All Apps and Add-ons

SAI doesn't show any alert in Alerts tab

tung_doan
Engager

We have SAI installed on a Searchhead (SH), and Add-ons are installed on a Indexer (IDX) and a HeavyForwarder (HF) in a distributed system.
The Add-ons on the IDX created 3 indexes which are em_metrics, infra_alerts, and em_meta

We also have a Windows Universal Forwarders (machine1) sending metrics logs to the em_metrics index on IDX.

The SAI app on SH can discover entities without issues. But it doesn't show any alert in Alerts tab for alerts we created in the SAI app.

Is this something related to infra_alerts index as we received this below message on SH whenever created an alert within the SAI app?

Received event for unconfigured/disabled/deleted index=infra_alerts with source="source::machine1-Processor.-_Processor_Time-avg" host="host::SH-name" sourcetype="sourcetype::stash". So far received events from 2 missing index(es)

Do we need to install the add-on on SH so that it is able to sees infra_alerts index? If it's the case, we may also need to forward SH data to IDX, right?

0 Karma

junyuw
Splunk Employee
Splunk Employee

Yes, in this case I think you will need to install the SAI TA on the SH as well to make the `infra_alerts` summary index available, and that index is where SAI stores the alerts created (though if the search head is properly set up and connected to the indexers this shouldn't be necessary)

The actual data won't be actually stored on the SH as long as data forwarding is set up correctly. Reference: https://community.splunk.com/t5/Getting-Data-In/Should-a-summary-index-be-created-on-both-Search-Head-and/m-p/239317

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...