log10x-mcp 1.30.21 → 1.30.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/README.md +3 -1
  2. package/build/index.js +26 -4
  3. package/build/index.js.map +1 -1
  4. package/build/lib/advisor/envelope.d.ts +1 -1
  5. package/build/lib/advisor/reporter-forwarders.d.ts +32 -13
  6. package/build/lib/advisor/reporter-forwarders.js +179 -94
  7. package/build/lib/advisor/reporter-forwarders.js.map +1 -1
  8. package/build/lib/advisor/reporter.d.ts +18 -10
  9. package/build/lib/advisor/reporter.js +43 -16
  10. package/build/lib/advisor/reporter.js.map +1 -1
  11. package/build/lib/advisor/retriever.d.ts +6 -0
  12. package/build/lib/advisor/retriever.js +5 -3
  13. package/build/lib/advisor/retriever.js.map +1 -1
  14. package/build/lib/advisor/types.d.ts +3 -1
  15. package/build/lib/cdk-recipes.d.ts +1 -1
  16. package/build/lib/cdk-recipes.js +21 -10
  17. package/build/lib/cdk-recipes.js.map +1 -1
  18. package/build/lib/discovery/types.d.ts +15 -10
  19. package/build/lib/fenced.d.ts +2 -0
  20. package/build/lib/fenced.js +2 -2
  21. package/build/lib/fenced.js.map +1 -1
  22. package/build/lib/offload-recipes.d.ts +2 -1
  23. package/build/lib/offload-recipes.js +13 -10
  24. package/build/lib/offload-recipes.js.map +1 -1
  25. package/build/lib/poc-report-renderer.js +17 -11
  26. package/build/lib/poc-report-renderer.js.map +1 -1
  27. package/build/lib/retriever-api.d.ts +14 -0
  28. package/build/lib/retriever-api.js +40 -10
  29. package/build/lib/retriever-api.js.map +1 -1
  30. package/build/lib/runtime-image.d.ts +7 -2
  31. package/build/lib/runtime-image.js +7 -2
  32. package/build/lib/runtime-image.js.map +1 -1
  33. package/build/lib/siem/_sampling.js +4 -0
  34. package/build/lib/siem/_sampling.js.map +1 -1
  35. package/build/lib/siem/cloudwatch.d.ts +18 -0
  36. package/build/lib/siem/cloudwatch.js +106 -2
  37. package/build/lib/siem/cloudwatch.js.map +1 -1
  38. package/build/lib/siem/datadog.js +1 -1
  39. package/build/lib/siem/datadog.js.map +1 -1
  40. package/build/lib/siem/elasticsearch.js +13 -1
  41. package/build/lib/siem/elasticsearch.js.map +1 -1
  42. package/build/lib/siem/splunk.d.ts +18 -0
  43. package/build/lib/siem/splunk.js +71 -7
  44. package/build/lib/siem/splunk.js.map +1 -1
  45. package/build/product-kb/docs/apps/receiver/compact/index.md +3 -3
  46. package/build/product-kb/docs/apps/receiver/compact/splunk.md +81 -67
  47. package/build/product-kb/docs/apps/retriever/faq.md +2 -2
  48. package/build/product-kb/docs/engine/launcher/extension.md +20 -20
  49. package/build/product-kb/docs/faq/apps/retriever.md +2 -2
  50. package/build/product-kb/docs/faq/general.md +1 -1
  51. package/build/product-kb/docs/faq/stacks/splunk/comparisons.md +3 -3
  52. package/build/product-kb/docs/faq/stacks/splunk/compatibility.md +19 -242
  53. package/build/product-kb/docs/faq/stacks/splunk/index.md +1 -1
