You could do one of the following to re-sync the events from the server. i) Manually add another stanza in etc\...\local\admon.conf like so: [newCollection] targetDc = "your Server here" startingNode = monitorSubtree = 1 disabled = 0 ii) Use Splunkweb to add the new collection with the same settings as the old one. iii) In the splunk directory, under var\lib\splunk\persistentstorage\ADMon there is a file called "your collection name here.ini". Deleting this file before restarting splunk-admon.exe will resync the data from the server. If there are multiple such files, pick the file pertaining to the collection you want to reenumerate. ... View more