Splunk Data Fabric Search

How to check if DFS is enabled in Splunk Enterprise in regards to Log4J (CVE-2021-44228)

Rafiuddin
Engager

Hi Guys,
I am quite new to splunk. I was looking around to see any splunk documents pertaining to Data Fabric Search (DFS) as there is an impact since it leverages Log4j. However, I can't seem to find how to check if my Splunk Enterprise is using it.

Is there a setting that I can check from SearchHead, Indexer, etc if DFS is enabled? 

Also, does it mean if I did not install DFS Manager App, I am not using the DFS functionality?

Thank you,
Rafiuddin

Labels (1)
1 Solution

manjunathmeti
Champion

hi @Rafiuddin,

1. You can check disabled=false in server.conf.

 

[dfs]

disabled = <boolean>
* When set to 'false' for the [dfs] stanza, this setting enables data fabric
  search functionality for this instance.
* A 'false' setting causes the Splunk software to start the DFSMaster Java
  process in a separate process. This process is central to Data Fabric Search
  funtionality.
* Default: true

 

2. To check if DFS is in use you can run the below query. If it returns results then DFS is enabled.

 

| history 
| search search=*dfsjob* 
|  rex field=search "(?P<dfs_cmd>\|\s*dfsjob)" 
| search dfs_cmd=* and search!=*eval* 
| where len(dfs_cmd) > 0

 

View solution in original post

Yemi_Splunk
Engager

You can also use this:

https://<myonpremsplunkurl.com:8089/services/server/info

You will be prompted to login from the browser. Login. If DFS is enabled, it will dfs_enable 1, if not enabled, it will show dfs_enabled 0.

dfs_enabled0
eai:acl
app 
can_list1
can_write1
modifiable0



Cheers

sybilla
Engager

Please use:

| rest /services/configs/conf-server/dfs | table title,disabled

manjunathmeti
Champion

hi @Rafiuddin,

1. You can check disabled=false in server.conf.

 

[dfs]

disabled = <boolean>
* When set to 'false' for the [dfs] stanza, this setting enables data fabric
  search functionality for this instance.
* A 'false' setting causes the Splunk software to start the DFSMaster Java
  process in a separate process. This process is central to Data Fabric Search
  funtionality.
* Default: true

 

2. To check if DFS is in use you can run the below query. If it returns results then DFS is enabled.

 

| history 
| search search=*dfsjob* 
|  rex field=search "(?P<dfs_cmd>\|\s*dfsjob)" 
| search dfs_cmd=* and search!=*eval* 
| where len(dfs_cmd) > 0

 

Rafiuddin
Engager

Thank you @manjunathmeti !

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...