  54. package/build/product-kb/docs/faq/stacks/splunk/kv-store.md +41 -159
  55. package/build/product-kb/docs/faq/stacks/splunk/optimization.md +4 -4
  56. package/build/product-kb/docs/run/input/forwarder/fluentbit/index.md +1 -1
  57. package/build/product-kb/docs/run/input/forwarder/fluentd/index.md +1 -1
  58. package/build/product-kb/docs/run/input/forwarder/otel-collector/index.md +1 -1
  59. package/build/product-kb/docs/run/input/forwarder/vector/index.md +1 -1
  60. package/build/product-kb/docs/summary.md +0 -1
  61. package/build/tools/advise-install.d.ts +25 -18
  62. package/build/tools/advise-install.js +156 -90
  63. package/build/tools/advise-install.js.map +1 -1
  64. package/build/tools/advise-retriever.d.ts +5 -5
  65. package/build/tools/advise-retriever.js +25 -9
  66. package/build/tools/advise-retriever.js.map +1 -1
  67. package/build/tools/doctor.js +3 -2
  68. package/build/tools/doctor.js.map +1 -1
  69. package/build/tools/emit-sample-plan.js +7 -1
  70. package/build/tools/emit-sample-plan.js.map +1 -1
  71. package/build/tools/poc-from-local.js +7 -6
  72. package/build/tools/poc-from-local.js.map +1 -1
  73. package/build/tools/poc-from-siem.js +71 -4
  74. package/build/tools/poc-from-siem.js.map +1 -1
  75. package/build/tools/retriever-query.js +1 -1
  76. package/build/tools/retriever-query.js.map +1 -1
  77. package/package.json +1 -1
  78. package/build/product-kb/docs/run/output/event/dev/index.md +0 -351
@@ -18,6 +18,16 @@ export const ELASTICSEARCH_BUCKET_COUNT = 24;
18
18
  export const ELASTICSEARCH_PAGE_SIZE = 1000;
19
19
  /** Default index pattern when the caller gives no scope. */
20
20
  export const ELASTICSEARCH_DEFAULT_INDEX = 'logs-*';
21
+ /**
22
+ * The v9 client sends `compatible-with=9`, which every Elasticsearch 8.x
23
+ * cluster rejects ("Accept version must be either version 8 or 7, but found
24
+ * 9"), so a POC against 8.17 pulled nothing. `compatible-with=8` is accepted
25
+ * by 8.x natively and by 9.x through REST API compatibility.
26
+ */
27
+ const COMPAT_8_HEADERS = {
28
+ accept: 'application/vnd.elasticsearch+json; compatible-with=8',
29
+ 'content-type': 'application/vnd.elasticsearch+json; compatible-with=8',
30
+ };
21
31
  function getConn() {
22
32
  const url = process.env.ELASTIC_URL || process.env.ELASTICSEARCH_URL;
23
33
  if (!url)
@@ -74,6 +84,7 @@ async function pullEvents(opts) {
74
84
  : conn.username && conn.password
75
85
  ? { auth: { username: conn.username, password: conn.password } }
76
86
  : {}),
87
+ headers: COMPAT_8_HEADERS,
77
88
  });
78
89
  const deadline = Date.now() + opts.maxPullMinutes * 60_000;
79
90
  const windowMs = parseWindowMs(opts.window);
@@ -86,7 +97,7 @@ async function pullEvents(opts) {
86
97
  // Stratified random sampling: 24 child sub-windows scattered across
87
98
  // the parent window with per-run RNG. Each bucket is its own
88
99
  // search_after pagination scope, capped at perBucketCap.
