@alacercogitatus , the app or add-on version we have is the latest one I can see on splunk base(1.4.2) What surprises me is the logs have not stop completely but only for sometime. How can python or old sdk be the cause while it is working partially. ... View more

@soumyasaha25 , Are you ingesting cloudtrail logs from multiple accounts? If yes, can you please suggest the approach? ... View more

It all depends on the particular mechanism of transporting logs from the source to the forwarder. In general, the forwarder has a configurable buffer in which it stores events destined for the indexer(s) or upstream forwarder. But whether data will get "filled" is up to the input. If it's a simple sylog input, especially UDP one, the source will most probably not retransmit the events. If it's a scripted/modular input, it's up to the script's author (but usually the input is able to "catch up"). It also depends on the duration of the outage because even if the input is in theory able to catch up but the data gets removed (rotated out) from the source, you will have gaps. ... View more