splunk logs missing for a particular timeframe

[Prakash493]

Hi I have an issue , i have a gap in splunk logs for a 20 minute , i saw my splunk universal forwarder is up and running , collecting logs but for a 20 min period it didnt ingest any logs then after some time it again ingest logs , how do i find what happend on that 20 minute period also how can i recover those logs which went missing for 20 minutes.

[adonio · Accepted solution]

for troubleshooting, start with:
index=_internal host=<youtForwarder> log_level = WARN* OR log_level=error
for the rest, look at this link:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Troubleshooting/Cantfinddata