I cannot see the Backfill of 7 days that I specified for a KPI in a service. I created a KPI Base Search and then, when I added the KPI, I specified a 7 days backfill. I see the notification in the notification dropdown saying it was completed successfully in 0 m (which seems odd to me).
Yet, when I go to the KPI in the Deep Dive, it only has stats for that KPI to the time I started that service.
Is there an additional step I am missing?
Has anyone else experienced this?
Okay I think I have an idea of what is happening though I dont understand why.
I needed to create KPIs that were based on the computation of other KPIs. So, I created these services with a query like:
sourcetype=abc-prod A0010 | stats sum(foo) as FOO sum(bar) as BAR | eval FOOBYSEC = FOO/300
And then, I was grabbing KPIs based on the new kpi of FOOBYSEC
(For this query I need the sum of a KPI value for 5 minutes divided by 300 to show average per second, this is the only way I know how to do this)
When I use a query like that, it doesnt backfill as expected.
I created a new service with a simple query and now it seems to work. But, I'm back at square one because I need to show that KPI value for 5 minutes of average per second...
Okay I think I have an idea of what is happening though I dont understand why.
I needed to create KPIs that were based on the computation of other KPIs. So, I created these services with a query like:
sourcetype=abc-prod A0010 | stats sum(foo) as FOO sum(bar) as BAR | eval FOOBYSEC = FOO/300
And then, I was grabbing KPIs based on the new kpi of FOOBYSEC
(For this query I need the sum of a KPI value for 5 minutes divided by 300 to show average per second, this is the only way I know how to do this)
When I use a query like that, it doesnt backfill as expected.
I created a new service with a simple query and now it seems to work. But, I'm back at square one because I need to show that KPI value for 5 minutes of average per second...