Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- How alerting works in 6.2.2 version with search he...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we recently migrated to search head clustered configuration. I'm trying to find how the search head manages scheduled searches and alerts. Specifically, where is the savedsearches.conf file located and how do we allow others to create new saved searches and update those saved searches? How does the search head then manage the scheduling of the scheduled searches and alerts? Do we need to configure authentication file on all 3 search heads in clustered environment ? if so, don't they send duplicate alerts/email notifications ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The search head captain manages the scheduling of searches and alerts. It ensures that alerts happen once and it coordinates alert suppression options across the cluster. The search head that runs the alert is responsible for the alert actions such as sending email.
http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/SHCarchitecture#Search_head_cluster_cap...
Every search head has a copy of the savedsearches.conf files (all of them); when users add or update searches, the changes are replicated across the cluster to every search head.
Authentication needs to be configured on every search head in the cluster.
You should read the Distributed Search manual before deploying search head clustering. It's a pretty complex topic.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The search head captain manages the scheduling of searches and alerts. It ensures that alerts happen once and it coordinates alert suppression options across the cluster. The search head that runs the alert is responsible for the alert actions such as sending email.
http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/SHCarchitecture#Search_head_cluster_cap...
Every search head has a copy of the savedsearches.conf files (all of them); when users add or update searches, the changes are replicated across the cluster to every search head.
Authentication needs to be configured on every search head in the cluster.
You should read the Distributed Search manual before deploying search head clustering. It's a pretty complex topic.
Prove Your Splunk Prowess at .conf25—No Prereqs Required!
Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code
Splunk Answers Content Calendar, July Edition I
