following KB article: https://docs.splunk.com/Documentation/Splunk/8.2.5/Admin/Healthconf On the Monitoring Console server, I have put the following into the etc\apps\search\local\health.conf file: [feature:iowait] alert:sum_top3_cpu_percs__max_last_3m.disabled = 1 However, I am still getting the appearing in SplunkWeb on the Monitoring Console server. Why is this? Am I configuring the health.conf in the wrong server or the wrong folder, or what? When I run a cmd btool health list, I see the configuration there, but Splunk is not doing as it is being told! If I am doing the wrong thing, even, can someone point me to some documentation that explains what I should be doing? Thanks in advance!
... View more