Alerting

alerts not firing from slave search head

anshu2812
Explorer

Hi,

We have an enterprise license for PROD server. We have a distributed architecture with 1 search head and 2 indexers. We applied the master license on PROD search head and added the indexers to the pool (as slave licenses). Now we have got an acceptance environment with 1 server serving as search head and indexer. To make sure it also becomes part of the master licensing we added it to the same pool as above with slave licensing configured. However, now the licensing issue is resolved on acceptance server but the alerts dont fire from this server, same searches work fine from master search head. Does licensing master/slave affect the alerting? If yes, what is the work around to get alerting working on both environments?

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

if your servers are license-slaves of a license-master with an enterprise license, they should have access to all the functions, including alerting.

You may have another issue, check your email smtp settings, and read the internal scheduler.log and the python.log for hints.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...