how to edit alerts in Indexer

[islam]

Hi,

we have one search head and one indexer, and installed db connect app on the indexer.

we created some searches on indexer related to db connect logs, and saved these searches as alerts.

the issue is we cannot edit or delete these searches or alerts, as the alerts tap is empty.

how can we edit there alerts.

[tscroggins · Accepted solution]

@islam 

If the searches aren't visible under Alerts, they likely have no alert actions defined. Check Reports or Settings > Searches, reports, and alerts to validate the schedule and alert actions.

In a simple two-tier environment like this, you should definitely move your alert searches and probably move DB Connect to your search head. Keep an eye on DB Connect JVM heap and HEC queue sizes.

[islam]

we already configured every alert to send mail as action, also as i mentioned, when we open settings >> Searches, reports, and alerts we didn't find our alerts under alerts tab or searched tab however the alerts work and we receive their mails properly.

[tscroggins]

@islam 

Can you see the searches under Settings > All configurations with App set to All and Owner set to Any? If yes, ensure the searches are exported (shared) correctly and have the owner you expect.