Splunk Cloud Platform

AME not showing alerts in app

HopyardMiner
New Member

I have successfully setup AME and tested the tenant connection and get back connector is healthy.  I can also send test event from the tenant setup page and can see it in the default index.  If I go to events there is not test not any of the alerts I have configured to send to AME even though I can see them in the traditional triggered alerts as they are still configured as well.  Looking in _internal I do see the below error:

2025-06-06T11:24:06.612+00:00 version=3.4.0 log_level=ERROR pid=1615220 s=AbstractHECWrapper.py:send_chunk:304 uuid=***************** action=sending_event reason="[Errno 111] Connection refused"

Seems to suggest there is an issue with HEC, but the tenant shows green/healthy and the test comes to the index.  Any assistance would be appreaciated.

Also, if I create an event from the Events page, that does show up in the app:  

HopyardMiner_0-1749220532662.png

 

Labels (2)
Tags (1)
0 Karma

seiimonn
New Member

Hi!

If the logs produced by AME can not be sent to the index, you will not get any alert data when expanding events.

It would be easiest if you could open a support case in our support portal and provide the output of the following search as a CSV export.

index=_internal source=*ame* ERROR | table _time host source _raw

 

Regards,
Simon

0 Karma

HopyardMiner
New Member

Seeing events now.  The default template needed a notification assigned and that notification needed to be defined as there was none.  The error mentioned above is still showing but am not sure if it is causing any seen issues.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...