Archive

Connectivity to Check Point OPSEC LEA reset, now missing data. Any way to load the old data once connection re-established?

Splunk Employee
Splunk Employee

Our connectivity to Check Point was broken for a few days. As a result, Splunk has a gap of time in the data. Data is flowing now, but we'd like to be able to retrieve the older data from that timeframe. Is this possible?

0 Karma

Splunk Employee
Splunk Employee

If you are using online mode found in Opsec 2.1+, lea-loggrabber will not retrieve the older data. It indexes the live stream of logs. If you are not using online mode, then like mreynov said, the logs should be pulled in automatically.

0 Karma

Splunk Employee
Splunk Employee

If logs were not rotated, it should just work. If they were, you may need to import some of the data manually.

0 Karma