All Apps and Add-ons

why is the URL field in the Splunk Add-on for Cisco CWS sometimes empty?

stefan1988
Path Finder

The Splunk Add-on for Cisco CWS: url field is sometimes empty causing DM vulnerabilities in Enterprise Security filling up with unknown field values.

0 Karma
1 Solution

piebob
Splunk Employee
Splunk Employee

This is because url is build from 4 parts (cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query) and when cs_uri_query is empty url will be empty.

Please adjust the TA and in props.conf instead of:
EVAL-url = cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query

use:
EVAL-url = case(len(cs_uri_query)>0 AND len(cs_uri_path)>0,cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query,
len(cs_uri_path)>0,cs_uri_scheme + "://" + cs_host + cs_uri_path,
1==1,cs_uri_scheme + "://" + cs_host)

View solution in original post

0 Karma

piebob
Splunk Employee
Splunk Employee

This is because url is build from 4 parts (cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query) and when cs_uri_query is empty url will be empty.

Please adjust the TA and in props.conf instead of:
EVAL-url = cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query

use:
EVAL-url = case(len(cs_uri_query)>0 AND len(cs_uri_path)>0,cs_uri_scheme + "://" + cs_host + cs_uri_path + "?" + cs_uri_query,
len(cs_uri_path)>0,cs_uri_scheme + "://" + cs_host + cs_uri_path,
1==1,cs_uri_scheme + "://" + cs_host)

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...