We are currently configuring the DUO security MFA on Splunk Enterprise and we noticed that the local account admin gets forced through the MFA. Lets say that there is a problem with the DUO MFA and we need to investigate the issue within Splunk, then how are we supposed to login to troubleshoot? We could deactivate the DUO MFA but we dont want to let the regular users login without it. Is there any way to configure the DUO security MFA to check the LDAP accounts and ignore the local admin? Are there any workarounds? ... View more

We are currently trying to recover some lost data on one indexer. The manual recovery process is long enough that we are evaluating automated or scripted alternatives. This data is available on another indexer on a different instance and the indexers are not clustered. They are two different indexers. Since the indexers are completely different instances the buckets are not identical we cant use rsync or manual copy of the buckets to recover this data. How would you sync different indexers and copy/collect only the data that is missing on the destination? ... View more