Bug[?] in SSE 3.0 Data Introspection Status

[xeaon]

Hi,

after several re-runs of the introspection, I'm basically out of ideas.

I'm having the strange behaviour, that the first four sourcetype-based searches in step two never complete. My first thought was that there has to be an issue with the searches itselves (first searches are all about AWS). Trying to cancel the specific search results in a TypeError:

data_inventory_introspection.js?bust=10263:2501 Uncaught TypeError: intro_steps[stage].cancel is not a function
    at HTMLAnchorElement.<anonymous> (data_inventory_introspection.js?bust=10263:2501)
    at HTMLAnchorElement.dispatch (common.js:26)
    at HTMLAnchorElement.elemData.handle (common.js:26)

After digging into the sourcecode of app/Splunk_Security_Essentials/components/controls/data_inventory_introspection.js I've noticed, that you can't skip not-running/pending searches at all:

// line 369-371 
let shouldCancel = false
if(intro_elements[sourcetypeLookup['productId']].status == "searching"){
     shouldCancel = true
}

Next I deleted the corresponding elements from the array/object in runtime (e.g. Developer Tools in Chrome) before running the introspection:

delete(intro_elements["AWS__CloudTrail"])
delete(intro_elements["AWS__CloudWatch"])
delete(intro_elements["AWS__Config"])
delete(intro_elements["AWS__S3"])
delete(intro_elements["AWS__VPC_Flow_Logs"])

This actually worked. The searches have been 'skipped' (well they don't exist anymore) but now the next four searches are not beeing completed. While all this happens, CIM Searches in Step one stay queued and not start at all.

I would really appreciate any help

[peter_krammer]

Based on you own findings I found that the Data in my kv store lookup "data_inventory_products_lookup" was likely outdated from a previous version.
So my issue was fixed by:

| inputlookup SSE-default-data-inventory-products.csv
| outputlookup data_inventory_products_lookup

[kintyreab]

Hi Peter,

I tried that query and now get the following error:

Error!
Received the following error:
Description Message
Error occurred while grabbing data_inventory_products   'stage'
Error during Data Availability Enrichment   'list' object has no attribute 'split'

Got any advice for how to fix that?

[peter_krammer]

Yes, now you should have the buttons for Introspection back and there is a button in the popup menu, that says "Reset all Configurations".
Hit it and afterwards it should be fine again.

[xeaon · Accepted solution]

I have an odd solution/workaround for this.

Ofc i was fully aware, that deleting the array elements would prob. mess things up and decided to remove anything AWS related (although the problem isn't specific to the AWS searches) from the source.

So I've used the Lookup Editor Add-On to remove them from the Lookups

• KV Store: data_inventory_products
• CSV File: SSE-default-data-inventory-products.csv (to prevent from beeing loaded in the KV Store again)

After that, I've refreshed via https://yoursplunkhost/en-GB/debug/refresh

Well, this didn't change anything. After resetting and re-run the introspection, I experienced the same behaviour BUT after adding the entries back to the CSV and KV Store, the introspection ran as intended.

I have no idea if there is a legit issue with the procedure where the KV Store is initially filled with the contents of the CSV file.