89
- const BUCKET_COUNT = ELASTICSEARCH_BUCKET_COUNT;
100
+ const BUCKET_COUNT = Math.max(1, opts.buckets ?? ELASTICSEARCH_BUCKET_COUNT);
90
101
  const buckets = randomTimeBuckets(fromMs, toMs, BUCKET_COUNT);
91
102
  const bucketCap = perBucketCap(opts.targetEventCount, BUCKET_COUNT);
92
103
  const pageSize = ELASTICSEARCH_PAGE_SIZE;
@@ -203,6 +214,7 @@ async function detectDailyVolumeGb(opts) {
203
214
  : conn.username && conn.password
204
215
  ? { auth: { username: conn.username, password: conn.password } }
205
216
  : {}),
217
+ headers: COMPAT_8_HEADERS,
206
218
  });
207
219
  const indexPattern = opts.scope || ELASTICSEARCH_DEFAULT_INDEX;
208
220
  try {
@@ -1 +1 @@
1
- {"version":3,"file":"elasticsearch.js","sourceRoot":"","sources":["../../../src/lib/siem/elasticsearch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAYhD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AASpD,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAChF,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC7D,uFAAuF;IACvF,mFAAmF;IACnF,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,QAAQ;SACf;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE;oBACL,2FAA2F;wBACzF,uEAAuE;iBAC1E;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,wEAAwE;QACxE,qEAAqE;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAE/D,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,YAAY,GAAG,0BAA0B,CAAC;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC;IAEzC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,WAAW,GAA8B;YAC7C;gBACE,KAAK,EAAE;oBACL,YAAY,EAAE;wBACZ,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;wBAC1C,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;qBACzC;iBACF;aACF;SACF,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,WAAkC,CAAC;QACvC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,YAAY,GAAG,SAAS,EAAE,CAAC;YAChC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,2DAA2D;gBAC3D,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,gEAAgE;gBAChE,gEAAgE;gBAChE,mDAAmD;gBACnD,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC3C,MAAM,UAAU,GAA4B;oBAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;oBACtC,IAAI;oBACJ,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;oBAC/B,gBAAgB,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,WAAW;oBAAE,UAAU,CAAC,YAAY,GAAG,WAAW,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,MAAM,CAAC,MAAM,CAAC;oBACZ,KAAK,EAAE,YAAY;oBACnB,GAAG,UAAU;iBACd,CAAC,CACH,CAAC;gBACF,MAAM,IAAI,GACR,CAAE,IAAqF;qBACpF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,CAAC,mBAAmB;gBACjD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,YAAY,IAAI,SAAS;wBAAE,MAAM;oBACrC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACvB,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACnC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC;oBACd,IAAI,EAAE,wBAAwB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,KAAK,YAAY,IAAI,SAAS,GAAG;oBAC/F,GAAG,EAAE,IAAI,CAAC,GAAG,CACX,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAC5E;oBACD,aAAa,EAAE,MAAM,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,CAAC,mBAAmB;YACpD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,WAAY,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1F,mCAAmC;gBACnC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACnE,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5C,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,YAAY;SACoC,CAAC,CAE1D,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,SAAS,EAAE,gCAAgC,YAAY,6BAA6B,EAAE,CAAC;QAClG,CAAC;QACD,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,CAAC;YACP,IAAI,EAAE;gBACJ,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;aACzC;SACgD,CAAC,CAKnD,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,IAAI,IAAY,CAAC;QACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,UAAU,CAAC,CAAC;YACjD,QAAQ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,IAAI,GAAG,CAAC,CAAC;YACT,QAAQ,GAAG,oCAAoC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,OAAO;YACP,MAAM,EAAE,4BAA4B,YAAY,MAAM,QAAQ,GAAG;SAClE,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,0CAA2C,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,eAAe;IAC5B,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
1
