Splunk IT Service Intelligence

backfill itsi - insufficient data in ITSI summary index

rabadel83
Loves-to-Learn

Hi all,

I received the following error when I try to apply adaptive threshold in one KPI of one service where I enabled the backfill:

"The following problems were encountered: insufficient data in ITSI summary index for policies ['Weekdays, 4 PM', 'Weekdays, 9 AM', 'Weekdays, 2 PM', 'Weekdays, 12 PM', 'Weekdays, 10 AM', 'Weekdays, 3 PM', 'Weekdays, 7 AM', 'Weekdays, 8 AM', 'Weekdays, 1 PM', 'Weekdays, 6 PM', 'Weekdays, 5 PM', 'Weekdays, 11 AM']"

even though I know it should be data in the system.

If I search by the index itsi_summary I see only information from the moment when the backfill was activated (1 day ago) and not from the last 7 days. I've also checked I have the rights for it.

What else could I check to troubleshoot this issue?

Thanks in advance!

Labels (2)
0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

If you have insufficient permission you shouldn't have seen data from the time the backfill was turned on. Can you check the source index (where the raw data is coming from) for the KPI to see if you have data for the last 7 days?

0 Karma

rabadel83
Loves-to-Learn

I've checked the results from the KPI, creating a timechart with span=1h and I see the data in the last 7 days. There is only 1 row on the results of 1 of the days where there is no data, but the rest contain results. What else could I check?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...