Let me know if the new version (1.1.1) fixes the problem (if you accept the solution, I'll assume that means it is fixed). ... View more

Appending/subsearches can be pretty expensive in terms of performance and sometimes pretty hard to keep track of. What you probably need here is to run a single search over the last 5 weeks (or days, or whatever your window is) BUT scope it to the right hour interval. For example, this search will go back 5 days, search only between 9pm and 10pm and chart the count of events per method (GET or POST) for said slot of each day: index=_internal source=*access* date_hour=21 earliest=-5d | chart count over method by date_mday ... View more

yes you need to delete it for the backfill command to restart ... View more