log10x-mcp 1.30.21 → 1.30.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (63) hide show
  1. package/README.md +3 -1
  2. package/build/index.js +26 -4
  3. package/build/index.js.map +1 -1
  4. package/build/lib/advisor/reporter-forwarders.js +34 -3
  5. package/build/lib/advisor/reporter-forwarders.js.map +1 -1
  6. package/build/lib/advisor/reporter.js +7 -4
  7. package/build/lib/advisor/reporter.js.map +1 -1
  8. package/build/lib/cdk-recipes.d.ts +1 -1
  9. package/build/lib/cdk-recipes.js +4 -5
  10. package/build/lib/cdk-recipes.js.map +1 -1
  11. package/build/lib/fenced.d.ts +2 -0
  12. package/build/lib/fenced.js +2 -2
  13. package/build/lib/fenced.js.map +1 -1
  14. package/build/lib/offload-recipes.d.ts +2 -1
  15. package/build/lib/offload-recipes.js +7 -6
  16. package/build/lib/offload-recipes.js.map +1 -1
  17. package/build/lib/poc-report-renderer.js +17 -11
  18. package/build/lib/poc-report-renderer.js.map +1 -1
  19. package/build/lib/retriever-api.d.ts +14 -0
  20. package/build/lib/retriever-api.js +40 -10
  21. package/build/lib/retriever-api.js.map +1 -1
  22. package/build/lib/runtime-image.d.ts +4 -2
  23. package/build/lib/runtime-image.js +4 -2
  24. package/build/lib/runtime-image.js.map +1 -1
  25. package/build/lib/siem/_sampling.js +4 -0
  26. package/build/lib/siem/_sampling.js.map +1 -1
  27. package/build/lib/siem/cloudwatch.d.ts +18 -0
  28. package/build/lib/siem/cloudwatch.js +106 -2
  29. package/build/lib/siem/cloudwatch.js.map +1 -1
  30. package/build/lib/siem/datadog.js +1 -1
  31. package/build/lib/siem/datadog.js.map +1 -1
  32. package/build/lib/siem/elasticsearch.js +13 -1
  33. package/build/lib/siem/elasticsearch.js.map +1 -1
  34. package/build/lib/siem/splunk.d.ts +18 -0
  35. package/build/lib/siem/splunk.js +71 -7
  36. package/build/lib/siem/splunk.js.map +1 -1
  37. package/build/product-kb/docs/apps/receiver/compact/index.md +3 -3
  38. package/build/product-kb/docs/apps/receiver/compact/splunk.md +81 -67
  39. package/build/product-kb/docs/apps/retriever/faq.md +2 -2
  40. package/build/product-kb/docs/faq/apps/retriever.md +2 -2
  41. package/build/product-kb/docs/faq/general.md +1 -1
  42. package/build/product-kb/docs/faq/stacks/splunk/comparisons.md +3 -3
  43. package/build/product-kb/docs/faq/stacks/splunk/compatibility.md +19 -242
  44. package/build/product-kb/docs/faq/stacks/splunk/index.md +1 -1
  45. package/build/product-kb/docs/faq/stacks/splunk/kv-store.md +41 -159
  46. package/build/product-kb/docs/faq/stacks/splunk/optimization.md +4 -4
  47. package/build/product-kb/docs/run/input/forwarder/fluentbit/index.md +1 -1
  48. package/build/product-kb/docs/run/input/forwarder/fluentd/index.md +1 -1
  49. package/build/product-kb/docs/run/input/forwarder/otel-collector/index.md +1 -1
  50. package/build/product-kb/docs/run/input/forwarder/vector/index.md +1 -1
  51. package/build/tools/advise-install.js +8 -3
  52. package/build/tools/advise-install.js.map +1 -1
  53. package/build/tools/doctor.js +3 -2
  54. package/build/tools/doctor.js.map +1 -1
  55. package/build/tools/emit-sample-plan.js +7 -1
  56. package/build/tools/emit-sample-plan.js.map +1 -1
  57. package/build/tools/poc-from-local.js +7 -6
  58. package/build/tools/poc-from-local.js.map +1 -1
  59. package/build/tools/poc-from-siem.js +71 -4
  60. package/build/tools/poc-from-siem.js.map +1 -1
  61. package/build/tools/retriever-query.js +1 -1
  62. package/build/tools/retriever-query.js.map +1 -1
  63. package/package.json +1 -1
@@ -1 +1 @@
1
