log10x-mcp 1.30.21 → 1.30.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -1
- package/build/index.js +26 -4
- package/build/index.js.map +1 -1
- package/build/lib/advisor/reporter-forwarders.js +34 -3
- package/build/lib/advisor/reporter-forwarders.js.map +1 -1
- package/build/lib/advisor/reporter.js +7 -4
- package/build/lib/advisor/reporter.js.map +1 -1
- package/build/lib/cdk-recipes.d.ts +1 -1
- package/build/lib/cdk-recipes.js +4 -5
- package/build/lib/cdk-recipes.js.map +1 -1
- package/build/lib/fenced.d.ts +2 -0
- package/build/lib/fenced.js +2 -2
- package/build/lib/fenced.js.map +1 -1
- package/build/lib/offload-recipes.d.ts +2 -1
- package/build/lib/offload-recipes.js +7 -6
- package/build/lib/offload-recipes.js.map +1 -1
- package/build/lib/poc-report-renderer.js +17 -11
- package/build/lib/poc-report-renderer.js.map +1 -1
- package/build/lib/retriever-api.d.ts +14 -0
- package/build/lib/retriever-api.js +40 -10
- package/build/lib/retriever-api.js.map +1 -1
- package/build/lib/runtime-image.d.ts +4 -2
- package/build/lib/runtime-image.js +4 -2
- package/build/lib/runtime-image.js.map +1 -1
- package/build/lib/siem/_sampling.js +4 -0
- package/build/lib/siem/_sampling.js.map +1 -1
- package/build/lib/siem/cloudwatch.d.ts +18 -0
- package/build/lib/siem/cloudwatch.js +106 -2
- package/build/lib/siem/cloudwatch.js.map +1 -1
- package/build/lib/siem/datadog.js +1 -1
- package/build/lib/siem/datadog.js.map +1 -1
- package/build/lib/siem/elasticsearch.js +13 -1
- package/build/lib/siem/elasticsearch.js.map +1 -1
- package/build/lib/siem/splunk.d.ts +18 -0
- package/build/lib/siem/splunk.js +71 -7
- package/build/lib/siem/splunk.js.map +1 -1
- package/build/product-kb/docs/apps/receiver/compact/index.md +3 -3
- package/build/product-kb/docs/apps/receiver/compact/splunk.md +81 -67
- package/build/product-kb/docs/apps/retriever/faq.md +2 -2
- package/build/product-kb/docs/faq/apps/retriever.md +2 -2
- package/build/product-kb/docs/faq/general.md +1 -1
- package/build/product-kb/docs/faq/stacks/splunk/comparisons.md +3 -3
- package/build/product-kb/docs/faq/stacks/splunk/compatibility.md +19 -242
- package/build/product-kb/docs/faq/stacks/splunk/index.md +1 -1
- package/build/product-kb/docs/faq/stacks/splunk/kv-store.md +41 -159
- package/build/product-kb/docs/faq/stacks/splunk/optimization.md +4 -4
- package/build/product-kb/docs/run/input/forwarder/fluentbit/index.md +1 -1
- package/build/product-kb/docs/run/input/forwarder/fluentd/index.md +1 -1
- package/build/product-kb/docs/run/input/forwarder/otel-collector/index.md +1 -1
- package/build/product-kb/docs/run/input/forwarder/vector/index.md +1 -1
- package/build/tools/advise-install.js +8 -3
- package/build/tools/advise-install.js.map +1 -1
- package/build/tools/doctor.js +3 -2
- package/build/tools/doctor.js.map +1 -1
- package/build/tools/emit-sample-plan.js +7 -1
- package/build/tools/emit-sample-plan.js.map +1 -1
- package/build/tools/poc-from-local.js +7 -6
- package/build/tools/poc-from-local.js.map +1 -1
- package/build/tools/poc-from-siem.js +71 -4
- package/build/tools/poc-from-siem.js.map +1 -1
- package/build/tools/retriever-query.js +1 -1
- package/build/tools/retriever-query.js.map +1 -1
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"elasticsearch.js","sourceRoot":"","sources":["../../../src/lib/siem/elasticsearch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAYhD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;
|
|
1
|
+
{"version":3,"file":"elasticsearch.js","sourceRoot":"","sources":["../../../src/lib/siem/elasticsearch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAYhD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,uDAAuD;IAC/D,cAAc,EAAE,uDAAuD;CACxE,CAAC;AASF,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAChF,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC7D,uFAAuF;IACvF,mFAAmF;IACnF,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,QAAQ;SACf;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE;oBACL,2FAA2F;wBACzF,uEAAuE;iBAC1E;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,wEAAwE;QACxE,qEAAqE;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAE/D,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC;IAEzC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,WAAW,GAA8B;YAC7C;gBACE,KAAK,EAAE;oBACL,YAAY,EAAE;wBACZ,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;wBAC1C,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;qBACzC;iBACF;aACF;SACF,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,WAAkC,CAAC;QACvC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,YAAY,GAAG,SAAS,EAAE,CAAC;YAChC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,2DAA2D;gBAC3D,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,gEAAgE;gBAChE,gEAAgE;gBAChE,mDAAmD;gBACnD,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC3C,MAAM,UAAU,GAA4B;oBAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;oBACtC,IAAI;oBACJ,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;oBAC/B,gBAAgB,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,WAAW;oBAAE,UAAU,CAAC,YAAY,GAAG,WAAW,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,MAAM,CAAC,MAAM,CAAC;oBACZ,KAAK,EAAE,YAAY;oBACnB,GAAG,UAAU;iBACd,CAAC,CACH,CAAC;gBACF,MAAM,IAAI,GACR,CAAE,IAAqF;qBACpF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,CAAC,mBAAmB;gBACjD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,YAAY,IAAI,SAAS;wBAAE,MAAM;oBACrC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACvB,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACnC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC;oBACd,IAAI,EAAE,wBAAwB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,KAAK,YAAY,IAAI,SAAS,GAAG;oBAC/F,GAAG,EAAE,IAAI,CAAC,GAAG,CACX,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAC5E;oBACD,aAAa,EAAE,MAAM,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,CAAC,mBAAmB;YACpD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,WAAY,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1F,mCAAmC;gBACnC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACnE,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5C,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,YAAY;SACoC,CAAC,CAE1D,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,SAAS,EAAE,gCAAgC,YAAY,6BAA6B,EAAE,CAAC;QAClG,CAAC;QACD,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,CAAC;YACP,IAAI,EAAE;gBACJ,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;aACzC;SACgD,CAAC,CAKnD,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,IAAI,IAAY,CAAC;QACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,UAAU,CAAC,CAAC;YACjD,QAAQ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,IAAI,GAAG,CAAC,CAAC;YACT,QAAQ,GAAG,oCAAoC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,OAAO;YACP,MAAM,EAAE,4BAA4B,YAAY,MAAM,QAAQ,GAAG;SAClE,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,0CAA2C,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,eAAe;IAC5B,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
|
|
@@ -22,4 +22,22 @@ import type { SiemConnector } from './index.js';
|
|
|
22
22
|
export declare const SPLUNK_BUCKET_COUNT = 12;
|
|
23
23
|
/** Results page size used against `search/jobs/{sid}/results`. */
|
|
24
24
|
export declare const SPLUNK_PAGE_SIZE = 1000;
|
|
25
|
+
/**
|
|
26
|
+
* SPLUNK_INSECURE=1 skips certificate verification for the search head only.
|
|
27
|
+
* A default Splunk install serves port 8089 with its own self-signed
|
|
28
|
+
* certificate, issued to "SplunkServerDefaultCert", so neither the system CA
|
|
29
|
+
* store nor NODE_EXTRA_CA_CERTS can verify it (the hostname never matches).
|
|
30
|
+
* Global fetch cannot relax verification per request without a newer undici
|
|
31
|
+
* than Node 20 ships, and NODE_TLS_REJECT_UNAUTHORIZED would relax it for
|
|
32
|
+
* every connection this process makes, so this path uses node:https with
|
|
33
|
+
* rejectUnauthorized:false for Splunk requests alone. Opt-in, never default;
|
|
34
|
+
* the emitted export script offers the same choice (--insecure).
|
|
35
|
+
*/
|
|
36
|
+
export declare function splunkInsecure(): boolean;
|
|
37
|
+
/**
|
|
38
|
+
* "fetch failed" alone says nothing; the reason is on the cause chain
|
|
39
|
+
* (a certificate the process does not trust, a refused connection, DNS).
