Indexing issue- Why is data going on and off?

[ssuluguri]

Hi Team,

We are ingesting data from syslot to splunk using Cyberark App . Data is going ON and OFF even though data available on /var/log/Cyberark .

Can you suggest what can be the issue .

[mansisona]

I am facing the same issue while using a scripted input. Did you find any ways to identify the root cause and fix it ? We are receiving data from a scripted input. we also tried putting that data in a csv file which has all the data. but still we are observing issues with data missing 

[meetmshah]

Hello @ssuluguri, Can you please confirm below - 

1. How the _time is being extracted? If it's based on events - can you validate if the timestamp extraction is performed correctly?
2. Can you check queues on the indexers?
3. Can you run the search on real-time in Splunk along with running tcpdump on the host and validate if both are matching?

[ssuluguri]

You can also refer below screenshot.

[ssuluguri]

Thanks for the reply Meet.

1.Data is indexing on cloud 

2.Data automatically populating for sometimes and going OFF.

Backend raw data .