- {"version":3,"file":"elasticsearch.js","sourceRoot":"","sources":["../../../src/lib/siem/elasticsearch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAYhD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AASpD,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAChF,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC7D,uFAAuF;IACvF,mFAAmF;IACnF,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,QAAQ;SACf;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE;oBACL,2FAA2F;wBACzF,uEAAuE;iBAC1E;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,wEAAwE;QACxE,qEAAqE;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAE/D,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,YAAY,GAAG,0BAA0B,CAAC;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC;IAEzC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,WAAW,GAA8B;YAC7C;gBACE,KAAK,EAAE;oBACL,YAAY,EAAE;wBACZ,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;wBAC1C,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;qBACzC;iBACF;aACF;SACF,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,WAAkC,CAAC;QACvC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,YAAY,GAAG,SAAS,EAAE,CAAC;YAChC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,2DAA2D;gBAC3D,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,gEAAgE;gBAChE,gEAAgE;gBAChE,mDAAmD;gBACnD,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC3C,MAAM,UAAU,GAA4B;oBAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;oBACtC,IAAI;oBACJ,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;oBAC/B,gBAAgB,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,WAAW;oBAAE,UAAU,CAAC,YAAY,GAAG,WAAW,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,MAAM,CAAC,MAAM,CAAC;oBACZ,KAAK,EAAE,YAAY;oBACnB,GAAG,UAAU;iBACd,CAAC,CACH,CAAC;gBACF,MAAM,IAAI,GACR,CAAE,IAAqF;qBACpF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,CAAC,mBAAmB;gBACjD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,YAAY,IAAI,SAAS;wBAAE,MAAM;oBACrC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACvB,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACnC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC;oBACd,IAAI,EAAE,wBAAwB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,KAAK,YAAY,IAAI,SAAS,GAAG;oBAC/F,GAAG,EAAE,IAAI,CAAC,GAAG,CACX,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAC5E;oBACD,aAAa,EAAE,MAAM,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,CAAC,mBAAmB;YACpD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,WAAY,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1F,mCAAmC;gBACnC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACnE,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5C,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,YAAY;SACoC,CAAC,CAE1D,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,SAAS,EAAE,gCAAgC,YAAY,6BAA6B,EAAE,CAAC;QAClG,CAAC;QACD,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,CAAC;YACP,IAAI,EAAE;gBACJ,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;aACzC;SACgD,CAAC,CAKnD,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,IAAI,IAAY,CAAC;QACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,UAAU,CAAC,CAAC;YACjD,QAAQ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,IAAI,GAAG,CAAC,CAAC;YACT,QAAQ,GAAG,oCAAoC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,OAAO;YACP,MAAM,EAAE,4BAA4B,YAAY,MAAM,QAAQ,GAAG;SAClE,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,0CAA2C,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,eAAe;IAC5B,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
1
+ {"version":3,"file":"elasticsearch.js","sourceRoot":"","sources":["../../../src/lib/siem/elasticsearch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAYhD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,uDAAuD;IAC/D,cAAc,EAAE,uDAAuD;CACxE,CAAC;AASF,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAChF,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC7D,uFAAuF;IACvF,mFAAmF;IACnF,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,QAAQ;SACf;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE;oBACL,2FAA2F;wBACzF,uEAAuE;iBAC1E;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,wEAAwE;QACxE,qEAAqE;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAE/D,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC;IAEzC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,WAAW,GAA8B