missing fields in linux installtion compared to windows

[terryblair]

I had splunk running on a windows machine with my cisco asa 5505 sending syslogs too it and I was able to see destination ips and a bytes_in field but now ive moved to splunk to an ubuntu box, all the destinations ips are just our external ip and the bytes_in field seems to of disappeared completely

[netwrkr]

How are you getting the logs to the linux box? Direct through a splunk forwarder or syslog or? Can you view the raw logs and see if the fields you seek are present? If you look at 'show source' within splunk are the fields present?