|
|
40
|
+
* Name it, and say what fixes the common ones.
|
|
41
|
+
*/
|
|
42
|
+
export declare function describeSplunkError(e: unknown): string;
|
|
25
43
|
export declare const splunkConnector: SiemConnector;
|
package/build/lib/siem/splunk.js
CHANGED
|
@@ -25,6 +25,7 @@ export const SPLUNK_BUCKET_COUNT = 12;
|
|
|
25
25
|
export const SPLUNK_PAGE_SIZE = 1000;
|
|
26
26
|
import { existsSync, readFileSync } from 'fs';
|
|
27
27
|
import { homedir } from 'os';
|
|
28
|
+
import https from 'node:https';
|
|
28
29
|
import { join } from 'path';
|
|
29
30
|
function getConn() {
|
|
30
31
|
const envHost = process.env.SPLUNK_HOST;
|
|
@@ -86,9 +87,72 @@ function authHeader(conn) {
|
|
|
86
87
|
return `Bearer ${conn.token}`;
|
|
87
88
|
return 'Basic ' + Buffer.from(`${conn.username}:${conn.password}`).toString('base64');
|
|
88
89
|
}
|
|
90
|
+
/**
|
|
91
|
+
* SPLUNK_INSECURE=1 skips certificate verification for the search head only.
|
|
92
|
+
* A default Splunk install serves port 8089 with its own self-signed
|
|
93
|
+
* certificate, issued to "SplunkServerDefaultCert", so neither the system CA
|
|
94
|
+
* store nor NODE_EXTRA_CA_CERTS can verify it (the hostname never matches).
|
|
95
|
+
* Global fetch cannot relax verification per request without a newer undici
|
|
96
|
+
* than Node 20 ships, and NODE_TLS_REJECT_UNAUTHORIZED would relax it for
|
|
97
|
+
* every connection this process makes, so this path uses node:https with
|
|
98
|
+
* rejectUnauthorized:false for Splunk requests alone. Opt-in, never default;
|
|
99
|
+
* the emitted export script offers the same choice (--insecure).
|
|
100
|
+
*/
|
|
101
|
+
export function splunkInsecure() {
|
|
102
|
+
return /^(1|true|yes)$/i.test(process.env.SPLUNK_INSECURE ?? '');
|
|
103
|
+
}
|
|
104
|
+
function insecureFetch(url, init = {}) {
|
|
105
|
+
return new Promise((resolve, reject) => {
|
|
106
|
+
const headers = { ...init.headers };
|
|
107
|
+
const body = init.body == null ? undefined : String(init.body);
|
|
108
|
+
if (body !== undefined && !Object.keys(headers).some((k) => k.toLowerCase() === 'content-length')) {
|
|
109
|
+
headers['Content-Length'] = String(Buffer.byteLength(body));
|
|
110
|
+
}
|
|
111
|
+
const req = https.request(new URL(url), { method: init.method ?? 'GET', headers, rejectUnauthorized: false }, (res) => {
|
|
112
|
+
const chunks = [];
|
|
113
|
+
res.on('data', (c) => chunks.push(c));
|
|
114
|
+
res.on('error', reject);
|
|
115
|
+
res.on('end', () => {
|
|
116
|
+
const status = res.statusCode ?? 0;
|
|
117
|
+
const h = new Headers();
|
|
118
|
+
for (const [k, v] of Object.entries(res.headers)) {
|
|
119
|
+
if (v !== undefined)
|
|
120
|
+
h.set(k, Array.isArray(v) ? v.join(', ') : String(v));
|
|
121
|
+
}
|
|
122
|
+
const nullBody = status === 204 || status === 205 || status === 304;
|
|
123
|
+
resolve(new Response(nullBody ? null : Buffer.concat(chunks), { status, headers: h }));
|
|
124
|
+
});
|
|
125
|
+
});
|
|
126
|
+
req.on('error', reject);
|
|
127
|
+
if (body !== undefined)
|
|
128
|
+
req.write(body);
|
|
129
|
+
req.end();
|
|
130
|
+
});
|
|
131
|
+
}
|
|
132
|
+
function doFetch(url, init) {
|
|
133
|
+
return splunkInsecure() && url.startsWith('https:') ? insecureFetch(url, init) : fetch(url, init);
|
|
134
|
+
}
|
|
135
|
+
/**
|
|
136
|
+
* "fetch failed" alone says nothing; the reason is on the cause chain
|
|
137
|
+
* (a certificate the process does not trust, a refused connection, DNS).
