Our connectivity to Check Point was broken for a few days. As a result, Splunk has a gap of time in the data. Data is flowing now, but we'd like to be able to retrieve the older data from that timeframe. Is this possible?
If you are using online mode found in Opsec 2.1+, lea-loggrabber will not retrieve the older data. It indexes the live stream of logs. If you are not using online mode, then like mreynov said, the logs should be pulled in automatically.