topic Alert Manager functionality not working in search head clsuter environment in Alerting

Alert Manager functionality not working in search head clsuter environment

sandyIscream — Thu, 16 Nov 2017 13:44:25 GMT

We have implemented Alert manager in our prod environment.

The problem we are facing is that when we try to assign the alerts to a user in Splunk it is not working whereas when we try to do the same thing from the other search head it's getting assigned properly.

I checked the replication bundle status, artifacts count but didn't find any clue as to why this is happening.

Can someone explain as to why this is happening.

Re: Alert Manager functionality not working in search head clsuter environment

sudosplunk — Mon, 30 Jul 2018 14:44:01 GMT

Hello,

Not sure if you were able to fix this but are you using "Alert Manager" app from splunkbase? If yes, what is the version of the app?
Looks like the new version 2.2.2 has enhanced support for search head cluster.

Re: Alert Manager functionality not working in search head clsuter environment

davpx — Sat, 26 Jan 2019 03:17:51 GMT

You should ask simon@balz.me who created this.

Re: Alert Manager functionality not working in search head clsuter environment

jkat54 — Sun, 27 Jan 2019 16:13:39 GMT

Check for kvstore issues by searching

index=_internal sourcetype=mongod log_level=error

Correct any errors you see.

Also If you have a newer version of splunk there is a “Search Head Clustering” link in the settings drop down. It might have some clues too.

Re: Alert Manager functionality not working in search head clsuter environment

nawazns5038 — Tue, 12 Mar 2019 19:18:21 GMT

Alert manager started working only after I changed the permissions of the alert to App rather than private.
Check permissions of the alerts