;YAC7C;gBACE,KAAK,EAAE;oBACL,YAAY,EAAE;wBACZ,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;wBAC1C,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;qBACzC;iBACF;aACF;SACF,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,WAAkC,CAAC;QACvC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,YAAY,GAAG,SAAS,EAAE,CAAC;YAChC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,2DAA2D;gBAC3D,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,gEAAgE;gBAChE,gEAAgE;gBAChE,mDAAmD;gBACnD,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC3C,MAAM,UAAU,GAA4B;oBAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;oBACtC,IAAI;oBACJ,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;oBAC/B,gBAAgB,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,WAAW;oBAAE,UAAU,CAAC,YAAY,GAAG,WAAW,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,MAAM,CAAC,MAAM,CAAC;oBACZ,KAAK,EAAE,YAAY;oBACnB,GAAG,UAAU;iBACd,CAAC,CACH,CAAC;gBACF,MAAM,IAAI,GACR,CAAE,IAAqF;qBACpF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,CAAC,mBAAmB;gBACjD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,YAAY,IAAI,SAAS;wBAAE,MAAM;oBACrC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACvB,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACnC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC;oBACd,IAAI,EAAE,wBAAwB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,KAAK,YAAY,IAAI,SAAS,GAAG;oBAC/F,GAAG,EAAE,IAAI,CAAC,GAAG,CACX,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAC5E;oBACD,aAAa,EAAE,MAAM,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,CAAC,mBAAmB;YACpD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,WAAY,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1F,mCAAmC;gBACnC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACnE,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5C,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,YAAY;SACoC,CAAC,CAE1D,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,SAAS,EAAE,gCAAgC,YAAY,6BAA6B,EAAE,CAAC;QAClG,CAAC;QACD,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,CAAC;YACP,IAAI,EAAE;gBACJ,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;aACzC;SACgD,CAAC,CAKnD,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,IAAI,IAAY,CAAC;QACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,UAAU,CAAC,CAAC;YACjD,QAAQ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,IAAI,GAAG,CAAC,CAAC;YACT,QAAQ,GAAG,oCAAoC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,OAAO;YACP,MAAM,EAAE,4BAA4B,YAAY,MAAM,QAAQ,GAAG;SAClE,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,0CAA2C,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,eAAe;IAC5B,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
@@ -22,4 +22,22 @@ import type { SiemConnector } from './index.js';
22
22
  export declare const SPLUNK_BUCKET_COUNT = 12;
23
23
  /** Results page size used against `search/jobs/{sid}/results`. */
24
24
  export declare const SPLUNK_PAGE_SIZE = 1000;
25
+ /**
26
+ * SPLUNK_INSECURE=1 skips certificate verification for the search head only.
27
+ * A default Splunk install serves port 8089 with its own self-signed
28
+ * certificate, issued to "SplunkServerDefaultCert", so neither the system CA
29
+ * store nor NODE_EXTRA_CA_CERTS can verify it (the hostname never matches).
30
+ * Global fetch cannot relax verification per request without a newer undici
31
+ * than Node 20 ships, and NODE_TLS_REJECT_UNAUTHORIZED would relax it for
32
+ * every connection this process makes, so this path uses node:https with
33
+ * rejectUnauthorized:false for Splunk requests alone. Opt-in, never default;
34
+ * the emitted export script offers the same choice (--insecure).
35
+ */
36
+ export declare function splunkInsecure(): boolean;
37
+ /**
38
+ * "fetch failed" alone says nothing; the reason is on the cause chain
39
+ * (a certificate the process does not trust, a refused connection, DNS).
40
+ * Name it, and say what fixes the common ones.
