https://community.splunk.com/t5/All-Apps-and-Add-ons/Debug-Missing-Index-Data/m-p/463371#M56945 <P>Hi @rmurali4u<BR /> Check the time format of the events not moved, if they have a european data (dd/mm/yyyy) Splunk takes an american format (mm/dd/yyyy) so events of 9th of december are indexed at the 12 of september.</P> <P>Ciao.<BR /> Giuseppe</P> Mon, 09 Dec 2019 16:16:01 GMT gcusello 2019-12-09T16:16:01Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Debug-Missing-Index-Data/m-p/463370#M56944 <P>Hi </P> <P>My environment is as below AWS EKS cluster and on premise Splunk. I have configured Splunk connector with indexRouting enabled. There is situation where I am seeing logs in EKS pods which are not moved to Splunk. In this case how to debug the issue to find the root cause. </P> <P>Please help, i am new to K8 and Splunk.</P> <P>Thanks.</P> Mon, 09 Dec 2019 15:14:43 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Debug-Missing-Index-Data/m-p/463370#M56944 rmurali4u 2019-12-09T15:14:43Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Debug-Missing-Index-Data/m-p/463371#M56945 <P>Hi @rmurali4u<BR /> Check the time format of the events not moved, if they have a european data (dd/mm/yyyy) Splunk takes an american format (mm/dd/yyyy) so events of 9th of december are indexed at the 12 of september.</P> <P>Ciao.<BR /> Giuseppe</P> Mon, 09 Dec 2019 16:16:01 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Debug-Missing-Index-Data/m-p/463371#M56945 gcusello 2019-12-09T16:16:01Z