https://community.splunk.com/t5/Getting-Data-In/The-curious-case-of-missing-events/m-p/558314#M92374 <P>At the beginning of February this year we started ingesting events from Autosys prod and non-prd servers.&nbsp; All was going well until the end of the month.&nbsp; At 23:59 on 28th Feb, events stopped appearing in the index to which they are being ingested.&nbsp; A few days later they started again at midnight.&nbsp; None of the missed events were collected.&nbsp; The log files for Autosys roll over at midnight so I would not expect events during the missing time period to be collected as the files would have been renamed.</P><P>This has happened every month since.&nbsp; In March the events started coming in on 3rd, April it was 4th, May on&nbsp; 5th and June they appeared again on the 6th.&nbsp; The only pattern I can see is that events reappear on the day of the month that equals the number of the month - ie 3/3, 4/4, 5/5 and 6/6.&nbsp; If that is the case, then events will not appear in July until 7th.</P><P>How can this be?&nbsp; I can see no _internal messages that help.</P><P>Can someone shed some light on this?&nbsp; Thanks</P> Mon, 05 Jul 2021 14:00:30 GMT timrich66 2021-07-05T14:00:30Z https://community.splunk.com/t5/Getting-Data-In/The-curious-case-of-missing-events/m-p/558314#M92374 <P>At the beginning of February this year we started ingesting events from Autosys prod and non-prd servers.&nbsp; All was going well until the end of the month.&nbsp; At 23:59 on 28th Feb, events stopped appearing in the index to which they are being ingested.&nbsp; A few days later they started again at midnight.&nbsp; None of the missed events were collected.&nbsp; The log files for Autosys roll over at midnight so I would not expect events during the missing time period to be collected as the files would have been renamed.</P><P>This has happened every month since.&nbsp; In March the events started coming in on 3rd, April it was 4th, May on&nbsp; 5th and June they appeared again on the 6th.&nbsp; The only pattern I can see is that events reappear on the day of the month that equals the number of the month - ie 3/3, 4/4, 5/5 and 6/6.&nbsp; If that is the case, then events will not appear in July until 7th.</P><P>How can this be?&nbsp; I can see no _internal messages that help.</P><P>Can someone shed some light on this?&nbsp; Thanks</P> Mon, 05 Jul 2021 14:00:30 GMT https://community.splunk.com/t5/Getting-Data-In/The-curious-case-of-missing-events/m-p/558314#M92374 timrich66 2021-07-05T14:00:30Z https://community.splunk.com/t5/Getting-Data-In/The-curious-case-of-missing-events/m-p/558317#M92375 <P>To add -&nbsp;</P><P>This does not happen on any other ingestion.&nbsp; The servers are still phoning home and sending infra metrics to ITSI.&nbsp; I have redeployed inputs.conf to the servers.&nbsp; One is prod, one non-prd.</P> Mon, 05 Jul 2021 14:09:45 GMT https://community.splunk.com/t5/Getting-Data-In/The-curious-case-of-missing-events/m-p/558317#M92375 timrich66 2021-07-05T14:09:45Z