Alert manager enterprise - Creation of events in index

[MCH2018]

Hello everyone,

I am encountering an issue with the Alert Manager Enterprise application; following the triggering of an alert, no event is created in my dedicated index. The status of the health check is okay, and we are able to create test events:

 Another point to note is that in the application's troubleshooting logs, when an alert is triggered, the event creation occurs but nothing is created in the index:

There are no permission issues, as I have confirmed by manually writing a search that we can create events in the index:

| makeresults | eval user="TEST", src="192.168.0.1", action="create test event" | sendalert create_alert param.title="Hello $result.user$" param.template=default

This successfully creates my event in my index. I have exhausted my troubleshooting ideas, do you have any suggestions on how to resolve this issue?

Thank you for your help.

MCH

[Datapunctum · Accepted solution]

Hi

There's a documentation bug for 2.0.0 as the tenant_uid has to be specified now.

The correct search would be:

| makeresults | eval user="World", src="192.168.0.1", action="create test event" | sendalert create_alert param.title="Hello $result.user$" param.template=default param.tenant_uid=default

 Hope this helps!

[MCH2018]

Hello

Thank you, that indeed solved my issue. I also noticed that there are some screenshots in your documentation that are not up to date. It would be worth updating it for other users.

Thanks again for your response!

[_JP]

I don't have your answer...but it might be helpful to cross-post your question here:

Alert Manager Enterprise - Splunk Community

That is the "place" where questions about the Alert Manager Enterprise app on Splunkbase would go now, but I don't think there is any way to link this post with app right now.

Also, the folks at Datapunctum AG might have their eyes on that area for there app, and not here, for answering any questions.  

I'm going to tag one person I know at Datapunctum that I think worked on this app:  @my2ndhead