diff --git a/.github/workflows/build-test-release.yml b/.github/workflows/build-test-release.yml index 48f989193..43c57c466 100644 --- a/.github/workflows/build-test-release.yml +++ b/.github/workflows/build-test-release.yml @@ -148,6 +148,8 @@ jobs: "splunk_app_req", "splunk_app_req_broken", "splunk_cim_model", + "splunk_app_fiction_with_uuid", + "splunk_app_req_with_uuid", ] steps: - uses: actions/checkout@v4 diff --git a/.gitmodules b/.gitmodules index a3a4f4ddf..e69de29bb 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,6 +0,0 @@ -[submodule "deps/build/addonfactory_test_matrix_splunk"] - path = deps/build/addonfactory_test_matrix_splunk - url = https://github.com/splunk/addonfactory_test_matrix_splunk.git -[submodule "deps/apps/Splunk_SA_CIM"] - path = deps/apps/Splunk_SA_CIM - url = git@github.com:splunk/addonfactory-splunk_sa_cim.git diff --git a/deps/apps/Splunk_SA_CIM b/deps/apps/Splunk_SA_CIM deleted file mode 160000 index 099de8e1b..000000000 --- a/deps/apps/Splunk_SA_CIM +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 099de8e1bf5527e0f66c72737fe6f475b838ea68 diff --git a/deps/apps/Splunk_SA_CIM/README.txt b/deps/apps/Splunk_SA_CIM/README.txt new file mode 100644 index 000000000..c20a124c5 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/README.txt @@ -0,0 +1,10 @@ +ReadMe +Splunk Common Information Model 4.20.0 + +Copyright (C) 2005-2018 Splunk Inc. All rights reserved. + +* For the Release Notes, What's New, and Getting Started documentation for this +release see: + http://docs.splunk.com/Documentation/CIM/ + + diff --git a/deps/apps/Splunk_SA_CIM/README/alert_actions.conf.example b/deps/apps/Splunk_SA_CIM/README/alert_actions.conf.example new file mode 100644 index 000000000..a96c52681 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/README/alert_actions.conf.example @@ -0,0 +1,28 @@ + +[my_action] + +... + +param._cam = {\ + "category": ["Information Gathering"],\ + "task": ["create"],\ + "subject": ["network.capture"],\ + "technology": [{"vendor": "Splunk", "product": "Splunk App for Stream"}],\ + "supports_adhoc": true,\ + "drilldown_uri": "my_view?form.orig_sid=$sid$&form.orig_rid=$rid$"\ +} + + +[my_action2] + +... + +param._cam = {\ + "category": ["Information Gathering"],\ + "task": ["scan"],\ + "subject": ["process.reputation-service"],\ + "technology": [{"vendor": "myvendor", "product": "myproduct", "version": "1.0"}],\ + "supports_adhoc": true,\ + "drilldown_uri": "../my_app/my_view?form.orig_sid=$sid$&form.orig_rid=$rid$",\ + "field_name_params": ["param.host_field"]\ +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/README/alert_actions.conf.spec b/deps/apps/Splunk_SA_CIM/README/alert_actions.conf.spec new file mode 100644 index 000000000..6d5cb1549 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/README/alert_actions.conf.spec @@ -0,0 +1,98 @@ + +param._cam = + * Json specification for classifying response actions. + * See Appendix A. + * Optional. + * Defaults to None. + +param._cam_workers = + * Json specification for defining remote workers. + * See Appendix B. + * Optional. + * Defaults to None. + + +###### Appendix A: Common Action Model Specification ####### +## category: The category or categories the modular action belongs to. +## Required. +## For instance, "Information Gathering". +## See cam_categories.csv for recommended values. +## task: The function or functions performed by the modular action. +## Required. +## For instance, "create". +## See cam_tasks.csv for recommended values. +## subject: The object or objects that the modular action's task(s) +## can be performed on (i.e. "endpoint.file"). +## Required. +## See cam_subjects.csv for recommended values. +## technology: The technology or technologies that the modular action supports. +## Required. +## vendor: The vendor of the technology. +## Required. +## For instance, "Splunk". +## product: The product of the technology. +## Required. +## For instance, "Enterprise". +## version: The version or versions of the technology. +## Optional. +## For instance, "6.4". +## drilldown_uri: Specifies a custom target for viewing the events +## outputted as a result of the action. +## Custom target can specify app and/or view depending on syntax. +## Optional. +## For instance, "my_view?form.orig_sid=$sid$&form.orig_rid=$rid$" +## For instance, "../my_app/my_view?form.orig_sid=$sid$&form.orig_rid=$rid$" +## field_name_params: The param or params which represent the name of a result field. +## Optional. +## For instance, ["param.search_field"] indicates that the value of "param.search_field" +## should be present as a field in the result or results being operated on. +## required_params: Parameter(s) required for successful action execution. +## Indicated by "*" in the custom alert action user interface. +## For instance, ["param.search_field"] indicates that "param.search_field" +## should be specified when submitting the action on the custom alert action +## user interface. +## Optional. +## supports_adhoc: Specifies if the modular action supports adhoc invocations. +## Optional. +## Defaults to False. +## supports_cloud: Specifies if the modular actions supports the "cloud" model. +## For instance, does the action function properly when the search head does not have access +## to the local network. +## Optional. +## Defaults to True. +## supports_workers: