Hi, I had the same difficulties on a Linux search head. The solution was to modify the inputs.conf as follow [script://.\bin\alert_manager_scheduler.path] changed to [script://./bin/alert_manager_scheduler.path] Also, the index "alerts" was created on the cluster, but it was not enough. It was required to create an empty one on the search head as well, as you would do on heavy forwarders. Rgds Dan ... View more