We are monitoring a file name X.log witch contain similar structure for events starting by a date format. The number of events that were indexed in Splunk are less than the number of events in the file. Is there any bug in indexing ? what logs should i look at ?
It is also possible that your timestamping is off and some of your events are showing up way at the wrong time (even in the future). Try this search run for ALL TIME (you have to use "ALL TIME" because that is the only way to search for events "in the future):