Alert Manager functionality not working in search head clsuter environment


We have implemented Alert manager in our prod environment.

The problem we are facing is that when we try to assign the alerts to a user in Splunk it is not working whereas when we try to do the same thing from the other search head it's getting assigned properly.

I checked the replication bundle status, artifacts count but didn't find any clue as to why this is happening.

Can someone explain as to why this is happening.


Alert manager started working only after I changed the permissions of the alert to App rather than private.
Check permissions of the alerts

0 Karma


Check for kvstore issues by searching

index=_internal sourcetype=mongod log_level=error

Correct any errors you see.

Also If you have a newer version of splunk there is a “Search Head Clustering” link in the settings drop down. It might have some clues too.

0 Karma


You should ask who created this.

0 Karma



Not sure if you were able to fix this but are you using "Alert Manager" app from splunkbase? If yes, what is the version of the app?
Looks like the new version 2.2.2 has enhanced support for search head cluster.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...