Web intelligence App - backfill summary indexes not showing any data in reports/ dashboards

[raghukodali]

I am trying to use Web intelligence app on Splunk 5.x with a standard Apache logs (access_combined) that have all required fields.
In the setup screen, I can see the data indexed with sourcetype="access_c*".
After running backfill scripts, I don't see any data out of the reports/dashboards in the App.

Here are the checks I have done so far
- Make sure that the license is available
- I have edited events.conf to make sure the sourcetype is properly set
- looked in $SPLUNK_HOME/var/spool/splunk directory but did not see any files over there
- I see ERROR UserManager - Error while setting user context: Could not get info for non-existent user="nobody" in splunkd.log
- I checked the user has access to the indexes created by backfill scripts
- the general search is showing the events

Any tips or pointers on how to get the app working ?

-raghu

[macycron]

Try changing the app configuration. In the Web intlligence app, go to setup. In the sourcetypes field, put the name of the index that contains your web logs. Example: instead of sourcetype=access_combined put instead index=yourweblogs.

[hexx]

That explains why your summary indexes are not populating. At this point, you're going to need to decompose those searches to understand why they are not returning results. Are they failing to find the expected events? Are they failing to find the expected fields? Unfortunately, there is no easy recipe here. You have to use trial and error.

[raghukodali]

Went to Manager -> Searches and saw Reports for Web Intelligence app, there were 124 listed searches. What I could find out is the searches which aren't scheduled and not summarized like "New Visitors Lookup" are showing results.
All the other searches which are scheduled, and have SI and where the searches have index="wi_summary_daily" / "wi_summary_hourly" / "wi_summary_fivemin" are not showing any results.

[hexx]

If you manually run in the flashtimeline the searches that are intended to regenerate the summary indexes, do these return any results?