How to check if DFS is enabled in Splunk Enterprise in regards to Log4J (CVE-2021-44228)

[Rafiuddin]

Hi Guys,
I am quite new to splunk. I was looking around to see any splunk documents pertaining to Data Fabric Search (DFS) as there is an impact since it leverages Log4j. However, I can't seem to find how to check if my Splunk Enterprise is using it.

Is there a setting that I can check from SearchHead, Indexer, etc if DFS is enabled? 

Also, does it mean if I did not install DFS Manager App, I am not using the DFS functionality?

Thank you,
Rafiuddin

[Yemi_Splunk]

You can also use this:

https://<myonpremsplunkurl.com:8089/services/server/info

You will be prompted to login from the browser. Login. If DFS is enabled, it will dfs_enable 1, if not enabled, it will show dfs_enabled 0.

dfs_enabled	0
eai:acl	app   can_list 1 can_write 1 modifiable 0

Cheers

[sybilla]

Please use:

| rest /services/configs/conf-server/dfs | table title,disabled

[manjunathmeti · Accepted solution]

hi @Rafiuddin,

1. You can check disabled=false in server.conf.

[dfs]

disabled = <boolean>
* When set to 'false' for the [dfs] stanza, this setting enables data fabric
  search functionality for this instance.
* A 'false' setting causes the Splunk software to start the DFSMaster Java
  process in a separate process. This process is central to Data Fabric Search
  funtionality.
* Default: true

2. To check if DFS is in use you can run the below query. If it returns results then DFS is enabled.

| history 
| search search=*dfsjob* 
|  rex field=search "(?P<dfs_cmd>\|\s*dfsjob)" 
| search dfs_cmd=* and search!=*eval* 
| where len(dfs_cmd) > 0

[Rafiuddin]

Thank you @manjunathmeti !