Splunk takes a little while to spin up after a restart, how long are you waiting for these logs to show up after a restart?
Also depending on how you have the input set up, you could potentially speed up the process.
If you have
[monitor:/var/log/*]
Splunk will (on restart) iterate through the entire /var/log/ directory, listing all files in the directory and all subdirectories, then it will begin traversing down a directory level and on and on until it has finished. Then it will start indexing the files.