+ {"version":3,"file":"elasticsearch.js","sourceRoot":"","sources":["../../../src/lib/siem/elasticsearch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAYhD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,uDAAuD;IAC/D,cAAc,EAAE,uDAAuD;CACxE,CAAC;AASF,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAChF,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC7D,uFAAuF;IACvF,mFAAmF;IACnF,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,QAAQ;SACf;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE;oBACL,2FAA2F;wBACzF,uEAAuE;iBAC1E;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,wEAAwE;QACxE,qEAAqE;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAE/D,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC;IAEzC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,WAAW,GAA8B;YAC7C;gBACE,KAAK,EAAE;oBACL,YAAY,EAAE;wBACZ,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;wBAC1C,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;qBACzC;iBACF;aACF;SACF,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,WAAkC,CAAC;QACvC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,YAAY,GAAG,SAAS,EAAE,CAAC;YAChC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,2DAA2D;gBAC3D,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,gEAAgE;gBAChE,gEAAgE;gBAChE,mDAAmD;gBACnD,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC3C,MAAM,UAAU,GAA4B;oBAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;oBACtC,IAAI;oBACJ,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;oBAC/B,gBAAgB,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,WAAW;oBAAE,UAAU,CAAC,YAAY,GAAG,WAAW,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,MAAM,CAAC,MAAM,CAAC;oBACZ,KAAK,EAAE,YAAY;oBACnB,GAAG,UAAU;iBACd,CAAC,CACH,CAAC;gBACF,MAAM,IAAI,GACR,CAAE,IAAqF;qBACpF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,CAAC,mBAAmB;gBACjD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,YAAY,IAAI,SAAS;wBAAE,MAAM;oBACrC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACvB,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACnC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC;oBACd,IAAI,EAAE,wBAAwB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,KAAK,YAAY,IAAI,SAAS,GAAG;oBAC/F,GAAG,EAAE,IAAI,CAAC,GAAG,CACX,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAC5E;oBACD,aAAa,EAAE,MAAM,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,CAAC,mBAAmB;YACpD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,WAAY,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1F,mCAAmC;gBACnC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACnE,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5C,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,YAAY;SACoC,CAAC,CAE1D,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,SAAS,EAAE,gCAAgC,YAAY,6BAA6B,EAAE,CAAC;QAClG,CAAC;QACD,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,CAAC;YACP,IAAI,EAAE;gBACJ,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;aACzC;SACgD,CAAC,CAKnD,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,IAAI,IAAY,CAAC;QACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,UAAU,CAAC,CAAC;YACjD,QAAQ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,IAAI,GAAG,CAAC,CAAC;YACT,QAAQ,GAAG,oCAAoC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,OAAO;YACP,MAAM,EAAE,4BAA4B,YAAY,MAAM,QAAQ,GAAG;SAClE,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,0CAA2C,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,eAAe;IAC5B,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
@@ -22,4 +22,22 @@ import type { SiemConnector } from './index.js';
22
22
  export declare const SPLUNK_BUCKET_COUNT = 12;
23
23
  /** Results page size used against `search/jobs/{sid}/results`. */
24
24
  export declare const SPLUNK_PAGE_SIZE = 1000;
25
+ /**
26
+ * SPLUNK_INSECURE=1 skips certificate verification for the search head only.
27
+ * A default Splunk install serves port 8089 with its own self-signed
28
+ * certificate, issued to "SplunkServerDefaultCert", so neither the system CA
29
+ * store nor NODE_EXTRA_CA_CERTS can verify it (the hostname never matches).
30
+ * Global fetch cannot relax verification per request without a newer undici
31
+ * than Node 20 ships, and NODE_TLS_REJECT_UNAUTHORIZED would relax it for
32
+ * every connection this process makes, so this path uses node:https with
33
+ * rejectUnauthorized:false for Splunk requests alone. Opt-in, never default;
34
+ * the emitted export script offers the same choice (--insecure).
35
+ */
36
+ export declare function splunkInsecure(): boolean;
37
+ /**
38
+ * "fetch failed" alone says nothing; the reason is on the cause chain
39
+ * (a certificate the process does not trust, a refused connection, DNS).
40
+ * Name it, and say what fixes the common ones.
