Why is backfill not working in Splunk IT Service Intelligence?

[EricLloyd79]

I cannot see the Backfill of 7 days that I specified for a KPI in a service. I created a KPI Base Search and then, when I added the KPI, I specified a 7 days backfill. I see the notification in the notification dropdown saying it was completed successfully in 0 m (which seems odd to me).

Yet, when I go to the KPI in the Deep Dive, it only has stats for that KPI to the time I started that service.

Is there an additional step I am missing?

Has anyone else experienced this?

[EricLloyd79 · Accepted solution]

Okay I think I have an idea of what is happening though I dont understand why.

I needed to create KPIs that were based on the computation of other KPIs. So, I created these services with a query like:

sourcetype=abc-prod A0010 | stats sum(foo) as FOO sum(bar) as BAR | eval FOOBYSEC = FOO/300

And then, I was grabbing KPIs based on the new kpi of FOOBYSEC

(For this query I need the sum of a KPI value for 5 minutes divided by 300 to show average per second, this is the only way I know how to do this)

When I use a query like that, it doesnt backfill as expected.

I created a new service with a simple query and now it seems to work. But, I'm back at square one because I need to show that KPI value for 5 minutes of average per second...