topic Re: How to check if DFS is enabled in Splunk Enterprise in regards to Log4J (CVE-2021-44228) in Splunk Data Fabric Search

How to check if DFS is enabled in Splunk Enterprise in regards to Log4J (CVE-2021-44228)

Rafiuddin — Tue, 14 Dec 2021 01:59:30 GMT

Hi Guys,
I am quite new to splunk. I was looking around to see any splunk documents pertaining to Data Fabric Search (DFS) as there is an impact since it leverages Log4j. However, I can't seem to find how to check if my Splunk Enterprise is using it.

Is there a setting that I can check from SearchHead, Indexer, etc if DFS is enabled?

Also, does it mean if I did not install DFS Manager App, I am not using the DFS functionality?

Thank you,
Rafiuddin

How to check if DFS is enabled in Splunk Enterprise in regards to Log4J (CVE-2021-44228)

manjunathmeti — Tue, 14 Dec 2021 05:37:48 GMT

hi @Rafiuddin,

1. You can check disabled=false in server.conf.

[dfs] disabled = <boolean> * When set to 'false' for the [dfs] stanza, this setting enables data fabric search functionality for this instance. * A 'false' setting causes the Splunk software to start the DFSMaster Java process in a separate process. This process is central to Data Fabric Search funtionality. * Default: true

2. To check if DFS is in use you can run the below query. If it returns results then DFS is enabled.

Re: How to check if DFS is enabled in Splunk Enterprise in regards to Log4J (CVE-2021-44228)

Rafiuddin — Wed, 15 Dec 2021 05:05:56 GMT

Thank you @manjunathmeti !

Re: How to check if DFS is enabled in Splunk Enterprise in regards to Log4J (CVE-2021-44228)

sybilla — Thu, 16 Dec 2021 11:15:13 GMT

Please use:

| rest /services/configs/conf-server/dfs | table title,disabled

Re: How to check if DFS is enabled in Splunk Enterprise in regards to Log4J (CVE-2021-44228)

Yemi_Splunk — Mon, 20 Dec 2021 17:26:08 GMT

You can also use this:

https://<myonpremsplunkurl.com:8089/services/server/info

You will be prompted to login from the browser. Login. If DFS is enabled, it will dfs_enable 1, if not enabled, it will show dfs_enabled 0.

dfs_enabled

eai:acl

app
can_list	1
can_write	1
modifiable	0

Cheers