On which server should I deploy the Alerting: the search head or indexer node?

[sbeamro]

Hi,
I'm running a configuration of 1 Search Head and 2 Index Nodes (one of them acts as License node).
I'd like to create real-time alerting and I was wondering what would be the best practice ?
should I deploy the searches of the alert over the search head or over the index nodes ?

[tom_frotscher · Accepted solution]

On the Search Head. Just one simple argument: the search head is able to search both indexers if given as search peers. The indexer may only know the data on itself, not on the other indexer.

[linu1988]

Adding to that, Don't configure the script for real time alerts, it will continuously trigger the script every minute irrespective of the results found or not.

[sbeamro]

when you say dont configure the script - do you mean for the search proccess ?
is there any best practice guide lines ?
(for example, we have some major switch interfaces etc)

[linu1988]

I was refering to the script which is configured for a realtime alert. I personally feel there is not much use of a realtime alert. rather schedule it to run every minute or two. It will affect the performance for sure as the CPU core will be occupied. There is no best practice available currently but you will know this by experimenting in your test environment.

[sbeamro]

Tom, thats an excellent point !

I was wondering about the question if there is any effect over the performance of the search head or of the indexers.

by the way - do I lose performance when I run real-time alerting ? if so do do I lose performance on the indexer and the search head ?

can you elaborate ?

[tom_frotscher]

Hey,
there is an excellent part of the documentation that covers your questions -> Link

Grettings

Tom