>> Have you checked RAM, CPU and disk activity on the UF box?
RAM, CPU and Disk Activity are fine
>> What is the date and time of the first item missed? Does that coincide or nearly coincide with anything other happenings, either on servers or the network? Is it a "special" time like before midnight it was fine but skipped its first event at 2 minutes after midnight? Or 11:00 PM?
Nov 5th midnight.
*>> While I have no idea how this would still be happening now, does it appear like it could be daylight savings related? If you search all time just to see the relative amounts of events over the long term, can you spot these events possibly out of order (like they're in 2017 or something, or maybe added to 2015's data?)
It's not related to daylight savings. That was our first thought. This started at November 5th, two days before daylight saving change
*>>Lastly, do you have something unique (or nearly so) you can search that comes from inside one of the missing events? Maybe if you can search for that you'll find that event, and perhaps that will lead you to find the rest of them.
I did, and the line I looked for was not registered in Splunk.
... View more