41
+ */
42
+ export declare function describeSplunkError(e: unknown): string;
25
43
  export declare const splunkConnector: SiemConnector;
@@ -25,6 +25,7 @@ export const SPLUNK_BUCKET_COUNT = 12;
25
25
  export const SPLUNK_PAGE_SIZE = 1000;
26
26
  import { existsSync, readFileSync } from 'fs';
27
27
  import { homedir } from 'os';
28
+ import https from 'node:https';
28
29
  import { join } from 'path';
29
30
  function getConn() {
30
31
  const envHost = process.env.SPLUNK_HOST;
@@ -86,9 +87,72 @@ function authHeader(conn) {
86
87
  return `Bearer ${conn.token}`;
87
88
  return 'Basic ' + Buffer.from(`${conn.username}:${conn.password}`).toString('base64');
88
89
  }
90
+ /**
91
+ * SPLUNK_INSECURE=1 skips certificate verification for the search head only.
92
+ * A default Splunk install serves port 8089 with its own self-signed
93
+ * certificate, issued to "SplunkServerDefaultCert", so neither the system CA
94
+ * store nor NODE_EXTRA_CA_CERTS can verify it (the hostname never matches).
95
+ * Global fetch cannot relax verification per request without a newer undici
96
+ * than Node 20 ships, and NODE_TLS_REJECT_UNAUTHORIZED would relax it for
97
+ * every connection this process makes, so this path uses node:https with
98
+ * rejectUnauthorized:false for Splunk requests alone. Opt-in, never default;
99
+ * the emitted export script offers the same choice (--insecure).
100
+ */
101
+ export function splunkInsecure() {
102
+ return /^(1|true|yes)$/i.test(process.env.SPLUNK_INSECURE ?? '');
103
+ }
104
+ function insecureFetch(url, init = {}) {
105
+ return new Promise((resolve, reject) => {
106
+ const headers = { ...init.headers };
107
+ const body = init.body == null ? undefined : String(init.body);
108
+ if (body !== undefined && !Object.keys(headers).some((k) => k.toLowerCase() === 'content-length')) {
109
+ headers['Content-Length'] = String(Buffer.byteLength(body));
110
+ }
111
+ const req = https.request(new URL(url), { method: init.method ?? 'GET', headers, rejectUnauthorized: false }, (res) => {
112
+ const chunks = [];
113
+ res.on('data', (c) => chunks.push(c));
114
+ res.on('error', reject);
115
+ res.on('end', () => {
116
+ const status = res.statusCode ?? 0;
117
+ const h = new Headers();
118
+ for (const [k, v] of Object.entries(res.headers)) {
119
+ if (v !== undefined)
120
+ h.set(k, Array.isArray(v) ? v.join(', ') : String(v));
121
+ }
122
+ const nullBody = status === 204 || status === 205 || status === 304;
123
+ resolve(new Response(nullBody ? null : Buffer.concat(chunks), { status, headers: h }));
124
+ });
125
+ });
126
+ req.on('error', reject);
127
+ if (body !== undefined)
128
+ req.write(body);
129
+ req.end();
130
+ });
131
+ }
132
+ function doFetch(url, init) {
133
+ return splunkInsecure() && url.startsWith('https:') ? insecureFetch(url, init) : fetch(url, init);
134
+ }
135
+ /**
136
+ * "fetch failed" alone says nothing; the reason is on the cause chain
137
+ * (a certificate the process does not trust, a refused connection, DNS).
138
+ * Name it, and say what fixes the common ones.
