We currently have a Search Head (SH) cluster with members at 2 different sites. 1 site is failing to send emails and create Jira tickets successfully. We are looking into the network changes that need to be made to fix this but in the mean time, is there a setting we can change so all alerts come from the SH members at the working site or even just delegate 1 member to send out all alerts?
Thanks
This is a good question.. I've never done this before, but there is an attribute to dedicate a member of the cluster to only adhoc searches..
[shclustering]
adhoc_searchhead = true
https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Adhocclustermember
This is a good question.. I've never done this before, but there is an attribute to dedicate a member of the cluster to only adhoc searches..
[shclustering]
adhoc_searchhead = true
https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Adhocclustermember
Thanks skoelpin,
I'll try that and see if that works. I think that should fix our issue while the networking team does their thing at the other site.
I'll let you know
Thanks again
We're you able to confirm if this worked or not?
If so can you please accept the answer?
Thanks skoelpin,
That looks like it fixed our issue.
Thanks again