# ML Datafeed lookback retrieved no data

**URL:** <https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [November 27, 2020, 11:03am UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864 "2020-11-27T11:03:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [November 27, 2020, 11:03am UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864/1 "2020-11-27T11:03:14Z")

</div>

Hello,

I am trying to run the job "windows\_rare\_user\_type10\_remote\_login" in my cluster and It process no data, and I am getting `ML Datafeed lookback retrieved no data`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/b/5b5963798d55bdaf65cd84a200ccc32c0609595c.png)

Knowing that I already installed winlogbeat in some windows machines and I am receiving data from those machines.

Could you tell me what's wrong please !

Thanks for your help

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [November 27, 2020, 6:09pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864/2 "2020-11-27T18:09:20Z")

</div>

May I suggest you clone the job, run it over your historical data, then see how much of the historical data this new cloned job sees. Let us know.

---

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [November 30, 2020, 10:30am UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864/3 "2020-11-30T10:30:34Z")

</div>

Thanks for your answer @richcollier, I tried to do what you asked, and here is what I got (sorry if there are some mistakes as I just begin workign with ELK stack)

When I click on clone I get:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/d/2d5d0c5ac39c5370fe4735617ac1e590f9ad49fa.png)

And then I continue by doing this conflagration:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/993b411a9d3cc6aa235c0661b883ff15fd5600ea.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/2/725b42c22cd839fa8695b9662791c21a39d1a1c2.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f2e7f620a027db100f4bd3549ab6a711d012a7d3.png)

and when I click `Next` to go to the validation section, I get this error :

![image](https://us1.discourse-cdn.com/elastic/original/3X/4/4/44ad5050b46c68e9e3c9a687c1cfd38aff4e0a5e.png)

---

<div class="post-metadata">

**Author:** ![Peter\_Harverson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_harverson/32/21057_2.png) [@Peter\_Harverson](https://discuss.elastic.co/u/Peter_Harverson)\
**Post date:** [November 30, 2020, 2:09pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864/4 "2020-11-30T14:09:39Z")

</div>

@TheHunter1 could you let us know the version of the stack you are running? I was unable to reproduce those errors you saw on cloning your job in my setup here, but we have fixed a few issues around clone over recent releases.

Did you make any edits to the supplied configuration when cloning the job - I couldn't spot anything obvious from the screenshots you posted, but I may have missed something.

---

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [November 30, 2020, 2:16pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864/5 "2020-11-30T14:16:12Z")

</div>

thanks for your answer @Peter_Harverson, so maybe I understand the reason of that issue, maybe cause I am trying the version 8.0.0 and I didn't run `git pull` since a while. I will prepare my machine to make the necessary updates and keep you updated if that error persist.  
Thanks again 🙂

---

<div class="post-metadata">

**Author:** ![Peter\_Harverson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_harverson/32/21057_2.png) [@Peter\_Harverson](https://discuss.elastic.co/u/Peter_Harverson)\
**Post date:** [November 30, 2020, 2:40pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864/6 "2020-11-30T14:40:15Z")

</div>

If after updating to the latest 8.0.0 you still find you are hitting issues with clone, please could you let us have the JSON job config of the job you are cloning - go to the JSON tab of the job in the Anomaly detection jobs list:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/7/877f9554f9ed3fff286356956b075ae088141e49.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2020, 2:40pm UTC](https://discuss.elastic.co/t/ml-datafeed-lookback-retrieved-no-data/256864/7 "2020-12-28T14:40:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
