Splunk IT Service Intelligence

backfill itsi - insufficient data in ITSI summary index

rabadel83
Loves-to-Learn

Hi all,

I received the following error when I try to apply adaptive threshold in one KPI of one service where I enabled the backfill:

"The following problems were encountered: insufficient data in ITSI summary index for policies ['Weekdays, 4 PM', 'Weekdays, 9 AM', 'Weekdays, 2 PM', 'Weekdays, 12 PM', 'Weekdays, 10 AM', 'Weekdays, 3 PM', 'Weekdays, 7 AM', 'Weekdays, 8 AM', 'Weekdays, 1 PM', 'Weekdays, 6 PM', 'Weekdays, 5 PM', 'Weekdays, 11 AM']"

even though I know it should be data in the system.

If I search by the index itsi_summary I see only information from the moment when the backfill was activated (1 day ago) and not from the last 7 days. I've also checked I have the rights for it.

What else could I check to troubleshoot this issue?

Thanks in advance!

Labels (2)
0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

If you have insufficient permission you shouldn't have seen data from the time the backfill was turned on. Can you check the source index (where the raw data is coming from) for the KPI to see if you have data for the last 7 days?

0 Karma

rabadel83
Loves-to-Learn

I've checked the results from the KPI, creating a timechart with span=1h and I see the data in the last 7 days. There is only 1 row on the results of 1 of the days where there is no data, but the rest contain results. What else could I check?

0 Karma