Specifies if the modular actions supports remote workers. +## supports_workers==True implies supports_cloud==True +## Optional. +## Defaults to False. +#{ +# "category": ["", ..., "], +# "task": ["", ..., ""], +# "subject": ["", ..., ""], +# "technology": [{ "vendor": "", +# "product": "", +# "version": ["", ..., ""] +# }, +# ..., +# { "vendor": "", +# "product": "", +# "version": ["", ..., ""] +# } +# ], +# "drilldown_uri": "", +# "field_name_params": ["", ..., ""], +# "required_params": ["", ..., ""] +# "supports_adhoc": true | false, +# "supports_cloud": true | false, +# "supports_workers": true | false +#} + + +###### Appendix B: Common Action Model Remote Workers Specification ####### +## List of Splunk "serverName" values as advertised by /server/info +## +## Special "serverName" values: +## * "local" - action script will continue doing work locally in addition to +## queueing work for additional workers (if specified). +## +## +## [ "local"?, "worker1", "worker2", ..., "workern" ] \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/README/commands.conf.spec b/deps/apps/Splunk_SA_CIM/README/commands.conf.spec new file mode 100644 index 000000000..f6a63b8b2 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/README/commands.conf.spec @@ -0,0 +1,9 @@ + +[] +python.version = {default|python|python2|python3} +* Optional setting. Requires 8.0+ +* For Python scripts only, selects which Python version to use. +* Set to either "default" or "python" to use the system-wide default Python + version. +* Optional. +* Default: Not set; uses the system-wide Python version. diff --git a/deps/apps/Splunk_SA_CIM/README/inputs.conf.example b/deps/apps/Splunk_SA_CIM/README/inputs.conf.example new file mode 100644 index 000000000..e311cca68 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/README/inputs.conf.example @@ -0,0 +1,6 @@ +[relaymodaction://master] +uri = https://master:8089 +description = splunk cloud search head +username = username +verify = True +client_cert = client_cert.pem diff --git a/deps/apps/Splunk_SA_CIM/README/inputs.conf.spec b/deps/apps/Splunk_SA_CIM/README/inputs.conf.spec new file mode 100644 index 000000000..a6df3c11b --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/README/inputs.conf.spec @@ -0,0 +1,29 @@ + +python.version = {default|python|python2|python3} +* Optional setting. Requires 8.0+ +* For Python scripts only, selects which Python version to use. +* Set to either "default" or "python" to use the system-wide default Python + version. +* Optional. +* Default: Not set; uses the system-wide Python version. + +[relaymodaction://] +uri = +* Remote splunk instance management URI. +* Format should be protocol://host:port + +description = +* Description for the remote Splunk instance. + +username = +* Label pertaining to the API key stored in secure storage, must be unique. +* Realm is "cam_queue". + +verify = +* Specifies if SSL verification is needed between worker and remote search head. +* Defaults to True + +client_cert = +* Filename of client certificate. +* Specify when SSL verification is needed, leave empty otherwise. +* Certificate should be put in $splunk_home/etc/apps/Splunk_SA_CIM/auth diff --git a/deps/apps/Splunk_SA_CIM/README/restmap.conf.spec b/deps/apps/Splunk_SA_CIM/README/restmap.conf.spec new file mode 100644 index 000000000..23088525a --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/README/restmap.conf.spec @@ -0,0 +1,9 @@ + +[script:] +python.version={default|python|python2|python3} +* Optional setting. Requires 8.0+ +* For Python scripts only, selects which Python version to use. +* Set to either "default" or "python" to use the system-wide default Python + version. +* Optional. +* Default: Not set; uses the system-wide Python version. diff --git a/deps/apps/Splunk_SA_CIM/README/transforms.conf.spec b/deps/apps/Splunk_SA_CIM/README/transforms.conf.spec new file mode 100644 index 000000000..6d3c3c246 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/README/transforms.conf.spec @@ -0,0 +1,11 @@ +[] +reverse_lookup_honor_case_sensitive_match = {default|true|false} +* Optional setting. +* This setting does not apply to KV Store lookups. +* Default: true +* When set to true, and case_sensitive_match is true Splunk software performs case-sensitive matching for + all fields in a reverse lookup. +* When set to true, and case_sensitive_match is false Splunk software performs case-insensitive matching for + all fields in a reverse lookup. +* When set to false, Splunk software performs case-insensitive matching for + all fields in a reverse lookup. diff --git a/deps/apps/Splunk_SA_CIM/appserver/static/bootstrap-enterprise.css b/deps/apps/Splunk_SA_CIM/appserver/static/bootstrap-enterprise.css new file mode 100644 index 000000000..70bb1938e --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/appserver/static/bootstrap-enterprise.css @@ -0,0 +1 @@ +article,aside,details,figcaption,figure,footer,header,hgroup,nav,section{display:block}audio,canvas,video{display:inline-block}audio:not([controls]){display:none}html{font-size:100%;-webkit-text-size-adjust:100%;-moz-text-size-adjust:100%;-ms-text-size-adjust:100%;text-size-adjust:100%}a:active,a:hover{outline:0}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{max-width:100%;height:auto;vertical-align:middle;border:0;-ms-interpolation-mode:bicubic}#map_canvas