41
+ */
42
+ export declare function describeSplunkError(e: unknown): string;
25
43
  export declare const splunkConnector: SiemConnector;
@@ -25,6 +25,7 @@ export const SPLUNK_BUCKET_COUNT = 12;
25
25
  export const SPLUNK_PAGE_SIZE = 1000;
26
26
  import { existsSync, readFileSync } from 'fs';
27
27
  import { homedir } from 'os';
28
+ import https from 'node:https';
28
29
  import { join } from 'path';
29
30
  function getConn() {
30
31
  const envHost = process.env.SPLUNK_HOST;
@@ -86,9 +87,72 @@ function authHeader(conn) {
86
87
  return `Bearer ${conn.token}`;
87
88
  return 'Basic ' + Buffer.from(`${conn.username}:${conn.password}`).toString('base64');
88
89
  }
90
+ /**
91
+ * SPLUNK_INSECURE=1 skips certificate verification for the search head only.
92
+ * A default Splunk install serves port 8089 with its own self-signed
93
+ * certificate, issued to "SplunkServerDefaultCert", so neither the system CA
94
+ * store nor NODE_EXTRA_CA_CERTS can verify it (the hostname never matches).
95
+ * Global fetch cannot relax verification per request without a newer undici
96
+ * than Node 20 ships, and NODE_TLS_REJECT_UNAUTHORIZED would relax it for
97
+ * every connection this process makes, so this path uses node:https with
98
+ * rejectUnauthorized:false for Splunk requests alone. Opt-in, never default;
99
+ * the emitted export script offers the same choice (--insecure).
100
+ */
101
+ export function splunkInsecure() {
102
+ return /^(1|true|yes)$/i.test(process.env.SPLUNK_INSECURE ?? '');
103
+ }
104
+ function insecureFetch(url, init = {}) {
105
+ return new Promise((resolve, reject) => {
106
+ const headers = { ...init.headers };
107
+ const body = init.body == null ? undefined : String(init.body);
108
+ if (body !== undefined && !Object.keys(headers).some((k) => k.toLowerCase() === 'content-length')) {
109
+ headers['Content-Length'] = String(Buffer.byteLength(body));
110
+ }
111
+ const req = https.request(new URL(url), { method: init.method ?? 'GET', headers, rejectUnauthorized: false }, (res) => {
112
+ const chunks = [];
113
+ res.on('data', (c) => chunks.push(c));
114
+ res.on('error', reject);
115
+ res.on('end', () => {
116
+ const status = res.statusCode ?? 0;
117
+ const h = new Headers();
118
+ for (const [k, v] of Object.entries(res.headers)) {
119
+ if (v !== undefined)
120
+ h.set(k, Array.isArray(v) ? v.join(', ') : String(v));
121
+ }
122
+ const nullBody = status === 204 || status === 205 || status === 304;
123
+ resolve(new Response(nullBody ? null : Buffer.concat(chunks), { status, headers: h }));
124
+ });
125
+ });
126
+ req.on('error', reject);
127
+ if (body !== undefined)
128
+ req.write(body);
129
+ req.end();
130
+ });
131
+ }
132
+ function doFetch(url, init) {
133
+ return splunkInsecure() && url.startsWith('https:') ? insecureFetch(url, init) : fetch(url, init);
134
+ }
135
+ /**
136
+ * "fetch failed" alone says nothing; the reason is on the cause chain
137
+ * (a certificate the process does not trust, a refused connection, DNS).
138
+ * Name it, and say what fixes the common ones.
