All Apps and Add-ons

SAI doesn't show any alert in Alerts tab

tung_doan
Engager

We have SAI installed on a Searchhead (SH), and Add-ons are installed on a Indexer (IDX) and a HeavyForwarder (HF) in a distributed system.
The Add-ons on the IDX created 3 indexes which are em_metrics, infra_alerts, and em_meta

We also have a Windows Universal Forwarders (machine1) sending metrics logs to the em_metrics index on IDX.

The SAI app on SH can discover entities without issues. But it doesn't show any alert in Alerts tab for alerts we created in the SAI app.

Is this something related to infra_alerts index as we received this below message on SH whenever created an alert within the SAI app?

Received event for unconfigured/disabled/deleted index=infra_alerts with source="source::machine1-Processor.-_Processor_Time-avg" host="host::SH-name" sourcetype="sourcetype::stash". So far received events from 2 missing index(es)

Do we need to install the add-on on SH so that it is able to sees infra_alerts index? If it's the case, we may also need to forward SH data to IDX, right?

0 Karma

junyuw
Splunk Employee
Splunk Employee

Yes, in this case I think you will need to install the SAI TA on the SH as well to make the `infra_alerts` summary index available, and that index is where SAI stores the alerts created (though if the search head is properly set up and connected to the indexers this shouldn't be necessary)

The actual data won't be actually stored on the SH as long as data forwarding is set up correctly. Reference: https://community.splunk.com/t5/Getting-Data-In/Should-a-summary-index-be-created-on-both-Search-Head-and/m-p/239317

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...