img,.google-maps img{max-width:none}button,input,select,textarea{margin:0;font-size:100%;vertical-align:middle}button,input{line-height:normal}button::-moz-focus-inner,input::-moz-focus-inner{padding:0;border:0}button,html input[type=button],input[type=reset],input[type=submit]{-webkit-appearance:button;cursor:pointer}button,input[type=button],input[type=checkbox],input[type=radio],input[type=reset],input[type=submit],label,select{cursor:pointer}input[type=search]{-webkit-box-sizing:content-box;box-sizing:content-box;-webkit-appearance:textfield}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance:none}textarea{overflow:auto;vertical-align:top}@media print{*{text-shadow:none!important;color:#000!important;background:transparent!important;-webkit-box-shadow:none!important;box-shadow:none!important}a,a:visited{text-decoration:underline}a[href]:after{content:" (" attr(href) ")"}abbr[title]:after{content:" (" attr(title) ")"}.ir a:after,a[href^="#"]:after,a[href^="javascript:"]:after{content:""}blockquote,pre{border:1px solid #999;page-break-inside:avoid}thead{display:table-header-group}img,tr{page-break-inside:avoid}img{max-width:100%!important}@page{margin:.5cm}h2,h3,p{orphans:3;widows:3}h2,h3{page-break-after:avoid}}body{margin:0;background:#f2f4f5;color:#3c444d;min-width:960px;font-family:Splunk Platform Sans,Proxima Nova,Roboto,Droid,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:20px;-webkit-transition:margin .2s;transition:margin .2s}body.open{margin-left:300px;margin-right:-300px}.shared-page{height:100vh;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}a{text-decoration:none;cursor:pointer}a,a:hover{color:#006eaa}a:hover{text-decoration:underline}a:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}a:active,a:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}a.disabled{color:#6b7785}a.external:after{font-family:Splunk Icons;content:"\EC13";display:inline-block;padding-left:.5em}.img-rounded{border-radius:3px}.img-polaroid{padding:4px;background-color:#fff;border:1px solid #c3cbd4;border:1px solid rgba(0,0,0,.2);-webkit-box-shadow:0 1px 3px rgba(0,0,0,.1);box-shadow:0 1px 3px rgba(0,0,0,.1)}.img-circle{border-radius:500px}.section-padded{padding:20px}.section-header{position:relative}.section-header .section-title{margin-top:0;font-size:24px;font-weight:500;line-height:24px}.section-header.page-heading{padding:20px 20px 10px}.main-section-body{color:#3c444d;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.main-section-body,.main-section-body>:first-child{-webkit-box-flex:1;-ms-flex-positive:1;flex-grow:1}.main-section-body h2 i[class*=" icon-"],.main-section-body h2 i[class^=icon-]{color:#6b7785}.main-section-body .divider{border-top:1px solid #c3cbd4;margin:0}.main-section-body>.pull-right{margin-right:20px}.main-section-body .loading-message{padding-top:100px;min-height:400px;text-align:center}.main-section-body .main-section{padding:0 20px}.main-section-body .card{background-color:#fff;-webkit-box-shadow:0 1px 1px #e1e6eb;box-shadow:0 1px 1px #e1e6eb}.container-full-width{padding:0}.push-margins{margin-left:-20px;margin-right:-20px}.hide-text{text-indent:100%;white-space:nowrap;overflow:hidden}.panel{position:relative;border:1px solid #c3cbd4;background-color:#fff;padding:20px;margin-right:20px;border-radius:2px}.panel:last-child{margin-right:0}.panel-row{padding:0 20px;margin-bottom:20px}.section-content{background-color:#fff;min-height:400px;border-top:1px solid #c3cbd4}.column{position:relative;padding:20px;margin-right:20px}.navSkip{position:absolute;margin:1px 0 0 10px;top:0;left:-1000px;width:150px;height:32px;text-align:center;line-height:32px;background-color:#171d21;color:#c3cbd4;z-index:1040}.navSkip:focus{left:0}.shared-paywall{padding-top:30px}.list-dotted{line-height:20px;margin-top:0}.list-dotted dt{float:left;width:120px;overflow:hidden;white-space:nowrap;margin-right:5px;font-weight:400;line-height:20px;word-wrap:normal}.list-dotted dt:after{content:" ............................................"}.list-dotted dd{line-height:20px;margin-left:125px}#placeholder-splunk-bar{padding:0;background-color:#171d21;text-rendering:geometricPrecision}#placeholder-splunk-bar .brand,#placeholder-splunk-bar .brand:hover{font-family:Splunk Icons;font-weight:400;color:#fff;padding:0 20px;height:34px;font-size:18px;line-height:34px;text-shadow:none;text-decoration:none;text-rendering:geometricPrecision;margin-left:0}#placeholder-splunk-bar .brand strong{color:#818d99;font-weight:400}#placeholder-splunk-bar .brand strong:after{content:"\AE";color:#818d99;font-weight:400}#placeholder-app-bar{color:#fff;background-color:#3c444d;height:44px}#placeholder-main-section-body{color:#3c444d;padding-top:100px;min-height:400px;text-align:center}@media print{.main-section-body,body{background:none!important}@page{margin:1.27cm}.navSkip{display:none!important}}.span1{width:60px}.span1,.span2{float:left;min-height:1px;margin-left:20px}.span2{width:140px}.span3{width:220px}.span3,.span4{float:left;min-height:1px;margin-left:20px}.span4{width:300px}.span5{width:380px}.span5,.span6{float:left;min-height:1px;margin-left:20px}.span6{width:460px}.span7{width:540px}.span7,.span8{float:left;min-height:1px;margin-left:20px}.span8{width:620px}.span9{width:700px}.span9,.span10{float:left;min-height:1px;margin-left:20px}.span10{width:780px}.span11{width:860px}.span11,.span12{float:left;min-height:1px;margin-left:20px}.span12{width:940px}.offset1{margin-left:100px}.offset2{margin-left:180px}.offset3{margin-left:260px}.offset4{margin-left:340px}.offset5{margin-left:420px}.offset6{margin-left:500px}.offset7{margin-left:580px}.offset8{margin-left:660px}.offset9{margin-left:740px}.offset10{margin-left:820px}.offset11{margin-left:900px}.offset12{margin-left:980px}.row{margin-left:-20px}.row:after,.row:before{display:table;content:"";line-height:0}.row:after{clear:both}.container,.navbar-fixed-bottom .container,.navbar-fixed-top .container,.navbar-static-top .container{width:940px}.row-fluid{width:100%}.row-fluid:after,.row-fluid:before{display:table;content:"";line-height:0}.row-fluid:after{clear:both}.row-fluid .span1{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:6.38298%;float:left;margin-left:2.127659574%}.row-fluid .span1:first-child{margin-left:0}.row-fluid .span2{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:14.89362%;float:left;margin-left:2.127659574%}.row-fluid .span2:first-child{margin-left:0}.row-fluid .span3{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:23.40426%;float:left;margin-left:2.127659574%}.row-fluid .span3:first-child{margin-left:0}.row-fluid .span4{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:31.91489%;float:left;margin-left:2.127659574%}.row-fluid .span4:first-child{margin-left:0}.row-fluid .span5{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:40.42553%;float:left;margin-left:2.127659574%}.row-fluid .span5:first-child{margin-left:0}.row-fluid .span6{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:48.93617%;float:left;margin-left:2.127659574%}.row-fluid .span6:first-child{margin-left:0}.row-fluid .span7{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:57.44681%;float:left;margin-left:2.127659574%}.row-fluid .span7:first-child{margin-left:0}.row-fluid .span8{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:65.95745%;float:left;margin-left:2.127659574%}.row-fluid .span8:first-child{margin-left:0}.row-fluid .span9{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:74.46809%;float:left;margin-left:2.127659574%}.row-fluid .span9:first-child{margin-left:0}.row-fluid .span10{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:82.97873%;float:left;margin-left:2.127659574%}.row-fluid .span10:first-child{margin-left:0}.row-fluid .span11{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:91.48937%;float:left;margin-left:2.127659574%}.row-fluid .span11:first-child{margin-left:0}.row-fluid .span12{display:block;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box;width:100%;float:left;margin-left:2.127659574%}.row-fluid .span12:first-child{margin-left:0}.row-fluid .offset1{margin-left:10.6383%}.row-fluid .offset2{margin-left:19.14894%}.row-fluid .offset3{margin-left:27.65958%}.row-fluid .offset4{margin-left:36.17021%}.row-fluid .offset5{margin-left:44.68085%}.row-fluid .offset6{margin-left:53.19149%}.row-fluid .offset7{margin-left:61.70213%}.row-fluid .offset8{margin-left:70.21277%}.row-fluid .offset9{margin-left:78.72341%}.row-fluid .offset10{margin-left:87.23405%}.row-fluid .offset11{margin-left:95.74469%}.row-fluid .offset12{margin-left:104.25532%}.row-fluid .controls-row [class*=span]+[class*=span]{margin-left:2.127659574%}.row-fluid [class*=span].hide,[class*=span].hide{display:none}.row-fluid [class*=span].pull-right,[class*=span].pull-right{float:right}.container{margin-right:auto;margin-left:auto}.container:after,.container:before{display:table;content:"";line-height:0}.container:after{clear:both}.container-fluid{padding-right:20px;padding-left:20px}.container-fluid:after,.container-fluid:before{display:table;content:"";line-height:0}.container-fluid:after{clear:both}@font-face{font-family:Splunk Platform Sans;src:url(/static/fonts/proxima-bold-webfont.woff) format("woff");font-weight:700;font-style:normal}@font-face{font-family:Splunk Platform Sans;src:url(/static/fonts/proxima-regular-webfont.woff) format("woff");font-weight:400;font-style:normal}@font-face{font-family:Splunk Platform Sans;src:url(/static/fonts/proxima-semibold-webfont.woff) format("woff");font-weight:500;font-style:normal}@font-face{font-family:Splunk Platform Mono;src:url(/static/fonts/inconsolata-regular.woff) format("woff");font-weight:400;font-style:normal}@font-face{font-family:Splunk Icons;src:url(/static/fonts/splunkicons-regular-webfont.woff) format("woff");font-weight:400;font-style:normal}p{margin:0 0 10px}.lead{margin-bottom:20px;font-size:21px;font-weight:200;line-height:30px}small{font-size:85%}strong{font-weight:700}em{font-style:italic}cite{font-style:normal}.text-left{text-align:left}.text-right{text-align:right}.text-center{text-align:center}.muted{color:#6b7785}a.muted:focus,a.muted:hover{color:#545e69}.text-warning{color:#f8be34}a.text-warning:focus,a.text-warning:hover{color:#f1ab09}.text-error{color:#dc4e41}a.text-error:focus,a.text-error:hover{color:#c63224}.text-info{color:#006d9c}a.text-info:focus,a.text-info:hover{color:#004b6b}.text-success{color:#53a051}a.text-success:focus,a.text-success:hover{color:#417d3f}.mono-space{font-family:Splunk Platform Mono,Inconsolata,Consolas,Droid Sans Mono,Monaco,Courier New,Courier,monospace}h1{margin:10px 0;font-size:24px;font-family:inherit;font-weight:500;line-height:20px;text-transform:none;color:#3c444d;text-rendering:optimizelegibility}h1 