How to find lost logs from universal forwarder?

[ozirus]

Hi,

I've a universal forwarder on a Linux machine that forwards Security Onion logs to my Splunk instance.

Logs are coming to network interface via port 9998 (checked tcpdump), When I try to search with;

index=_internal metrics kb group=per_sourcetype_thruput | eval sizeMB = round(kb/1024,2)| stats sum(sizeMB) by series | sort -sum(sizeMB) | rename sum(sizeMB) AS "Size on Disk (MB)" 

It shows source names etc. and logs are coming to my instance but when I try to see the logs, I can't find the logs. They're being saved somewhere but I can't figure out the search to see them.

How can i do this?

Regards,

[richgalloway · Accepted solution]

You could have a timestamp problem. Try searching All Time to see if Splunk is logging the events in the future.

[ozirus]

Thanks! It was.

[richgalloway]

Please accept the answer.

[ozirus]

It wasn't available yesterday. Now it is accepted i guess. Thanks again!