We have defined a service with an adhoc base search.
When i run the generated search from the kpi, i get results:
If I go to threshold settings, I see data in the trending (chose a random time, all time shows data)
But if I go to service analyzer, and click on the service, the KPI shows N/A and it shows 0 Entities. Am i missing something?
This might be related to the number of services/KPIs/saved searches you have. See best practice #3 here: https://www.splunk.com/en_us/blog/it/top-3-best-practices-for-configuring-splunk-itsi-in-a-large-sca...
But it depends on a lot of environmental factors. When did you run the two searches? The assumption is back-to-back. But if they're separated by, say, an hour and your service analyzer only looks at the past hour, then maybe you should be getting different results.