You could do one of the following to re-sync the events from the server.
i) Manually add another stanza in etc\...\local\admon.conf like so:
[newCollection]
targetDc = "your Server here"
startingNode =
monitorSubtree = 1
disabled = 0
ii) Use Splunkweb to add the new collection with the same settings as the old one.
iii) In the splunk directory, under var\lib\splunk\persistentstorage\ADMon
there is a file called "your collection name here.ini".
Deleting this file before restarting splunk-admon.exe will resync the data from the server. If there are multiple such files, pick the file pertaining to the collection you want to reenumerate.
... View more