Hi!
There are 2 servers: Search Head (SH) and Indexer. I've configured data forwarding from SH to Indexer without local copy and distributed search peer. I've an alert and a custom alert action, which uses token from stdin for sdk client.submit method. Next the most interesting thing is going, the sent event is missed. I cant find it on SH or Indexer (I've created the corresponding indexes). So if I use standalone configuration without indexer and data forwarding I've no any problems. Also I've tried other sdk methods like attach but with the same result.
... View more