Why in Python SDK, forwarding on Search Head is causing missed events?

[astarchenkov]

Hi!

There are 2 servers: Search Head (SH) and Indexer. I've configured data forwarding from SH to Indexer without local copy and distributed search peer. I've an alert and a custom alert action, which uses token from stdin for sdk client.submit method. Next the most interesting thing is going, the sent event is missed. I cant find it on SH or Indexer (I've created the corresponding indexes). So if I use standalone configuration without indexer and data forwarding I've no any problems. Also I've tried other sdk methods like attach but with the same result.

[astarchenkov · Accepted solution]

The problem was in transforms.conf..

[mstjohn_splunk]

hi @astarchankov

I'm glad you figured out a solution to your problem. Would you mind giving our community more details about how you solved your problem? That way, other future Splunk users with similar issues can learn from your experience.

Thanks!