|
|
138
|
+
* Name it, and say what fixes the common ones.
|
|
139
|
+
*/
|
|
140
|
+
export function describeSplunkError(e) {
|
|
141
|
+
const err = e;
|
|
142
|
+
const code = err?.cause?.code ?? err?.code;
|
|
143
|
+
const causeMsg = err?.cause?.message;
|
|
144
|
+
const base = `${err?.message ?? String(e)}${code || causeMsg ? ` (${[code, causeMsg].filter(Boolean).join(': ')})` : ''}`;
|
|
145
|
+
if (code && /CERT|SELF_SIGNED|UNABLE_TO_VERIFY|ALTNAME/.test(code)) {
|
|
146
|
+
return `${base}. The search head's certificate is not trusted by this process; a default Splunk install serves a self-signed certificate on 8089. Set SPLUNK_INSECURE=1 in the MCP's environment to skip verification for Splunk only, or install a trusted certificate.`;
|
|
147
|
+
}
|
|
148
|
+
if (code === 'ECONNREFUSED' || code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
|
|
149
|
+
return `${base}. Nothing answered at SPLUNK_HOST; check the host and that the management port (8089 by default) is reachable from this machine.`;
|
|
150
|
+
}
|
|
151
|
+
return base;
|
|
152
|
+
}
|
|
89
153
|
async function splunkFetch(conn, path, init = {}) {
|
|
90
154
|
const url = `${conn.host}${path}`;
|
|
91
|
-
const res = await
|
|
155
|
+
const res = await doFetch(url, {
|
|
92
156
|
...init,
|
|
93
157
|
headers: {
|
|
94
158
|
Accept: 'application/json',
|
|
@@ -141,7 +205,7 @@ async function pullEvents(opts) {
|
|
|
141
205
|
// the parent window with per-run RNG. Splunk dispatches one search
|
|
142
206
|
// job per bucket sequentially — concurrent dispatches risk hitting
|
|
143
207
|
// the search head's per-user concurrency cap (default 6).
|
|
144
|
-
const BUCKET_COUNT = SPLUNK_BUCKET_COUNT;
|
|
208
|
+
const BUCKET_COUNT = Math.max(1, opts.buckets ?? SPLUNK_BUCKET_COUNT);
|
|
145
209
|
const buckets = randomTimeBuckets(fromMs, toMs, BUCKET_COUNT);
|
|
146
210
|
const bucketCap = perBucketCap(opts.targetEventCount, BUCKET_COUNT);
|
|
147
211
|
const pageSize = SPLUNK_PAGE_SIZE;
|
|
@@ -172,7 +236,7 @@ async function pullEvents(opts) {
|
|
|
172
236
|
sid = job.sid;
|
|
173
237
|
}
|
|
174
238
|
catch (e) {
|
|
175
|
-
notes.push(`bucket_${bucket.index}_create_failed: ${e.
|
|
239
|
+
notes.push(`bucket_${bucket.index}_create_failed: ${describeSplunkError(e).slice(0, 400)}`);
|
|
176
240
|
// Per-bucket failure is non-fatal; move on.
|
|
177
241
|
continue;
|
|
178
242
|
}
|
|
@@ -208,7 +272,7 @@ async function pullEvents(opts) {
|
|
|
208
272
|
await sleep(wait);
|
|
209
273
|
}
|
|
210
274
|
catch (e) {
|
|
211
|
-
notes.push(`bucket_${bucket.index}_poll_error: ${e.
|
|
275
|
+
notes.push(`bucket_${bucket.index}_poll_error: ${describeSplunkError(e).slice(0, 400)}`);
|
|
212
276
|
pollFailed = true;
|
|
213
277
|
break;
|
|
214
278
|
}
|
|
@@ -251,7 +315,7 @@ async function pullEvents(opts) {
|
|
|
251
315
|
break;
|
|
252
316
|
}
|
|
253
317
|
catch (e) {
|
|
254
|
-
notes.push(`bucket_${bucket.index}_page_error offset=${offset}: ${e.
