We have SAI installed on a Searchhead (SH), and Add-ons are installed on a Indexer (IDX) and a HeavyForwarder (HF) in a distributed system.
The Add-ons on the IDX created 3 indexes which are **em_metrics**, **infra_alerts**, and **em_meta**
We also have a Windows Universal Forwarders (*machine1*) sending metrics logs to the **em_metrics** index on IDX.
The SAI app on SH can discover entities without issues. But it doesn't show any alert in Alerts tab for alerts we created in the SAI app.
Is this something related to **infra_alerts** index as we received this below message on SH whenever created an alert within the SAI app?
*Received event for unconfigured/disabled/deleted index=infra_alerts with source="source::machine1-Processor.-_Processor_Time-avg" host="host::SH-name" sourcetype="sourcetype::stash". So far received events from 2 missing index(es)*
Do we need to install the add-on on SH so that it is able to sees **infra_alerts** index? If it's the case, we may also need to forward SH data to IDX, right?
↧
