https://community.splunk.com/t5/Getting-Data-In/splunk-logs-missing-for-a-particular-timeframe/m-p/447469#M77819 <P>for troubleshooting, start with:<BR /> <CODE>index=_internal host=&lt;youtForwarder&gt; log_level = WARN* OR log_level=error</CODE><BR /> for the rest, look at this link:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Troubleshooting/Cantfinddata">https://docs.splunk.com/Documentation/Splunk/7.2.6/Troubleshooting/Cantfinddata</A></P> Tue, 14 May 2019 01:05:40 GMT adonio 2019-05-14T01:05:40Z https://community.splunk.com/t5/Getting-Data-In/splunk-logs-missing-for-a-particular-timeframe/m-p/447468#M77818 <P>Hi I have an issue , i have a gap in splunk logs for a 20 minute , i saw my splunk universal forwarder is up and running , collecting logs but for a 20 min period it didnt ingest any logs then after some time it again ingest logs , how do i find what happend on that 20 minute period also how can i recover those logs which went missing for 20 minutes.</P> Sun, 05 May 2019 20:17:35 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-logs-missing-for-a-particular-timeframe/m-p/447468#M77818 Prakash493 2019-05-05T20:17:35Z https://community.splunk.com/t5/Getting-Data-In/splunk-logs-missing-for-a-particular-timeframe/m-p/447469#M77819 <P>for troubleshooting, start with:<BR /> <CODE>index=_internal host=&lt;youtForwarder&gt; log_level = WARN* OR log_level=error</CODE><BR /> for the rest, look at this link:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Troubleshooting/Cantfinddata">https://docs.splunk.com/Documentation/Splunk/7.2.6/Troubleshooting/Cantfinddata</A></P> Tue, 14 May 2019 01:05:40 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-logs-missing-for-a-particular-timeframe/m-p/447469#M77819 adonio 2019-05-14T01:05:40Z