KPI Shows 0 Entities but generated search from same kpi shows results

[david_rose]

We have defined a service with an adhoc base search.

When i run the generated search from the kpi, i get results:

If I go to threshold settings, I see data in the trending (chose a random time, all time shows data)

But if I go to service analyzer, and click on the service, the KPI shows N/A and it shows 0 Entities. Am i missing something?

[esnyder_splunk]

This might be related to the number of services/KPIs/saved searches you have. See best practice #3 here: https://www.splunk.com/en_us/blog/it/top-3-best-practices-for-configuring-splunk-itsi-in-a-large-sca...

But it depends on a lot of environmental factors. When did you run the two searches? The assumption is back-to-back. But if they're separated by, say, an hour and your service analyzer only looks at the past hour, then maybe you should be getting different results.