Can anyone shed any light on an issue I am having with a Splunk Cloud deployment, I have a Splunk heavy forwarder setup on Red Hat Linux 8 ingesting Cisco Switches via syslog, This appears to be working fine for the vast majority of devices, I can see the individual directories and logs dropping into /opt/splunklogs/Cisco/, There is just one Cisco device that isn't being ingested ? I have compared the config on the switch to the others and it is setup correctly logging host/trap etc, I can telnet from the switch to the interface on the Linux server and see the syslog hitting the interface via tcpdump, I have never had to populate an allow list for the switch IP's it looks to do them automatically on the forwarder, I can see the Cisco directories in the forwarder are generated by SPLUNK.
For some reason this one switch just isn't being ingested.
Does anyone have any guidance on some troubleshooting steps to try and establish what the issue is ?
Thanks
