Hi Ricklepick. Thanks for your info. We have a lot of data in our network. We lost logs form this device at approx 05:15 in the morning, local time. At that time, there isn`t a lot of traffic on our network. We had not excperinced any lack of connectivty in that period where we was missing these logs from this device. I If it was the loadbalancer, then we should miss logs from more one device. Our syslogs sources are sending logs through the netscaler to syslog servers. Syslogservers are sending then the syslogs to SPlunk index Cluster, which are sending it to the Heavy forwarders. Brgds DD ... View more

Hi Isoutamo. Sorry for the late response, had some time off. But If I share our Splunk enviroment, perhaps there would be some places you could recommend for troubleshooting.  Our clients are sending syslogs through Netscaler enviroment to the syslogs servers. Syslog servers are connected to the Splunk Index Cluster, which is connected to the Search Head cluster and Heavy Forwarders.  Heavy forwarders are connected to Universal Forwarder. There was no changes in our network. The logs from this specific host was missing for about 5 hours. Earlier we had some issues with the indexes in our Splunk enviroment, which they are saying is fixed. In this case our syslogs servers have Netscaler between it self and the clients. The logs are at the end send via Internet to a Cybersecurity enviroment. Does this make the picture more clear, or can I send you our diagram over the Splunk envorment (some place where it is not public) ? Brgds DD ... View more

Hi PickleRick. Thank you for replying on the post. Our devices are sending syslogs to Splunk server over the network (there has not been, network issues). Secondly, we  our supplier noticed, that they was not recieving logs from one specefic host. And after some hours (approx 5), our Supplier was recieving logs from the specific host. While the supplier was not recieving logs from this host, they recieved a lot of logs from other hosts on our network. It happend around 04.47 (am) local time, on that time, there is not load on the network  Our supplier is maintaining indexes, and system work.  About the ingestion process stops, could that process stop for one host (one out of many), while the other hosts are not impacted ? Brgds DD ... View more