139
+ */
140
+ export function describeSplunkError(e) {
141
+ const err = e;
142
+ const code = err?.cause?.code ?? err?.code;
143
+ const causeMsg = err?.cause?.message;
144
+ const base = `${err?.message ?? String(e)}${code || causeMsg ? ` (${[code, causeMsg].filter(Boolean).join(': ')})` : ''}`;
145
+ if (code && /CERT|SELF_SIGNED|UNABLE_TO_VERIFY|ALTNAME/.test(code)) {
146
+ return `${base}. The search head's certificate is not trusted by this process; a default Splunk install serves a self-signed certificate on 8089. Set SPLUNK_INSECURE=1 in the MCP's environment to skip verification for Splunk only, or install a trusted certificate.`;
147
+ }
148
+ if (code === 'ECONNREFUSED' || code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
149
+ return `${base}. Nothing answered at SPLUNK_HOST; check the host and that the management port (8089 by default) is reachable from this machine.`;
150
+ }
151
+ return base;
152
+ }
89
153
  async function splunkFetch(conn, path, init = {}) {
90
154
  const url = `${conn.host}${path}`;
91
- const res = await fetch(url, {
155
+ const res = await doFetch(url, {
92
156
  ...init,
93
157
  headers: {
94
158
  Accept: 'application/json',
@@ -141,7 +205,7 @@ async function pullEvents(opts) {
141
205
  // the parent window with per-run RNG. Splunk dispatches one search
142
206
  // job per bucket sequentially — concurrent dispatches risk hitting
143
207
  // the search head's per-user concurrency cap (default 6).
144
- const BUCKET_COUNT = SPLUNK_BUCKET_COUNT;
208
+ const BUCKET_COUNT = Math.max(1, opts.buckets ?? SPLUNK_BUCKET_COUNT);
145
209
  const buckets = randomTimeBuckets(fromMs, toMs, BUCKET_COUNT);
146
210
  const bucketCap = perBucketCap(opts.targetEventCount, BUCKET_COUNT);
147
211
  const pageSize = SPLUNK_PAGE_SIZE;
@@ -172,7 +236,7 @@ async function pullEvents(opts) {
172
236
  sid = job.sid;
173
237
  }
174
238
  catch (e) {
175
- notes.push(`bucket_${bucket.index}_create_failed: ${e.message.slice(0, 200)}`);
239
+ notes.push(`bucket_${bucket.index}_create_failed: ${describeSplunkError(e).slice(0, 400)}`);
176
240
  // Per-bucket failure is non-fatal; move on.
177
241
  continue;
178
242
  }
@@ -208,7 +272,7 @@ async function pullEvents(opts) {
208
272
  await sleep(wait);
209
273
  }
210
274
  catch (e) {
211
- notes.push(`bucket_${bucket.index}_poll_error: ${e.message.slice(0, 200)}`);
275
+ notes.push(`bucket_${bucket.index}_poll_error: ${describeSplunkError(e).slice(0, 400)}`);
212
276
  pollFailed = true;
213
277
  break;
214
278
  }
@@ -251,7 +315,7 @@ async function pullEvents(opts) {
251
315
  break;
252
316
  }
253
317
  catch (e) {
254
- notes.push(`bucket_${bucket.index}_page_error offset=${offset}: ${e.message.slice(0, 200)}`);
318
+ notes.push(`bucket_${bucket.index}_page_error offset=${offset}: ${describeSplunkError(e).slice(0, 400)}`);
255
319
  break;
256
320
  }
257
321
  }
@@ -270,7 +334,7 @@ async function pullEvents(opts) {
270
334
  };
271
335
  }
272
336
  async function cancelJob(conn, sid) {
273
- await fetch(`${conn.host}/services/search/jobs/${sid}`, {
337
+ await doFetch(`${conn.host}/services/search/jobs/${sid}`, {
274
338
  method: 'DELETE',
275
339
  headers: { Authorization: authHeader(conn), Accept: 'application/json' },
276
340
  }).catch(() => undefined);
@@ -326,7 +390,7 @@ async function detectDailyVolumeGb(opts) {
326
390
  };
327
391
  }
328
392
  catch (e) {
329
- return { errorNote: `Splunk volume detection failed: ${e.message.slice(0, 200)}` };
393
+ return { errorNote: `Splunk volume detection failed: ${describeSplunkError(e).slice(0, 400)}` };
330
394
  }
331
395
  }
332
396
  export const splunkConnector = {
@@ -1 +1 @@
1
- {"version":3,"file":"splunk.js","sourceRoot":"","sources":["../../../src/lib/siem/splunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,4DAA4D;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,EAAE,GAA2B,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7D,IAAI,KAAK;oBAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAAE,CAAC,IAAI,OAAO,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC;YAC/B,GAAI,IAAI,CAAC,OAA8C;SACxD;KACF,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAqD,CAAC;QACzH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,CAAC,0DAA0D,CAAC;aACpE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAE/B,+EAA+E;IAC/E,MAAM,WAAW,GAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,mBAAmB,CAAC;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAElC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC7C,