Hi, we have a client that is experiencing indexed log disappearing and reappearing on a daily basis. Log input is a file that gets populated by custom application, all logs follow splunk log recommendation (one line with nice timestamp). Logs get indexed and one day you can see them, another day they just disappear. Indexer is a Windows 2008_64 server. Any suggestions how to troubleshoot this, or ideas how can this happen? There is no custom processing of logs, no scripted preprocessing, no sed filtering...
