Yes, in this case I think you will need to install the SAI TA on the SH as well to make the `infra_alerts` summary index available, and that index is where SAI stores the alerts created (though if the search head is properly set up and connected to the indexers this shouldn't be necessary) The actual data won't be actually stored on the SH as long as data forwarding is set up correctly. Reference: https://community.splunk.com/t5/Getting-Data-In/Should-a-summary-index-be-created-on-both-Search-Head-and/m-p/239317
... View more