SAI doesn't show any alert in Alerts tab

[tung_doan]

We have SAI installed on a Searchhead (SH), and Add-ons are installed on a Indexer (IDX) and a HeavyForwarder (HF) in a distributed system.
The Add-ons on the IDX created 3 indexes which are em_metrics, infra_alerts, and em_meta

We also have a Windows Universal Forwarders (machine1) sending metrics logs to the em_metrics index on IDX.

The SAI app on SH can discover entities without issues. But it doesn't show any alert in Alerts tab for alerts we created in the SAI app.

Is this something related to infra_alerts index as we received this below message on SH whenever created an alert within the SAI app?

Received event for unconfigured/disabled/deleted index=infra_alerts with source="source::machine1-Processor.-_Processor_Time-avg" host="host::SH-name" sourcetype="sourcetype::stash". So far received events from 2 missing index(es)

Do we need to install the add-on on SH so that it is able to sees infra_alerts index? If it's the case, we may also need to forward SH data to IDX, right?

[junyuw]

Yes, in this case I think you will need to install the SAI TA on the SH as well to make the `infra_alerts` summary index available, and that index is where SAI stores the alerts created (though if the search head is properly set up and connected to the indexers this shouldn't be necessary)

The actual data won't be actually stored on the SH as long as data forwarding is set up correctly. Reference: https://community.splunk.com/t5/Getting-Data-In/Should-a-summary-index-be-created-on-both-Search-Head-and/m-p/239317