Splunk Data Fabric Search

How to check if DFS is enabled in Splunk Enterprise in regards to Log4J (CVE-2021-44228)

Rafiuddin
Engager

Hi Guys,
I am quite new to splunk. I was looking around to see any splunk documents pertaining to Data Fabric Search (DFS) as there is an impact since it leverages Log4j. However, I can't seem to find how to check if my Splunk Enterprise is using it.

Is there a setting that I can check from SearchHead, Indexer, etc if DFS is enabled? 

Also, does it mean if I did not install DFS Manager App, I am not using the DFS functionality?

Thank you,
Rafiuddin

Labels (1)
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @Rafiuddin,

1. You can check disabled=false in server.conf.

 

[dfs]

disabled = <boolean>
* When set to 'false' for the [dfs] stanza, this setting enables data fabric
  search functionality for this instance.
* A 'false' setting causes the Splunk software to start the DFSMaster Java
  process in a separate process. This process is central to Data Fabric Search
  funtionality.
* Default: true

 

2. To check if DFS is in use you can run the below query. If it returns results then DFS is enabled.

 

| history 
| search search=*dfsjob* 
|  rex field=search "(?P<dfs_cmd>\|\s*dfsjob)" 
| search dfs_cmd=* and search!=*eval* 
| where len(dfs_cmd) > 0

 

View solution in original post

Yemi_Splunk
Engager

You can also use this:

https://<myonpremsplunkurl.com:8089/services/server/info

You will be prompted to login from the browser. Login. If DFS is enabled, it will dfs_enable 1, if not enabled, it will show dfs_enabled 0.

dfs_enabled0
eai:acl
app 
can_list1
can_write1
modifiable0



Cheers

sybilla
Engager

Please use:

| rest /services/configs/conf-server/dfs | table title,disabled

manjunathmeti
SplunkTrust
SplunkTrust

hi @Rafiuddin,

1. You can check disabled=false in server.conf.

 

[dfs]

disabled = <boolean>
* When set to 'false' for the [dfs] stanza, this setting enables data fabric
  search functionality for this instance.
* A 'false' setting causes the Splunk software to start the DFSMaster Java
  process in a separate process. This process is central to Data Fabric Search
  funtionality.
* Default: true

 

2. To check if DFS is in use you can run the below query. If it returns results then DFS is enabled.

 

| history 
| search search=*dfsjob* 
|  rex field=search "(?P<dfs_cmd>\|\s*dfsjob)" 
| search dfs_cmd=* and search!=*eval* 
| where len(dfs_cmd) > 0

 

Rafiuddin
Engager

Thank you @manjunathmeti !

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...