Hi! If the logs produced by AME can not be sent to the index, you will not get any alert data when expanding events. It would be easiest if you could open a support case in our support portal and provide the output of the following search as a CSV export. index=_internal source=*ame* ERROR | table _time host source _raw   Regards, Simon ... View more

Hi! No, this is not normal - which OS, Splunk version and AME version are you on? Please create a ticket at https://datapunctum.atlassian.net/servicedesk/customer/portal/1 Simon ... View more

Hi Andras Which OS, Splunk version and AME version are you using? Is there anything visible in the browser developer console? Can you check if something loads if you open this URL in your browser? https://your-splunk:8000/en-GB/splunkd/__raw/services/ame_sysinfo Are there any errors visible with  index=_internal source=*ame* ERROR | table _time host source _raw   Please open a support case if you cannot share this information publicly. Regards, Simon   ... View more