So I'm not 100% sure where in my splunk system I should be looking. I am gathering logs from two paloalto's on a linux box, syslog-ng and then a universalforwarder is picking it up and sending it into splunk.

It is not a big system, 8 cpu,16gb of ram, ~ 30gb of daily indexing.

If I do a search for just the host, It is showing data was received ~25 min ago, but nothing sense. If I go to monitoring, and forwarder instance it shows data has been received from that same server less then a minute ago.

So I'm guessing this means it's taking 25min to index the data once it's received. Yet the CPU is running at maybe 20% if not less. And if I'm looking at it correctly the queue's are showing 0 items in the queue.