Connectivity to Check Point OPSEC LEA reset, now missing data. Any way to load the old data once connection re-established?

[jtsplunk]

Our connectivity to Check Point was broken for a few days. As a result, Splunk has a gap of time in the data. Data is flowing now, but we'd like to be able to retrieve the older data from that timeframe. Is this possible?

[ccheung_splunk]

If you are using online mode found in Opsec 2.1+, lea-loggrabber will not retrieve the older data. It indexes the live stream of logs. If you are not using online mode, then like mreynov said, the logs should be pulled in automatically.

[mreynov_splunk]

If logs were not rotated, it should just work. If they were, you may need to import some of the data manually.