https://community.splunk.com/t5/Alerting/Why-in-Python-SDK-forwarding-on-Search-Head-is-causing-missed/m-p/391505#M6879 <P>The problem was in transforms.conf.. </P> Tue, 25 Sep 2018 11:31:06 GMT astarchenkov 2018-09-25T11:31:06Z https://community.splunk.com/t5/Alerting/Why-in-Python-SDK-forwarding-on-Search-Head-is-causing-missed/m-p/391504#M6878 <P>Hi!</P> <P>There are 2 servers: Search Head (SH) and Indexer. I've configured data forwarding from SH to Indexer without local copy and distributed search peer. I've an alert and a custom alert action, which uses token from stdin for sdk client.submit method. Next the most interesting thing is going, the sent event is missed. I cant find it on SH or Indexer (I've created the corresponding indexes). So if I use standalone configuration without indexer and data forwarding I've no any problems. Also I've tried other sdk methods like attach but with the same result. </P> Tue, 25 Sep 2018 08:33:44 GMT https://community.splunk.com/t5/Alerting/Why-in-Python-SDK-forwarding-on-Search-Head-is-causing-missed/m-p/391504#M6878 astarchenkov 2018-09-25T08:33:44Z https://community.splunk.com/t5/Alerting/Why-in-Python-SDK-forwarding-on-Search-Head-is-causing-missed/m-p/391505#M6879 <P>The problem was in transforms.conf.. </P> Tue, 25 Sep 2018 11:31:06 GMT https://community.splunk.com/t5/Alerting/Why-in-Python-SDK-forwarding-on-Search-Head-is-causing-missed/m-p/391505#M6879 astarchenkov 2018-09-25T11:31:06Z https://community.splunk.com/t5/Alerting/Why-in-Python-SDK-forwarding-on-Search-Head-is-causing-missed/m-p/391506#M6880 <P>hi @astarchankov</P> <P>I'm glad you figured out a solution to your problem. Would you mind giving our community more details about how you solved your problem? That way, other future Splunk users with similar issues can learn from your experience.</P> <P>Thanks!</P> Thu, 27 Sep 2018 21:06:47 GMT https://community.splunk.com/t5/Alerting/Why-in-Python-SDK-forwarding-on-Search-Head-is-causing-missed/m-p/391506#M6880 mstjohn_splunk 2018-09-27T21:06:47Z