small{font-size:21.6px}h2{margin:10px 0;font-size:18px;font-family:inherit;font-weight:500;line-height:20px;text-transform:none;color:#3c444d;text-rendering:optimizelegibility}h2 small{font-size:16.2px}h3{margin:10px 0;font-size:16px;font-family:inherit;font-weight:500;line-height:20px;text-transform:none;color:#3c444d;text-rendering:optimizelegibility}h3 small{font-size:14px}h4{font-size:14px}h4,h5{margin:10px 0;font-family:inherit;font-weight:500;line-height:20px;text-transform:none;color:#3c444d;text-rendering:optimizelegibility}h5{font-size:18px;font-size:12px}h6{margin:10px 0;font-size:18px;text-transform:none;color:#3c444d;font-size:11px}.section-heading,h6{font-family:inherit;font-weight:500;line-height:20px;text-rendering:optimizelegibility}.section-heading{font-size:14px}.section-heading,.section-heading-small{margin:5px 0;text-transform:uppercase;color:#5c6773}.section-heading-small{font-size:12px;font-family:inherit;font-weight:500;line-height:20px;text-rendering:optimizelegibility}.page-header{padding-bottom:9px;margin:20px 0 30px;border-bottom:1px solid #e1e6eb}ol,ul{padding:0;margin:0 0 10px 25px}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}ol.inline,ol.unstyled,ul.inline,ul.unstyled{margin-left:0;list-style:none}ol.inline>li,ul.inline>li{display:inline-block;padding-left:5px;padding-right:5px}li{line-height:20px}dl{margin-bottom:20px}dd,dt{line-height:20px}dt{font-weight:700}dd{margin-left:10px}.dl-horizontal:after,.dl-horizontal:before{display:table;content:"";line-height:0}.dl-horizontal:after{clear:both}.dl-horizontal dt{float:left;width:160px;clear:left;text-align:right;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dl-horizontal dd{margin-left:180px}hr{margin:20px 0;border:0;border-top:1px solid #e1e6eb;border-bottom:1px solid #fff}abbr[data-original-title],abbr[title]{cursor:help;border-bottom:1px dotted #818d99}abbr.initialism{font-size:90%;text-transform:uppercase}blockquote{padding:0 0 0 15px;margin:0 0 20px;border-left:5px solid #e1e6eb}blockquote p{margin-bottom:0;font-size:17.5px;font-weight:300;line-height:1.25}blockquote small{display:block;line-height:20px;color:#818d99}blockquote small:before{content:"\2014 \A0"}blockquote.pull-right{float:right;padding-right:15px;padding-left:0;border-right:5px solid #e1e6eb;border-left:0}blockquote.pull-right p,blockquote.pull-right small{text-align:right}blockquote.pull-right small:before{content:""}blockquote.pull-right small:after{content:"\A0 \2014"}blockquote:after,blockquote:before,q:after,q:before{content:""}address{display:block;margin-bottom:20px;font-style:normal;line-height:20px}code,pre{font-family:Splunk Platform Mono,Inconsolata,Consolas,Droid Sans Mono,Monaco,Courier New,Courier,monospace;border-radius:3px}code{padding:2px 4px;color:#d14;background-color:#f7f7f9;border:1px solid #e1e1e8;white-space:nowrap;font-size:12px}pre{display:block;padding:9.5px;margin:0 0 10px;font-size:13px;color:#3c444d;line-height:20px;word-break:break-all;word-wrap:break-word;white-space:pre;white-space:pre-wrap;background-color:#f5f5f5;border:1px solid rgba(0,0,0,.15)}pre.prettyprint{margin-bottom:20px}pre code{padding:0;color:inherit;white-space:pre;white-space:pre-wrap;background-color:transparent;border:0}.pre-scrollable{max-height:340px;overflow-y:scroll}form,form:last-child{margin:0 0 20px}fieldset{margin:0}fieldset,legend{padding:0;border:0}legend{display:block;width:100%;margin-bottom:20px;font-size:15px;line-height:40px;color:#3c444d;border-bottom:1px solid #e5e5e5}legend small{font-size:15px;color:#818d99}button,input,label,select,textarea{font-size:14px;font-weight:400;line-height:20px}button,input,select,textarea{font-family:Splunk Platform Sans,Proxima Nova,Roboto,Droid,Helvetica Neue,Helvetica,Arial,sans-serif}label{display:block;margin-bottom:5px;cursor:default}.uneditable-input,input[type=color],input[type=date],input[type=datetime-local],input[type=datetime],input[type=email],input[type=month],input[type=number],input[type=password],input[type=search],input[type=tel],input[type=text],input[type=time],input[type=url],input[type=week],select,textarea{display:inline-block;padding:5px 8px;height:32px;line-height:20px;font-size:14px;-webkit-box-sizing:border-box;box-sizing:border-box;margin-bottom:10px;color:#5c6773;border-radius:3px;vertical-align:middle}.uneditable-input,input,textarea{width:206px;-webkit-box-sizing:border-box;box-sizing:border-box}textarea{height:auto}.uneditable-input,input[type=color],input[type=date],input[type=datetime-local],input[type=datetime],input[type=email],input[type=month],input[type=number],input[type=password],input[type=search],input[type=tel],input[type=text],input[type=time],input[type=url],input[type=week],textarea{background-color:#fff;border:1px solid #c3cbd4;-webkit-transition:border .2s,-webkit-box-shadow .2s;transition:border .2s,-webkit-box-shadow .2s;transition:border .2s,box-shadow .2s;transition:border .2s,box-shadow .2s,-webkit-box-shadow .2s}.uneditable-input:focus,input[type=color]:focus,input[type=date]:focus,input[type=datetime-local]:focus,input[type=datetime]:focus,input[type=email]:focus,input[type=month]:focus,input[type=number]:focus,input[type=password]:focus,input[type=search]:focus,input[type=tel]:focus,input[type=text]:focus,input[type=time]:focus,input[type=url]:focus,input[type=week]:focus,textarea:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none;z-index:3}.uneditable-input:focus:active:not([disabled]),input[type=color]:focus:active:not([disabled]),input[type=date]:focus:active:not([disabled]),input[type=datetime-local]:focus:active:not([disabled]),input[type=datetime]:focus:active:not([disabled]),input[type=email]:focus:active:not([disabled]),input[type=month]:focus:active:not([disabled]),input[type=number]:focus:active:not([disabled]),input[type=password]:focus:active:not([disabled]),input[type=search]:focus:active:not([disabled]),input[type=tel]:focus:active:not([disabled]),input[type=text]:focus:active:not([disabled]),input[type=time]:focus:active:not([disabled]),input[type=url]:focus:active:not([disabled]),input[type=week]:focus:active:not([disabled]),textarea:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.uneditable-input.text-clear,input[type=color].text-clear,input[type=date].text-clear,input[type=datetime-local].text-clear,input[type=datetime].text-clear,input[type=email].text-clear,input[type=month].text-clear,input[type=number].text-clear,input[type=password].text-clear,input[type=search].text-clear,input[type=tel].text-clear,input[type=text].text-clear,input[type=time].text-clear,input[type=url].text-clear,input[type=week].text-clear,textarea.text-clear{padding-right:28px}.uneditable-input.text-clear::-ms-clear,input[type=color].text-clear::-ms-clear,input[type=date].text-clear::-ms-clear,input[type=datetime-local].text-clear::-ms-clear,input[type=datetime].text-clear::-ms-clear,input[type=email].text-clear::-ms-clear,input[type=month].text-clear::-ms-clear,input[type=number].text-clear::-ms-clear,input[type=password].text-clear::-ms-clear,input[type=search].text-clear::-ms-clear,input[type=tel].text-clear::-ms-clear,input[type=text].text-clear::-ms-clear,input[type=time].text-clear::-ms-clear,input[type=url].text-clear::-ms-clear,input[type=week].text-clear::-ms-clear,textarea.text-clear::-ms-clear{display:none;width:0;height:0}input[type=checkbox],input[type=radio]{margin:4px 0 0;margin-top:1px\9;line-height:normal}input[type=button],input[type=checkbox],input[type=file],input[type=image],input[type=radio],input[type=reset],input[type=submit]{width:auto}input[type=file],select{height:32px;line-height:32px}select{width:220px;border:1px solid #c3cbd4;background-color:#fff}select[multiple],select[size]{height:auto}input[type=checkbox]:focus,input[type=file]:focus,input[type=radio]:focus,select:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}input[type=checkbox]:focus:active:not([disabled]),input[type=file]:focus:active:not([disabled]),input[type=radio]:focus:active:not([disabled]),select:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}input[type=radio]:focus{border-radius:100%}.uneditable-input,.uneditable-textarea{color:#c3cbd4;background-color:#f7f8fa;border-color:#e1e6eb;-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,.025);box-shadow:inset 0 1px 2px rgba(0,0,0,.025);cursor:not-allowed}.uneditable-input{overflow:hidden;white-space:nowrap}.uneditable-textarea{width:auto;height:auto}textarea{min-height:2em;resize:vertical}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#6b7785;opacity:1}input:-ms-input-placeholder,textarea:-ms-input-placeholder{color:#6b7785;opacity:1}input::-ms-input-placeholder,textarea::-ms-input-placeholder{color:#6b7785;opacity:1}input::placeholder,textarea::placeholder{color:#6b7785;opacity:1}.checkbox,.radio{min-height:20px;padding-left:20px}.checkbox input[type=checkbox],.radio input[type=radio]{float:left;margin-left:-20px}.radio input[type=radio]{border-radius:100%}.controls>.checkbox:first-child,.controls>.radio:first-child{padding-top:5px}.checkbox.inline,.radio.inline{display:inline-block;padding-top:5px;margin-bottom:0;vertical-align:middle}.checkbox.inline+.checkbox.inline,.radio.inline+.radio.inline{margin-left:10px}input[disabled],input[readonly],select[disabled],select[readonly],textarea[disabled],textarea[readonly]{cursor:not-allowed;background-color:#f7f8fa;border-color:#e1e6eb;color:#c3cbd4}input[type=checkbox][disabled],input[type=checkbox][readonly],input[type=radio][disabled],input[type=radio][readonly]{background-color:#f7f8fa}.control-group.warning .checkbox,.control-group.warning .control-label,.control-group.warning .help-block,.control-group.warning .help-inline,.control-group.warning .radio{color:#f8be34}.control-group.warning input,.control-group.warning select,.control-group.warning textarea{color:#f8be34;border-color:#f8be34;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075)}.control-group.warning input:focus,.control-group.warning select:focus,.control-group.warning textarea:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none;z-index:3}.control-group.warning input:focus:active:not([disabled]),.control-group.warning select:focus:active:not([disabled]),.control-group.warning textarea:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.control-group.warning .input-append .add-on,.control-group.warning .input-prepend .add-on{color:#f8be34;background-color:#fef2d7;border-color:#f8be34}.control-group.error .checkbox,.control-group.error .control-label,.control-group.error .help-block,.control-group.error .help-inline,.control-group.error .radio{color:#dc4e41}.control-group.error input,.control-group.error select,.control-group.error