Alerting

Why in Python SDK, forwarding on Search Head is causing missed events?

astarchenkov
Explorer

Hi!

There are 2 servers: Search Head (SH) and Indexer. I've configured data forwarding from SH to Indexer without local copy and distributed search peer. I've an alert and a custom alert action, which uses token from stdin for sdk client.submit method. Next the most interesting thing is going, the sent event is missed. I cant find it on SH or Indexer (I've created the corresponding indexes). So if I use standalone configuration without indexer and data forwarding I've no any problems. Also I've tried other sdk methods like attach but with the same result.

Tags (3)
0 Karma
1 Solution

astarchenkov
Explorer

The problem was in transforms.conf..

View solution in original post

0 Karma

astarchenkov
Explorer

The problem was in transforms.conf..

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @astarchankov

I'm glad you figured out a solution to your problem. Would you mind giving our community more details about how you solved your problem? That way, other future Splunk users with similar issues can learn from your experience.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...