139
+ */
140
+ export function describeSplunkError(e) {
141
+ const err = e;
142
+ const code = err?.cause?.code ?? err?.code;
143
+ const causeMsg = err?.cause?.message;
144
+ const base = `${err?.message ?? String(e)}${code || causeMsg ? ` (${[code, causeMsg].filter(Boolean).join(': ')})` : ''}`;
145
+ if (code && /CERT|SELF_SIGNED|UNABLE_TO_VERIFY|ALTNAME/.test(code)) {
146
+ return `${base}. The search head's certificate is not trusted by this process; a default Splunk install serves a self-signed certificate on 8089. Set SPLUNK_INSECURE=1 in the MCP's environment to skip verification for Splunk only, or install a trusted certificate.`;
147
+ }
148
+ if (code === 'ECONNREFUSED' || code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
149
+ return `${base}. Nothing answered at SPLUNK_HOST; check the host and that the management port (8089 by default) is reachable from this machine.`;
150
+ }
151
+ return base;
152
+ }
89
153
  async function splunkFetch(conn, path, init = {}) {
90
154
  const url = `${conn.host}${path}`;
91
- const res = await fetch(url, {
155
+ const res = await doFetch(url, {
92
156
  ...init,
93
157
  headers: {
94
158
  Accept: 'application/json',
@@ -141,7 +205,7 @@ async function pullEvents(opts) {
141
205
  // the parent window with per-run RNG. Splunk dispatches one search
142
206
  // job per bucket sequentially — concurrent dispatches risk hitting
143
207
  // the search head's per-user concurrency cap (default 6).
144
- const BUCKET_COUNT = SPLUNK_BUCKET_COUNT;
208
+ const BUCKET_COUNT = Math.max(1, opts.buckets ?? SPLUNK_BUCKET_COUNT);
145
209
  const buckets = randomTimeBuckets(fromMs, toMs, BUCKET_COUNT);
146
210
  const bucketCap = perBucketCap(opts.targetEventCount, BUCKET_COUNT);
147
211
  const pageSize = SPLUNK_PAGE_SIZE;
@@ -172,7 +236,7 @@ async function pullEvents(opts) {
172
236
  sid = job.sid;
173
237
  }
174
238
  catch (e) {
175
- notes.push(`bucket_${bucket.index}_create_failed: ${e.message.slice(0, 200)}`);
239
+ notes.push(`bucket_${bucket.index}_create_failed: ${describeSplunkError(e).slice(0, 400)}`);
176
240
  // Per-bucket failure is non-fatal; move on.
177
241
  continue;
178
242
  }
@@ -208,7 +272,7 @@ async function pullEvents(opts) {
208
272
  await sleep(wait);
209
273
  }
210
274
  catch (e) {
211
- notes.push(`bucket_${bucket.index}_poll_error: ${e.message.slice(0, 200)}`);
275
+ notes.push(`bucket_${bucket.index}_poll_error: ${describeSplunkError(e).slice(0, 400)}`);
212
276
  pollFailed = true;
213
277
  break;
214
278
  }
@@ -251,7 +315,7 @@ async function pullEvents(opts) {
251
315
  break;
252
316
  }
253
317
  catch (e) {
254
- notes.push(`bucket_${bucket.index}_page_error offset=${offset}: ${e.message.slice(0, 200)}`);
318
+ notes.push(`bucket_${bucket.index}_page_error offset=${offset}: ${describeSplunkError(e).slice(0, 400)}`);
255
319
  break;
256
320
  }
257
321
  }
@@ -270,7 +334,7 @@ async function pullEvents(opts) {
270
334
  };
271
335
  }
272
336
  async function cancelJob(conn, sid) {
273
- await fetch(`${conn.host}/services/search/jobs/${sid}`, {
337
+ await doFetch(`${conn.host}/services/search/jobs/${sid}`, {
274
338
  method: 'DELETE',
275
339
  headers: { Authorization: authHeader(conn), Accept: 'application/json' },
276
340
  }).catch(() => undefined);
@@ -326,7 +390,7 @@ async function detectDailyVolumeGb(opts) {
326
390
  };
327
391
  }
328
392
  catch (e) {
329
- return { errorNote: `Splunk volume detection failed: ${e.message.slice(0, 200)}` };
393
+ return { errorNote: `Splunk volume detection failed: ${describeSplunkError(e).slice(0, 400)}` };
330
394
  }
331
395
  }
332
396
  export const splunkConnector = {
@@ -1 +1 @@
1
- {"version":3,"file":"splunk.js","sourceRoot":"","sources":["../../../src/lib/siem/splunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,4DAA4D;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,EAAE,GAA2B,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7D,IAAI,KAAK;oBAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAAE,CAAC,IAAI,OAAO,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC;YAC/B,GAAI,IAAI,CAAC,OAA8C;SACxD;KACF,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAqD,CAAC;QACzH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,CAAC,0DAA0D,CAAC;aACpE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAE/B,+EAA+E;IAC/E,MAAM,WAAW,GAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,mBAAmB,CAAC;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAElC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC7C,