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAqB,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7D,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,mBAAoB,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,4CAA4C;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,iBAAiB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,aAAa,GAAG,gBAAgB,CAAC;gBACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,mBAAmB,CAAC,CACnE,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoJ,CAAC;gBACpL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzC,eAAe,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC;gBACnE,IAAI,OAAO,EAAE,MAAM;oBAAE,MAAM;gBAC3B,IAAI,OAAO,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC;oBACrD,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvE,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,gBAAiB,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvF,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,MAAM,GAAG,eAAe,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;YAC5D,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CACT,IAAI,EACJ,yBAAyB,GAAG,mBAAmB,MAAM,UAAU,KAAK,mBAAmB,CACxF,CACF,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM;gBAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,CAAC,CAAC,KAAK;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI;wBACf,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC;qBACP,CAAC,CAAC;oBACH,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,sBAAsB,MAAM,KAAM,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxG,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG;YACd,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAU,EAAE,GAAW;IAC9C,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,yBAAyB,GAAG,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACzE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,KAAK,IAAI,CAAC;IACV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,mCAAmC,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GACP,+DAA+D;QAC/D,sBAAsB;QACtB,kCAAkC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4C,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,qFAAqF,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,+CAA+C,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAChD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,uCAAuC,IAAI,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,mCAAoC,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
1
+ {"version":3,"file":"splunk.js","sourceRoot":"","sources":["../../../src/lib/siem/splunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,4DAA4D;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,EAAE,GAA2B,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7D,IAAI,KAAK;oBAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAAE,CAAC,IAAI,OAAO,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,OAAoB,EAAE;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAA2B,EAAE,GAAI,IAAI,CAAC,OAA8C,EAAE,CAAC;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAClG,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACpH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBACnC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,KAAK,SAAS;wBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;gBACpE,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,IAAiB;IAC7C,OAAO,cAAc,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,MAAM,GAAG,GAAG,CAA4D,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,IAAK,GAAyB,EAAE,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1H,IAAI,IAAI,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,GAAG,IAAI,2PAA2P,CAAC;IAC5Q,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC5E,OAAO,GAAG,IAAI,kIAAkI,CAAC;IACnJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC;YAC/B,GAAI,IAAI,CAAC,OAA8C;SACxD;KACF,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAqD,CAAC;QACzH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,CAAC,0DAA0D,CAAC;aACpE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAE/B,+EAA+E;IAC/E,MAAM,WAAW,GAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAElC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC7C,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAqB,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7D,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5F,4CAA4C;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,iBAAiB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,aAAa,GAAG,gBAAgB,CAAC;gBACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,mBAAmB,CAAC,CACnE,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoJ,CAAC;gBACpL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzC,eAAe,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC;gBACnE,IAAI,OAAO,EAAE,MAAM;oBAAE,MAAM;gBAC3B,IAAI,OAAO,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC;oBACrD,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvE,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,gBAAgB,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzF,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,MAAM,GAAG,eAAe,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;YAC5D,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CACT,IAAI,EACJ,yBAAyB,GAAG,mBAAmB,MAAM,UAAU,KAAK,mBAAmB,CACxF,CACF,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM;gBAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,CAAC,CAAC,KAAK;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI;wBACf,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC;qBACP,CAAC,CAAC;oBACH,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,sBAAsB,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG;YACd,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAU,EAAE,GAAW;IAC9C,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,yBAAyB,GAAG,EAAE,EAAE;QACxD,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACzE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,KAAK,IAAI,CAAC;IACV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,mCAAmC,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GACP,+DAA+D;QAC/D,sBAAsB;QACtB,kCAAkC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4C,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,qFAAqF,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,+CAA+C,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAChD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,uCAAuC,IAAI,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,mCAAmC,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
@@ -14,7 +14,7 @@ Reduce storage costs by forwarding [compact](https://doc.log10x.com/run/transfor
14
14
 
15
15
  <h3 id="analytics-costs"><span class="twemoji" ><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 21H7v-2h4v2m4.5-2H17v2h-4v-2h.2l-1.4-6.1-2.5.6c-.1.5-.3.9-.5 1.3-.9 1.5-2.8 1.9-4.3 1-1.5-.9-1.9-2.8-1-4.3.9-1.5 2.8-1.9 4.3-1 .4.2.7.6.9.9l2.5-.6-.6-2.5c-.4-.1-.8-.3-1.2-.5C8 6.9 7.5 5 8.4 3.5c.9-1.5 2.8-1.9 4.3-1 1.5.9 1.9 2.8 1 4.3-.2.4-.6.7-.9.9L15.5 19M7 11.8c-.7-.5-1.7-.2-2.2.5-.5.7-.2 1.7.5 2.1.7.5 1.7.3 2.2-.5.4-.7.2-1.7-.5-2.1M12.4 6c.5-.7.2-1.7-.5-2.2-.7-.5-1.7-.2-2.2.5-.4.7-.2 1.7.6 2.2.7.4 1.7.2 2.1-.5m.4 5.3c-.2-.1-.4-.1-.5.1-.1.2-.1.4.1.5.2.1.4.1.5-.1.2-.2.1-.4-.1-.5M21 8.5 14.5 10l.5 2.2 7.5-1.8.5-.7-2-1.2M23 19h-4v2h4v-2M5 19H1v2h4v-2Z"></path></svg></span> Cut Log Analytics Costs</h3>
16
16
 
17
- Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [10x for Splunk](splunk.md) app and [L1ES Elasticsearch plugin](elasticsearch.md) expand events in real-time, maintaining full querying, dashboard, and alerting capabilities; compact is lossless, so expanded events match the originals.
17
+ Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [Log10x App](splunk.md) and [L1ES Elasticsearch plugin](elasticsearch.md) expand events in real-time, maintaining full querying, dashboard, and alerting capabilities; compact is lossless, so expanded events match the originals.
18
18
 
19
19
  ## :material-cog-transfer-outline: Workflow
20
20
 
@@ -87,10 +87,10 @@ Compact mode executes inside the [Receiver](../index.md) sidecar, compacting eve
87
87
 
88
88
  === ":material-greater-than: Splunk"
89
89
 
90
- Forward compact events to Splunk. The open-source [10x for Splunk](splunk.md) app expands events on-the-fly at search time, displaying them in full JSON/text form in dashboards and queries.
90
+ Forward compact events to Splunk. The open-source [Log10x App](splunk.md) expands events on-the-fly at search time, displaying them in full JSON/text form in dashboards and queries.
91
91
 
92
92
  <figure markdown="span">
93
- ![Architecture diagram: Compact mode losslessly compacts events before shipping to Splunk, where the 10x for Splunk app expands them at search time](../../../assets/tenx-edge-optimizer-splunk.png){ align=left }
93
+ ![Architecture diagram: Compact mode losslessly compacts events before shipping to Splunk, where the Log10x App expands them at search time](../../../assets/tenx-edge-optimizer-splunk.png){ align=left }
94
94
  <figcaption>:white_check_mark: **Compact mode** losslessly compacts events before they ship to Splunk</figcaption>
95
95
  </figure>
96
96