backfill itsi - insufficient data in ITSI summary index

[rabadel83]

Hi all,

I received the following error when I try to apply adaptive threshold in one KPI of one service where I enabled the backfill:

"The following problems were encountered: insufficient data in ITSI summary index for policies ['Weekdays, 4 PM', 'Weekdays, 9 AM', 'Weekdays, 2 PM', 'Weekdays, 12 PM', 'Weekdays, 10 AM', 'Weekdays, 3 PM', 'Weekdays, 7 AM', 'Weekdays, 8 AM', 'Weekdays, 1 PM', 'Weekdays, 6 PM', 'Weekdays, 5 PM', 'Weekdays, 11 AM']"

even though I know it should be data in the system.

If I search by the index itsi_summary I see only information from the moment when the backfill was activated (1 day ago) and not from the last 7 days. I've also checked I have the rights for it.

What else could I check to troubleshoot this issue?

Thanks in advance!

[esnyder_splunk]

If you have insufficient permission you shouldn't have seen data from the time the backfill was turned on. Can you check the source index (where the raw data is coming from) for the KPI to see if you have data for the last 7 days?

[rabadel83]

I've checked the results from the KPI, creating a timechart with span=1h and I see the data in the last 7 days. There is only 1 row on the results of 1 of the days where there is no data, but the rest contain results. What else could I check?