Why is Splunk missing logs?

[bheptinstall]

Hello everyone I am running into an issue that may be either Splunk or my Kiwi Syslog server, and I am not really sure and the research I am doing is not helping currently.

We had a network device that was not communicating and sending logs to syslog server but we fixed that and now whenever we view the RAW logs on the server we can see the specific %Port_Security logs that we are trying to have reported directly to splunk.

Whenever I run a search query (that worked before a baseline change) I return 0 results. So what I did was change the way I am trying to retrieve these logs so I run a "sourcetype=syslog" host={switch-name}. The switch pops up and contains a number of logs. However, it seems that the most important log that we want (%Port_Security) does not return as a finding. After, running this search I figured there was maybe a problem with the sourcetype so I ran a search that targets the live syslog data with - source={log location} host={switch-name}. The system pops up again. I did not find the port security report inside this search either. I even added a (%Port_Security) on the back end of it. 

I reached out to our engineers that provided the tool to us to help fix the issue since they are the ones that provide it and do the back end configuration and troubleshooting but they refuse to help. 

[diogofgm]

How are you indexing the data? UF with a monitor stanza in the syslog server? If that's te case the logs would be there. If not, do you have some rules that might change or discard the logs you are looking for?
If, as I believe given the %Port_Security, you are running cisco devices use this:

https://splunkbase.splunk.com/app/1467

The final source type should not be syslog but something like cisco:ios. Avoid using syslog as a final source type since the logs will be different fro device to device and it will make a mess to build proper extractions since they will apply to everything with math source type.