All Apps and Add-ons

Bug[?] in SSE 3.0 Data Introspection Status

xeaon
Explorer

Hi,

after several re-runs of the introspection, I'm basically out of ideas.

I'm having the strange behaviour, that the first four sourcetype-based searches in step two never complete. My first thought was that there has to be an issue with the searches itselves (first searches are all about AWS). Trying to cancel the specific search results in a TypeError:

data_inventory_introspection.js?bust=10263:2501 Uncaught TypeError: intro_steps[stage].cancel is not a function
    at HTMLAnchorElement.<anonymous> (data_inventory_introspection.js?bust=10263:2501)
    at HTMLAnchorElement.dispatch (common.js:26)
    at HTMLAnchorElement.elemData.handle (common.js:26)

After digging into the sourcecode of app/Splunk_Security_Essentials/components/controls/data_inventory_introspection.js I've noticed, that you can't skip not-running/pending searches at all:

// line 369-371 
let shouldCancel = false
if(intro_elements[sourcetypeLookup['productId']].status == "searching"){
     shouldCancel = true
}

Next I deleted the corresponding elements from the array/object in runtime (e.g. Developer Tools in Chrome) before running the introspection:

delete(intro_elements["AWS__CloudTrail"])
delete(intro_elements["AWS__CloudWatch"])
delete(intro_elements["AWS__Config"])
delete(intro_elements["AWS__S3"])
delete(intro_elements["AWS__VPC_Flow_Logs"])

This actually worked. The searches have been 'skipped' (well they don't exist anymore) but now the next four searches are not beeing completed. While all this happens, CIM Searches in Step one stay queued and not start at all.

I would really appreciate any help

1 Solution

xeaon
Explorer

I have an odd solution/workaround for this.

Ofc i was fully aware, that deleting the array elements would prob. mess things up and decided to remove anything AWS related (although the problem isn't specific to the AWS searches) from the source.

So I've used the Lookup Editor Add-On to remove them from the Lookups

  • KV Store: data_inventory_products
  • CSV File: SSE-default-data-inventory-products.csv (to prevent from beeing loaded in the KV Store again)

After that, I've refreshed via https://yoursplunkhost/en-GB/debug/refresh

Well, this didn't change anything. After resetting and re-run the introspection, I experienced the same behaviour BUT after adding the entries back to the CSV and KV Store, the introspection ran as intended.

I have no idea if there is a legit issue with the procedure where the KV Store is initially filled with the contents of the CSV file.

View solution in original post

0 Karma

peter_krammer
Communicator

Based on you own findings I found that the Data in my kv store lookup "data_inventory_products_lookup" was likely outdated from a previous version.
So my issue was fixed by:

| inputlookup SSE-default-data-inventory-products.csv
| outputlookup data_inventory_products_lookup
0 Karma

kintyreab
New Member

Hi Peter,

I tried that query and now get the following error:

Error!
Received the following error:
Description Message
Error occurred while grabbing data_inventory_products   'stage'
Error during Data Availability Enrichment   'list' object has no attribute 'split'

Got any advice for how to fix that?

0 Karma

peter_krammer
Communicator

Yes, now you should have the buttons for Introspection back and there is a button in the popup menu, that says "Reset all Configurations".
Hit it and afterwards it should be fine again.

0 Karma

xeaon
Explorer

I have an odd solution/workaround for this.

Ofc i was fully aware, that deleting the array elements would prob. mess things up and decided to remove anything AWS related (although the problem isn't specific to the AWS searches) from the source.

So I've used the Lookup Editor Add-On to remove them from the Lookups

  • KV Store: data_inventory_products
  • CSV File: SSE-default-data-inventory-products.csv (to prevent from beeing loaded in the KV Store again)

After that, I've refreshed via https://yoursplunkhost/en-GB/debug/refresh

Well, this didn't change anything. After resetting and re-run the introspection, I experienced the same behaviour BUT after adding the entries back to the CSV and KV Store, the introspection ran as intended.

I have no idea if there is a legit issue with the procedure where the KV Store is initially filled with the contents of the CSV file.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...