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAqB,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7D,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,mBAAoB,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,4CAA4C;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,iBAAiB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,aAAa,GAAG,gBAAgB,CAAC;gBACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,mBAAmB,CAAC,CACnE,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoJ,CAAC;gBACpL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzC,eAAe,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC;gBACnE,IAAI,OAAO,EAAE,MAAM;oBAAE,MAAM;gBAC3B,IAAI,OAAO,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC;oBACrD,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvE,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,gBAAiB,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvF,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,MAAM,GAAG,eAAe,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;YAC5D,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CACT,IAAI,EACJ,yBAAyB,GAAG,mBAAmB,MAAM,UAAU,KAAK,mBAAmB,CACxF,CACF,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM;gBAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,CAAC,CAAC,KAAK;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI;wBACf,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC;qBACP,CAAC,CAAC;oBACH,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,sBAAsB,MAAM,KAAM,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxG,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG;YACd,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAU,EAAE,GAAW;IAC9C,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,yBAAyB,GAAG,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACzE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,KAAK,IAAI,CAAC;IACV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,mCAAmC,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GACP,+DAA+D;QAC/D,sBAAsB;QACtB,kCAAkC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4C,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,qFAAqF,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,+CAA+C,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAChD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,uCAAuC,IAAI,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,mCAAoC,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
1
+ {"version":3,"file":"splunk.js","sourceRoot":"","sources":["../../../src/lib/siem/splunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,4DAA4D;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,EAAE,GAA2B,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7D,IAAI,KAAK;oBAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAAE,CAAC,IAAI,OAAO,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,OAAoB,EAAE;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAA2B,EAAE,GAAI,IAAI,CAAC,OAA8C,EAAE,CAAC;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAClG,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACpH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBACnC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,KAAK,SAAS;wBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;gBACpE,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,IAAiB;IAC7C,OAAO,cAAc,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,MAAM,GAAG,GAAG,CAA4D,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,IAAK,GAAyB,EAAE,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1H,IAAI,IAAI,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,GAAG,IAAI,2PAA2P,CAAC;IAC5Q,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC5E,OAAO,GAAG,IAAI,kIAAkI,CAAC;IACnJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC;YAC/B,GAAI,IAAI,CAAC,OAA8C;SACxD;KACF,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAqD,CAAC;QACzH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,CAAC,0DAA0D,CAAC;aACpE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAE/B,+EAA+E;IAC/E,MAAM,WAAW,GAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAElC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC7C,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAqB,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7D,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5F,4CAA4C;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,iBAAiB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,aAAa,GAAG,gBAAgB,CAAC;gBACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,mBAAmB,CAAC,CACnE,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoJ,CAAC;gBACpL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzC,eAAe,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC;gBACnE,IAAI,OAAO,EAAE,MAAM;oBAAE,MAAM;gBAC3B,IAAI,OAAO,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC;oBACrD,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvE,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,gBAAgB,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzF,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,MAAM,GAAG,eAAe,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;YAC5D,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CACT,IAAI,EACJ,yBAAyB,GAAG,mBAAmB,MAAM,UAAU,KAAK,mBAAmB,CACxF,CACF,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM;gBAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,CAAC,CAAC,KAAK;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI;wBACf,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC;qBACP,CAAC,CAAC;oBACH,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,sBAAsB,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG;YACd,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAU,EAAE,GAAW;IAC9C,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,yBAAyB,GAAG,EAAE,EAAE;QACxD,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACzE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,KAAK,IAAI,CAAC;IACV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,mCAAmC,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GACP,+DAA+D;QAC/D,sBAAsB;QACtB,kCAAkC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4C,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,qFAAqF,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,+CAA+C,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAChD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,uCAAuC,IAAI,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,mCAAmC,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
@@ -14,7 +14,7 @@ Reduce storage costs by forwarding [compact](https://doc.log10x.com/run/transfor
14
14
 
15
15
  <h3 id="analytics-costs"><span class="twemoji" ><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 21H7v-2h4v2m4.5-2H17v2h-4v-2h.2l-1.4-6.1-2.5.6c-.1.5-.3.9-.5 1.3-.9 1.5-2.8 1.9-4.3 1-1.5-.9-1.9-2.8-1-4.3.9-1.5 2.8-1.9 4.3-1 .4.2.7.6.9.9l2.5-.6-.6-2.5c-.4-.1-.8-.3-1.2-.5C8 6.9 7.5 5 8.4 3.5c.9-1.5 2.8-1.9 4.3-1 1.5.9 1.9 2.8 1 4.3-.2.4-.6.7-.9.9L15.5 19M7 11.8c-.7-.5-1.7-.2-2.2.5-.5.7-.2 1.7.5 2.1.7.5 1.7.3 2.2-.5.4-.7.2-1.7-.5-2.1M12.4 6c.5-.7.2-1.7-.5-2.2-.7-.5-1.7-.2-2.2.5-.4.7-.2 1.7.6 2.2.7.4 1.7.2 2.1-.5m.4 5.3c-.2-.1-.4-.1-.5.1-.1.2-.1.4.1.5.2.1.4.1.5-.1.2-.2.1-.4-.1-.5M21 8.5 14.5 10l.5 2.2 7.5-1.8.5-.7-2-1.2M23 19h-4v2h4v-2M5 19H1v2h4v-2Z"></path></svg></span> Cut Log Analytics Costs</h3>
16
16
 
17
- Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [10x for Splunk](splunk.md) app and [L1ES Elasticsearch plugin](elasticsearch.md) expand events in real-time, maintaining full querying, dashboard, and alerting capabilities; compact is lossless, so expanded events match the originals.
17
+ Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [Log10x App](splunk.md) and [L1ES Elasticsearch plugin](elasticsearch.md) expand events in real-time, maintaining full querying, dashboard, and alerting capabilities; compact is lossless, so expanded events match the originals.
18
18
 
19
19
  ## :material-cog-transfer-outline: Workflow
20
20
 
@@ -87,10 +87,10 @@ Compact mode executes inside the [Receiver](../index.md) sidecar, compacting eve
87
87
 
88
88
  === ":material-greater-than: Splunk"
89
89
 
90
- Forward compact events to Splunk. The open-source [10x for Splunk](splunk.md) app expands events on-the-fly at search time, displaying them in full JSON/text form in dashboards and queries.
90
+ Forward compact events to Splunk. The open-source [Log10x App](splunk.md) expands events on-the-fly at search time, displaying them in full JSON/text form in dashboards and queries.
91
91
 
92
92
  <figure markdown="span">
93
- ![Architecture diagram: Compact mode losslessly compacts events before shipping to Splunk, where the 10x for Splunk app expands them at search time](../../../assets/tenx-edge-optimizer-splunk.png){ align=left }
93
+ ![Architecture diagram: Compact mode losslessly compacts events before shipping to Splunk, where the Log10x App expands them at search time](../../../assets/tenx-edge-optimizer-splunk.png){ align=left }
94
94
  <figcaption>:white_check_mark: **Compact mode** losslessly compacts events before they ship to Splunk</figcaption>
95
95
  </figure>
96
96