Alerting

On which server should I deploy the Alerting: the search head or indexer node?

sbeamro
Explorer

Hi,
I'm running a configuration of 1 Search Head and 2 Index Nodes (one of them acts as License node).
I'd like to create real-time alerting and I was wondering what would be the best practice ?
should I deploy the searches of the alert over the search head or over the index nodes ?

0 Karma
1 Solution

tom_frotscher
Builder

On the Search Head. Just one simple argument: the search head is able to search both indexers if given as search peers. The indexer may only know the data on itself, not on the other indexer.

View solution in original post

tom_frotscher
Builder

On the Search Head. Just one simple argument: the search head is able to search both indexers if given as search peers. The indexer may only know the data on itself, not on the other indexer.

linu1988
Champion

Adding to that, Don't configure the script for real time alerts, it will continuously trigger the script every minute irrespective of the results found or not.

sbeamro
Explorer

when you say dont configure the script - do you mean for the search proccess ?
is there any best practice guide lines ?
(for example, we have some major switch interfaces etc)

0 Karma

linu1988
Champion

I was refering to the script which is configured for a realtime alert. I personally feel there is not much use of a realtime alert. rather schedule it to run every minute or two. It will affect the performance for sure as the CPU core will be occupied. There is no best practice available currently but you will know this by experimenting in your test environment.

0 Karma

sbeamro
Explorer

Tom, thats an excellent point !

I was wondering about the question if there is any effect over the performance of the search head or of the indexers.

by the way - do I lose performance when I run real-time alerting ? if so do do I lose performance on the indexer and the search head ?

can you elaborate ?

0 Karma

tom_frotscher
Builder

Hey,
there is an excellent part of the documentation that covers your questions -> Link

Grettings

Tom

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...