https://community.splunk.com/t5/Getting-Data-In/Missed-data-from-SOPHOS/m-p/709561#M117222 <P>I am encountering an issue regarding the synchronization of update logs between Sophos and Splunk for a specific host, designated as "EXAMPLE01." According to the Sophos console, the device has received updates on the following dates:</P><UL><LI>19 Nov 2024</LI><LI>20 Nov 2024</LI><LI>26 Nov 2024</LI><LI>2 Dec 2024</LI><LI>3 Dec 2024</LI><LI>10 Dec 2024</LI><LI>17 Dec 2024</LI><LI>21 Jan 2025</LI></UL><P>However, when I search in Splunk within the same timeframe (1 Nov 2024 to 23 Jan 2025), the logs only show updates on:</P><UL><LI>3 Dec 2024</LI><LI>10 Dec 2024</LI><LI>17 Dec 2024</LI></UL><P>I aim to establish a rule that triggers a notification if there has been no update for 20 days or more. Regrettably, despite the Sophos console indicating recent updates, the discrepancies in Splunk raise concerns about accurate monitoring.</P><P>I have verified the settings under Indexing &gt; Indexes and Volumes in Splunk, and everything appears to be configured correctly. Could anyone provide insights on how to track and resolve this discrepancy?</P><P>Thank you for your assistance.</P> Thu, 23 Jan 2025 07:24:48 GMT zksvc 2025-01-23T07:24:48Z https://community.splunk.com/t5/Getting-Data-In/Missed-data-from-SOPHOS/m-p/709561#M117222 <P>I am encountering an issue regarding the synchronization of update logs between Sophos and Splunk for a specific host, designated as "EXAMPLE01." According to the Sophos console, the device has received updates on the following dates:</P><UL><LI>19 Nov 2024</LI><LI>20 Nov 2024</LI><LI>26 Nov 2024</LI><LI>2 Dec 2024</LI><LI>3 Dec 2024</LI><LI>10 Dec 2024</LI><LI>17 Dec 2024</LI><LI>21 Jan 2025</LI></UL><P>However, when I search in Splunk within the same timeframe (1 Nov 2024 to 23 Jan 2025), the logs only show updates on:</P><UL><LI>3 Dec 2024</LI><LI>10 Dec 2024</LI><LI>17 Dec 2024</LI></UL><P>I aim to establish a rule that triggers a notification if there has been no update for 20 days or more. Regrettably, despite the Sophos console indicating recent updates, the discrepancies in Splunk raise concerns about accurate monitoring.</P><P>I have verified the settings under Indexing &gt; Indexes and Volumes in Splunk, and everything appears to be configured correctly. Could anyone provide insights on how to track and resolve this discrepancy?</P><P>Thank you for your assistance.</P> Thu, 23 Jan 2025 07:24:48 GMT https://community.splunk.com/t5/Getting-Data-In/Missed-data-from-SOPHOS/m-p/709561#M117222 zksvc 2025-01-23T07:24:48Z