Logs sending being cutoff

STU3 · ‎09-26-2020

Hello,

I have had an issue where specifically the firewall logs were cutoff for about 5 hours and then reconnected and started logging again in Splunk.

The syslog server responsible is actually running and sending data, but how can I troubleshoot why the logs were not sent during that specific time period ?

I am new to troubleshooting indexers etc. any help is appreciaited.

Regards,

STU3 · ‎09-26-2020

PS by "syslog server responsible" I meant the firewall management software responsible was logging all the events at the time of cutoff, might have used a wrong term there

Logs sending being cutoff

heavy forwarder

host

index

indexer

inputs.conf

props.conf

source

sourcetype

syslog

time

transforms.conf

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Join the Conversation

Logs sending being cutoff

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.