For our office Disaster Recovery plan, we use Hyper-V replication to replicate our servers offsite. Yesterday we had a DR event and brought the replicas online. Two of the many servers decided to reindex their WinEventLog:Security events. It was only these two servers and only the WinEventLog:Security events that got reindexed. Is there a way to prevent this from happening during a DR event? It pushed us over our licensing cap. Thank you in advance, Jeremy ... View more

I am in the process of revamping our Splunk installation. This time around we are attempting to implement a more distributed system. In the past we have had a single server running everything, indexing, searching, deployment services, etc. Currently I have a system setup running the Indexer, KV Store, License Master, and Search Head and another running the Deployment Server and Distributed Management Console. Indexing will be off loaded to other indexers as the buildout progresses. With the deployment server on a separate system, I am confused trying to following scenario. I have created a deployment application directly in the filesystem to configure the Universal Forwarders to forward data to the indexer. This is working as expected. Then to setup data imports, I login to the system running the deployment server, click 'Settings', 'Data Inputs', under Forwarded Inputs 'Files & Directories', 'Add new'. I progress through the wizard until asked about the index. I can not see the indexes that were created on the other system. If I use the same process on the Search Head/Indexer, the first page of the wizard gives me a "There are currently no forwarders configured as deployment clients to this instance." This all leads me to believe I am using the system incorrectly. While the documentation goes thru how to setup everything, it doesn't really cover what instance you should do what functions under. It seems to me the %SPLUNK_HOME/etc/deployment-apps should be shared between systems, so the deployment server has them to deploy and the other systems have it to be configured via the web interface. Any help in clearing this up will be greatly appreciated. Thank you in advance, Jeremy ... View more

I am trying to create a top bandwidth users report from the RT_FLOW_SESSION_CLOSE data coming from our Juniper SRX. A sample event looks like: Jan 8 10:03:42 fw-columbus01 1 2015-01-08T10:03:41.446-05:00 fw-columbus01 RT_FLOW - RT_FLOW_SESSION_CLOSE [junos@2636.1.1.1.2.39 reason="idle Timeout" source-address="172.16.0.10" source-port="61968" destination-address="8.8.8.8" destination-port="53" service-name="junos-dns-udp" nat-source-address="xxx.xxx.xxx.xxx" nat-source-port="4995" nat-destination-address="8.8.8.8" nat-destination-port="53" src-nat-rule-name="default" dst-nat-rule-name="None" protocol-id="17" policy-name="default-permit" source-zone-name="trust" destination-zone-name="untrust" session-id-32="23014" packets-from-client="1" bytes-from-client="72" packets-from-server="1" bytes-from-server="144" elapsed-time="4" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/0.0" encrypted="UNKNOWN"] The problem I am running into is, these event records are for both sides of the flow conversation. In order to figure out the total bytes send by 172.16.0.10, not only do I have to sum(bytes_from_client) by source-address where 172.16.0.10 is the source, but I also need to sum(bytes_from_server) by destination_address where 172.16.0.10 is the destination. Now of course I would like a table with any IP addresses seen and total bytes sent, not just a single one. Any guidance will be greatly appreciated! Jeremy ... View more