All Apps and Add-ons

Palo Alto Networks App for Splunk - "All Incidents" dashboard bug?

_smp_
Builder

I believe I found a logic flaw in the All Incidents dashboard in the Palo Alto Networks App for Splunk.  The flaw seems to affect two panels:

  • Endpoint Incidents Per Hour
  • Aperture SaaS Incidents Per Hour

I noticed that those two panels continuously refresh, even though I'm not refreshing the page. These two panels both have condition logic:

 

<condition match="'job.resultCount' == 0">
    <set token="results-3">1</set>
</condition>
<condition match="'job.resultCount' != 0 AND 'results-3' == 1">
    <set token="results-3">0</set>
</condition>

 

The first time the panel is loaded and there are no matching events in the data model, then the 'job.resultCount' == 0 condition matches and results-3 is set to 1. When the panel refreshes, | makeresults creates at least one output row, which means the second condition will always match. So the panel refreshes and the cycle starts over.

Instead of 'job.resultCount' != 0, I think the second condition needs to be 'job.resultCount' > 1. If there are matching no events in the data model then | makeresults will still produce a single output row, but the second condition ('job.resultCount' > 1) will no longer match which stops the repeat cycle. If there IS an event in the datamodel, there will be at least two rows of output, which also stops the cycle.

I think there is a problem here, but I'm not sure if I have it exactly right. It seems to stop the cycle after I changed != to >. What do you think?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...