Splunk IT Service Intelligence

Why is backfill not working in Splunk IT Service Intelligence?

EricLloyd79
Builder

I cannot see the Backfill of 7 days that I specified for a KPI in a service. I created a KPI Base Search and then, when I added the KPI, I specified a 7 days backfill. I see the notification in the notification dropdown saying it was completed successfully in 0 m (which seems odd to me).

Yet, when I go to the KPI in the Deep Dive, it only has stats for that KPI to the time I started that service.

Is there an additional step I am missing?

Has anyone else experienced this?

1 Solution

EricLloyd79
Builder

Okay I think I have an idea of what is happening though I dont understand why.

I needed to create KPIs that were based on the computation of other KPIs. So, I created these services with a query like:

sourcetype=abc-prod A0010 | stats sum(foo) as FOO sum(bar) as BAR | eval FOOBYSEC = FOO/300

And then, I was grabbing KPIs based on the new kpi of FOOBYSEC

(For this query I need the sum of a KPI value for 5 minutes divided by 300 to show average per second, this is the only way I know how to do this)

When I use a query like that, it doesnt backfill as expected.

I created a new service with a simple query and now it seems to work. But, I'm back at square one because I need to show that KPI value for 5 minutes of average per second...

View solution in original post

0 Karma

EricLloyd79
Builder

Okay I think I have an idea of what is happening though I dont understand why.

I needed to create KPIs that were based on the computation of other KPIs. So, I created these services with a query like:

sourcetype=abc-prod A0010 | stats sum(foo) as FOO sum(bar) as BAR | eval FOOBYSEC = FOO/300

And then, I was grabbing KPIs based on the new kpi of FOOBYSEC

(For this query I need the sum of a KPI value for 5 minutes divided by 300 to show average per second, this is the only way I know how to do this)

When I use a query like that, it doesnt backfill as expected.

I created a new service with a simple query and now it seems to work. But, I'm back at square one because I need to show that KPI value for 5 minutes of average per second...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...