This has been reported to Splunk previously. The vulnerability associated with this finding is CVE-2008-0252. Splunk has tried to reproduce and found that directory traversal with "//" and "/./" is not possible with any CherryPy web server that ships with Splunk. As per the Mitre vulnerability: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0252 Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie. In 5.0 and above, Splunk ships with CherryPy 3.1.2. If the version of Splunk you're running is close to current, this is almost certainly a false positive. You should proceed by reporting it as such to the vendor who reported the finding so they can tweak the vulnerability check. As an aside, any vulnerabilities discovered can be reported to Splunk via the security portal at this link: https://www.splunk.com/goto/report_vulnerabilities ... View more

| rest /services/data/indexes | where disabled = 0 | search NOT title = "_*" | eval currentDBSizeGB = round( currentDBSizeMB / 1024) | where currentDBSizeGB > 0 | table splunk_server title summaryHomePath_expanded minTime maxTime currentDBSizeGB totalEventCount frozenTimePeriodInSecs coldToFrozenDir maxTotalDataSizeMB | rename minTime AS earliest maxTime AS latest summaryHomePath_expanded AS index_path currentDBSizeGB AS index_size totalEventCount AS event_cnt frozenTimePeriodInSecs AS index_retention coldToFrozenDir AS index_path_frozen maxTotalDataSizeMB AS index_size_max title AS index ... View more