Error in sendalert: Cannot find a job with the search_id ''

[jmartin_pro]

Hello All,

We have a custom alert action (built with the Splunk Add-on Builder) that sends search results to a HEC input. We have heartbeat searches that trigger the alert action periodically to ensure different hosts are functioning appropriately. We have seen behavior where the the SID is not passed to the alert action. The logs we are seeing are as follows:

To me, this seems that the alert action is not even being triggered due to the lack of an SID (hence the blank alert_actions field, which is normally populated by the name of our alert action).

Has anyone else ran into this? Any tips for how to resolve?

Thank you.