|
|
318
|
+
notes.push(`bucket_${bucket.index}_page_error offset=${offset}: ${describeSplunkError(e).slice(0, 400)}`);
|
|
255
319
|
break;
|
|
256
320
|
}
|
|
257
321
|
}
|
|
@@ -270,7 +334,7 @@ async function pullEvents(opts) {
|
|
|
270
334
|
};
|
|
271
335
|
}
|
|
272
336
|
async function cancelJob(conn, sid) {
|
|
273
|
-
await
|
|
337
|
+
await doFetch(`${conn.host}/services/search/jobs/${sid}`, {
|
|
274
338
|
method: 'DELETE',
|
|
275
339
|
headers: { Authorization: authHeader(conn), Accept: 'application/json' },
|
|
276
340
|
}).catch(() => undefined);
|
|
@@ -326,7 +390,7 @@ async function detectDailyVolumeGb(opts) {
|
|
|
326
390
|
};
|
|
327
391
|
}
|
|
328
392
|
catch (e) {
|
|
329
|
-
return { errorNote: `Splunk volume detection failed: ${e.
|
|
393
|
+
return { errorNote: `Splunk volume detection failed: ${describeSplunkError(e).slice(0, 400)}` };
|
|
330
394
|
}
|
|
331
395
|
}
|
|
332
396
|
export const splunkConnector = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"splunk.js","sourceRoot":"","sources":["../../../src/lib/siem/splunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,4DAA4D;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,EAAE,GAA2B,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7D,IAAI,KAAK;oBAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAAE,CAAC,IAAI,OAAO,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC;YAC/B,GAAI,IAAI,CAAC,OAA8C;SACxD;KACF,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAqD,CAAC;QACzH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,CAAC,0DAA0D,CAAC;aACpE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAE/B,+EAA+E;IAC/E,MAAM,WAAW,GAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,mBAAmB,CAAC;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAElC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC7C,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAqB,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7D,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,mBAAoB,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,4CAA4C;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,iBAAiB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,aAAa,GAAG,gBAAgB,CAAC;gBACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,mBAAmB,CAAC,CACnE,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoJ,CAAC;gBACpL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzC,eAAe,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC;gBACnE,IAAI,OAAO,EAAE,MAAM;oBAAE,MAAM;gBAC3B,IAAI,OAAO,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC;oBACrD,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvE,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,gBAAiB,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvF,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,MAAM,GAAG,eAAe,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;YAC5D,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CACT,IAAI,EACJ,yBAAyB,GAAG,mBAAmB,MAAM,UAAU,KAAK,mBAAmB,CACxF,CACF,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM;gBAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,CAAC,CAAC,KAAK;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI;wBACf,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC;qBACP,CAAC,CAAC;oBACH,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,sBAAsB,MAAM,KAAM,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxG,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG;YACd,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAU,EAAE,GAAW;IAC9C,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,yBAAyB,GAAG,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACzE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,KAAK,IAAI,CAAC;IACV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,mCAAmC,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GACP,+DAA+D;QAC/D,sBAAsB;QACtB,kCAAkC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4C,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,qFAAqF,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,+CAA+C,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAChD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,uCAAuC,IAAI,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,mCAAoC,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
|
|
1
|
+
{"version":3,"file":"splunk.js","sourceRoot":"","sources":["../../../src/lib/siem/splunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,4DAA4D;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,EAAE,GAA2B,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7D,IAAI,KAAK;oBAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAAE,CAAC,IAAI,OAAO,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,OAAoB,EAAE;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAA2B,EAAE,GAAI,IAAI,CAAC,OAA8C,EAAE,CAAC;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAClG,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACpH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBACnC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,KAAK,SAAS;wBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;gBACpE,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