Just encountered the same error. Fixed by downloading the CIM app from Splunkbase and extracting the cim_dns_reply_codes2.csv.default file (from Splunk_SA_CIM/lookups/) , saving it as cim_dns_reply_codes2.csv and then uploading it back to the CIM app on our instance. For some reason the CSV is there in the app as cim_dns_reply_codes2.csv.default which Splunk doesn't seem to recognise as a valid CSV. Rebuilding the Network_Resolution data model and seems to be working now. ... View more

That would explain why the .co.uk domains aren't being parsed correctly because afaik the IANA list only has .uk as a TLD. ... View more

This solution worked in our environment. ... View more

Thanks! Tested and this works a treat. ... View more

Yes, you would receive duplicate logs if you are forwarding from both sites, as that will include replicated logs from each site/database. I haven't seen unique tag/field to indicate its original or replicated event. However, each event will have host=server1 (in site1) or server2 (from site2). But this may not be helpful, unless there is a way in the Symantec console to write only logs to files that are originated in that site. Another option (assuming in the DB, we can differentiate replicated logs) would be to use DB connect at each site, but only pull events that are generated in that site, excluding replicated logs. You may then need to extract fields your dashboard/reports etc.. ... View more