All Apps and Add-ons

SAI doesn't show any alert in Alerts tab


We have SAI installed on a Searchhead (SH), and Add-ons are installed on a Indexer (IDX) and a HeavyForwarder (HF) in a distributed system.
The Add-ons on the IDX created 3 indexes which are em_metrics, infra_alerts, and em_meta

We also have a Windows Universal Forwarders (machine1) sending metrics logs to the em_metrics index on IDX.

The SAI app on SH can discover entities without issues. But it doesn't show any alert in Alerts tab for alerts we created in the SAI app.

Is this something related to infra_alerts index as we received this below message on SH whenever created an alert within the SAI app?

Received event for unconfigured/disabled/deleted index=infra_alerts with source="source::machine1-Processor.-_Processor_Time-avg" host="host::SH-name" sourcetype="sourcetype::stash". So far received events from 2 missing index(es)

Do we need to install the add-on on SH so that it is able to sees infra_alerts index? If it's the case, we may also need to forward SH data to IDX, right?

0 Karma

Splunk Employee
Splunk Employee

Yes, in this case I think you will need to install the SAI TA on the SH as well to make the `infra_alerts` summary index available, and that index is where SAI stores the alerts created (though if the search head is properly set up and connected to the indexers this shouldn't be necessary)

The actual data won't be actually stored on the SH as long as data forwarding is set up correctly. Reference:

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>