,IAAiB;IAC7C,OAAO,cAAc,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,MAAM,GAAG,GAAG,CAA4D,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,IAAK,GAAyB,EAAE,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1H,IAAI,IAAI,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,GAAG,IAAI,2PAA2P,CAAC;IAC5Q,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC5E,OAAO,GAAG,IAAI,kIAAkI,CAAC;IACnJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC;YAC/B,GAAI,IAAI,CAAC,OAA8C;SACxD;KACF,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAqD,CAAC;QACzH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,CAAC,0DAA0D,CAAC;aACpE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAE/B,+EAA+E;IAC/E,MAAM,WAAW,GAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAElC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC7C,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAqB,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7D,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5F,4CAA4C;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,iBAAiB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,aAAa,GAAG,gBAAgB,CAAC;gBACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,mBAAmB,CAAC,CACnE,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoJ,CAAC;gBACpL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzC,eAAe,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC;gBACnE,IAAI,OAAO,EAAE,MAAM;oBAAE,MAAM;gBAC3B,IAAI,OAAO,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC;oBACrD,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvE,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,gBAAgB,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzF,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,MAAM,GAAG,eAAe,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;YAC5D,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CACT,IAAI,EACJ,yBAAyB,GAAG,mBAAmB,MAAM,UAAU,KAAK,mBAAmB,CACxF,CACF,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM;gBAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,CAAC,CAAC,KAAK;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI;wBACf,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC;qBACP,CAAC,CAAC;oBACH,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,sBAAsB,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG;YACd,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAU,EAAE,GAAW;IAC9C,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,yBAAyB,GAAG,EAAE,EAAE;QACxD,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACzE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,KAAK,IAAI,CAAC;IACV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,mCAAmC,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GACP,+DAA+D;QAC/D,sBAAsB;QACtB,kCAAkC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4C,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,qFAAqF,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,+CAA+C,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAChD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,uCAAuC,IAAI,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,mCAAmC,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
|
|
@@ -14,7 +14,7 @@ Reduce storage costs by forwarding [compact](https://doc.log10x.com/run/transfor
|
|
|
14
14
|
|
|
15
15
|
<h3 id="analytics-costs"><span class="twemoji" ><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 21H7v-2h4v2m4.5-2H17v2h-4v-2h.2l-1.4-6.1-2.5.6c-.1.5-.3.9-.5 1.3-.9 1.5-2.8 1.9-4.3 1-1.5-.9-1.9-2.8-1-4.3.9-1.5 2.8-1.9 4.3-1 .4.2.7.6.9.9l2.5-.6-.6-2.5c-.4-.1-.8-.3-1.2-.5C8 6.9 7.5 5 8.4 3.5c.9-1.5 2.8-1.9 4.3-1 1.5.9 1.9 2.8 1 4.3-.2.4-.6.7-.9.9L15.5 19M7 11.8c-.7-.5-1.7-.2-2.2.5-.5.7-.2 1.7.5 2.1.7.5 1.7.3 2.2-.5.4-.7.2-1.7-.5-2.1M12.4 6c.5-.7.2-1.7-.5-2.2-.7-.5-1.7-.2-2.2.5-.4.7-.2 1.7.6 2.2.7.4 1.7.2 2.1-.5m.4 5.3c-.2-.1-.4-.1-.5.1-.1.2-.1.4.1.5.2.1.4.1.5-.1.2-.2.1-.4-.1-.5M21 8.5 14.5 10l.5 2.2 7.5-1.8.5-.7-2-1.2M23 19h-4v2h4v-2M5 19H1v2h4v-2Z"></path></svg></span> Cut Log Analytics Costs</h3>
|
|
16
16
|
|
|
17
|
-
Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [
|
|
17
|
+
Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [Log10x App](splunk.md) and [L1ES Elasticsearch plugin](elasticsearch.md) expand events in real-time, maintaining full querying, dashboard, and alerting capabilities; compact is lossless, so expanded events match the originals.
|
|
18
18
|
|
|
19
19
|
## :material-cog-transfer-outline: Workflow
|
|
20
20
|
|
|
@@ -87,10 +87,10 @@ Compact mode executes inside the [Receiver](../index.md) sidecar, compacting eve
|
|
|
87
87
|
|
|
88
88
|
=== ":material-greater-than: Splunk"
|
|
89
89
|
|
|
90
|
-
Forward compact events to Splunk. The open-source [
|
|
90
|
+
Forward compact events to Splunk. The open-source [Log10x App](splunk.md) expands events on-the-fly at search time, displaying them in full JSON/text form in dashboards and queries.
|
|
91
91
|
|
|
92
92
|
<figure markdown="span">
|
|
93
|
-
{ align=left }
|
|
94
94
|
<figcaption>:white_check_mark: **Compact mode** losslessly compacts events before they ship to Splunk</figcaption>
|
|
95
95
|
</figure>
|
|
96
96
|
|