Hostname and index reverts to default

[hcpr]

Hi,
I just noticed a strange behaviour in the OPSEC LEA add-on.

If I add a CP log connection from the webgui of the app, I change the host and index parameters to match my data layout.
This works fine until I have to temporarily disable the connection.
When I click the 'Diasble" link, those two fields revert back to the default values (index=default and host=)

In the inputs.conf I get the following:

[script:///opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity xxxxxxxxxxxx]
disabled = 0
host = yyyyyyyyy
index = default
interval = 30
passAuth = splunk-system-user
sourcetype = opsec

Where yyyyy is the forwarder hostname.

While I should have:

[script:///opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber.sh --configentity xxxxxxxxxxxx]
disabled = 0
host = xxxxxxx
index = opsec
interval = 30
passAuth = splunk-system-user
sourcetype = opsec

Has anyone else seen this? Any suggestions for how to deal with it (apart from manually changing the values back)?

Thanks.

[hcpr]

There already is an answer, but just to make the information complete:
splunk-add-on-for-check-point-opsec-lea-linux_210.tgz
And I have tested with both Firefox and IE 10

[ilink_splunk · Accepted solution]

We have been able to reproduce this issue and have filed a jira ticket: OPSEC-224.

[araitz]

One workaround is to enable/disable from the individual connection's edit page. This will result in the host and index attributes not reverting to the default settings.

[araitz]

What version of the add-on are you using? What browser?