Mismatch between Violations ingested into splunk and what Jfrog reports on it's portal

[pault28]

We current have this setup on our environment. However we are seeing a lot of difference between what Jfrog reports as violations and what Splunk has ingested. See image below:

Splunk last 7 days. Worth noting that this is not related to failure to ingest data as we getting data for logs.

Jfrog last 7 days:

[pault28]

This is was due to worker that handles this ingestion dying silently. Restart of fluentd resolved the issue. It would be good to have more logging perhaps so users can identify this more easily.