Have a configuration with two splunk servers(logging01 and logging02) configured with shared configuration processing syslog data. The two servers are behind a load balancer.
Created an alert which sends an email.
Everytime a single alert fires I receive two emails.
From the smtp server's logs I see both servers sending the same email.
Is there anyway to prevents this, so only a single email is sent?