textarea{color:#dc4e41;border-color:#dc4e41;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075)}.control-group.error input:focus,.control-group.error select:focus,.control-group.error textarea:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none;z-index:3}.control-group.error input:focus:active:not([disabled]),.control-group.error select:focus:active:not([disabled]),.control-group.error textarea:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.control-group.error .input-append .add-on,.control-group.error .input-prepend .add-on{color:#dc4e41;background-color:#f8dcd9;border-color:#dc4e41}.control-group.success .checkbox,.control-group.success .control-label,.control-group.success .help-block,.control-group.success .help-inline,.control-group.success .radio{color:#53a051}.control-group.success input,.control-group.success select,.control-group.success textarea{color:#53a051;border-color:#53a051;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075)}.control-group.success input:focus,.control-group.success select:focus,.control-group.success textarea:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none;z-index:3}.control-group.success input:focus:active:not([disabled]),.control-group.success select:focus:active:not([disabled]),.control-group.success textarea:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.control-group.success .input-append .add-on,.control-group.success .input-prepend .add-on{color:#53a051;background-color:#ddecdd;border-color:#53a051}.control-group.info .checkbox,.control-group.info .control-label,.control-group.info .help-block,.control-group.info .help-inline,.control-group.info .radio{color:#006d9c}.control-group.info input,.control-group.info select,.control-group.info textarea{color:#006d9c;border-color:#006d9c;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,.075);box-shadow:inset 0 1px 1px rgba(0,0,0,.075)}.control-group.info input:focus,.control-group.info select:focus,.control-group.info textarea:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none;z-index:3}.control-group.info input:focus:active:not([disabled]),.control-group.info select:focus:active:not([disabled]),.control-group.info textarea:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.control-group.info .input-append .add-on,.control-group.info .input-prepend .add-on{color:#006d9c;background-color:#cce2eb;border-color:#006d9c}input:focus:invalid,select:focus:invalid,textarea:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,select:focus:invalid:focus,textarea:focus:invalid:focus{border-color:#e9352f;-webkit-box-shadow:0 0 6px #f8bcba;box-shadow:0 0 6px #f8bcba}.form-actions{padding:19px 20px 20px;margin-top:20px;margin-bottom:20px;background-color:#f7f8fa;border-top:1px solid #e5e5e5}.form-actions:after,.form-actions:before{display:table;content:"";line-height:0}.form-actions:after{clear:both}.help-block,.help-inline{color:#6b7785}.help-block>.help-link,.help-block>.learn-more-link,.help-inline>.help-link,.help-inline>.learn-more-link{white-space:nowrap}.help-block{display:block;margin-top:3px;margin-bottom:10px;line-height:1.4em;font-size:12px;word-wrap:break-word}.help-inline{display:inline-block;vertical-align:middle;padding-left:5px}input.search-query{margin-bottom:0;-webkit-transition:background-color .2s;transition:background-color .2s}.form-horizontal .uneditable-input,.form-horizontal input,.form-horizontal select,.form-horizontal textarea,.form-inline .uneditable-input,.form-inline input,.form-inline select,.form-inline textarea,.form-search .uneditable-input,.form-search input,.form-search select,.form-search textarea{display:inline-block;margin-bottom:0;vertical-align:middle}.form-horizontal .hide,.form-inline .hide,.form-search .hide{display:none}.form-inline .btn-group,.form-inline label,.form-search .btn-group,.form-search label{display:inline-block}.form-inline .checkbox,.form-inline .radio,.form-search .checkbox,.form-search .radio{padding-left:0;margin-bottom:0;vertical-align:middle}.form-inline .checkbox input[type=checkbox],.form-inline .radio input[type=radio],.form-search .checkbox input[type=checkbox],.form-search .radio input[type=radio]{float:left;margin-right:3px;margin-left:0}.control-group{margin-bottom:10px;position:relative}.control-group.disabled .control-label{color:#c3cbd4;cursor:default}.control-group .tooltip-link{top:-.5em;position:relative;font-size:75%;line-height:0;vertical-align:baseline;margin:0 2px;padding:2px;cursor:default;font-weight:400}legend:not(.visuallyhidden)+.control-group{margin-top:20px;-webkit-margin-top-collapse:separate}.form-horizontal{width:600px;max-width:100%}.form-horizontal .control-group{margin-bottom:10px}.form-horizontal .control-group:after,.form-horizontal .control-group:before{display:table;content:"";line-height:0}.form-horizontal .control-group:after{clear:both}.form-horizontal .control-label{float:left;width:160px;padding-top:5px;text-align:right}.form-horizontal .controls{margin-left:180px}.form-horizontal .controls>.help-block{margin-left:0}.form-horizontal .help-block{margin-bottom:0;margin-left:180px}.form-horizontal .uneditable-input+.help-block,.form-horizontal input+.help-block,.form-horizontal select+.help-block,.form-horizontal textarea+.help-block{margin-top:10px}.form-horizontal .form-actions{padding-left:180px}.form-inline label{line-height:28px}.form-inline .form-value{line-height:28px;margin-right:15px}.form-inline input{width:auto;margin-right:15px}.controls .shared-controls-booleanradiocontrol,.controls .shared-controls-syntheticradiocontrol{display:-webkit-box;display:-ms-flexbox;display:flex;width:100%}.controls .shared-controls-booleanradiocontrol>.btn,.controls .shared-controls-syntheticradiocontrol>.btn{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto}.controls-join{display:-webkit-box;display:-ms-flexbox;display:flex}.controls-join .control:not(:only-child){-webkit-box-flex:1;-ms-flex:1 0 0px;flex:1 0 0px;max-width:100%}.controls-join .control:only-child{width:100%}.controls-join .shared-controls-textcontrol{-webkit-box-flex:0;-ms-flex:0 1 100%;flex:0 1 100%;min-width:30%}.controls-join .control:nth-last-child(n+3)~.shared-controls-textcontrol,.controls-join .shared-controls-textcontrol:nth-last-child(n+3){min-width:48px}.controls-join .shared-controls-syntheticselectcontrol:not(:last-child) .btn,.controls-join .shared-controls-textcontrol:not(:last-child) .uneditable-input,.controls-join .shared-controls-textcontrol:not(:last-child) input{border-top-right-radius:0;border-bottom-right-radius:0}.controls-join .shared-controls-syntheticselectcontrol:not(:first-child) .btn,.controls-join .shared-controls-textcontrol:not(:first-child) .uneditable-input,.controls-join .shared-controls-textcontrol:not(:first-child) input{border-top-left-radius:0;border-bottom-left-radius:0;border-left:none}.controls-join .shared-controls-syntheticselectcontrol .btn,.controls-join .uneditable-input,.controls-join input,.controls-join select,.controls-join textarea{width:100%}.controls-join input[type=button],.controls-join input[type=checkbox],.controls-join input[type=file],.controls-join input[type=image],.controls-join input[type=radio],.controls-join input[type=reset],.controls-join input[type=submit]{width:auto}.controls-wrap{-ms-flex-wrap:wrap;flex-wrap:wrap}.controls-separate,.controls-wrap{display:-webkit-box;display:-ms-flexbox;display:flex}.controls-separate .control+.control{margin-left:10px}.controls-stack{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.control{position:relative}.control .placeholder{color:#6b7785;position:absolute;max-width:100%;top:3px;left:6px;font-size:14px}.control ::-webkit-input-placeholder{color:#6b7785;opacity:1}.control :-ms-input-placeholder{color:#6b7785;opacity:1}.control ::-ms-input-placeholder{color:#6b7785;opacity:1}.control ::placeholder{color:#6b7785;opacity:1}.control .uneditable-input{background-color:#f7f8fa;min-height:32px}.control .uneditable-input.uneditable-input-multiline{overflow-y:auto;white-space:normal;white-space:pre-wrap;word-break:break-all;word-break:break-word;height:auto;max-height:100px}.control.shared-controls-textcontrol .control-clear,.control.shared-controls-textcontrol .search-icon{position:absolute;top:calc(50% + 1px);-webkit-transform:translateY(-50%);transform:translateY(-50%);right:10px;font-size:18px;color:#6b7785}.control.shared-controls-textcontrol .control-clear{display:none}.control.shared-controls-textcontrol>input{width:100%}.control.shared-controls-spinnercontrol{text-align:center}.control.shared-controls-spinnercontrol .uneditable-input,.control.shared-controls-spinnercontrol input{display:block;padding:4px 65px 4px 6px;-webkit-transition:border .2s,-webkit-box-shadow .2s;transition:border .2s,-webkit-box-shadow .2s;transition:border .2s,box-shadow .2s;transition:border .2s,box-shadow .2s,-webkit-box-shadow .2s}.control.shared-controls-spinnercontrol input.corrected-value{border-color:#dc4e41;-webkit-box-shadow:#fcedec 0 0 8px 0;box-shadow:0 0 8px 0 #fcedec}.control.shared-controls-spinnercontrol .increment-down,.control.shared-controls-spinnercontrol .increment-up{position:absolute;right:1px;top:1px;width:30px;line-height:30px}.control.shared-controls-spinnercontrol .increment-down:focus,.control.shared-controls-spinnercontrol .increment-up:focus{background-color:rgba(0,164,253,.1);-webkit-box-shadow:none;box-shadow:none;outline:none}.control.shared-controls-spinnercontrol .increment-down.disabled,.control.shared-controls-spinnercontrol .increment-up.disabled{color:#c3cbd4}.control.shared-controls-spinnercontrol .increment-down{right:31px}.control.shared-findinput{display:inline-block;margin:5px 0}.control.shared-findinput input{width:250px}.input-label{display:inline-block;padding:8px 0 4px;height:auto;line-height:15px;font-size:14px;-webkit-box-sizing:border-box;box-sizing:border-box;max-width:100%;word-wrap:break-word;word-break:break-word;font-weight:500}label.checkbox{padding:2px 0 2px 21px;margin-bottom:0;position:relative}label.checkbox.disabled{color:#c3cbd4}label.checkbox>.btn{padding:0;width:16px;height:16px;border-radius:2px;position:absolute;left:0;top:3px}label.checkbox>.btn>[class*=icon-]{margin:0;position:relative;bottom:6px;vertical-align:text-top}.control-group-small .control-label,.control-small{font-size:12px}.control-small .uneditable-input,.control-small input[type=text],.control-small textarea{padding-top:2px;padding-bottom:2px;font-size:inherit}.control-small .uneditable-input,.control-small input[type=text]{height:26px}.control-small .uneditable-input{min-height:16px}.control-small .btn,.control-small.btn-group>.btn{padding-top:2px;padding-bottom:2px;font-size:12px}.control-small.shared-controls-spinnercontrol .uneditable-input,.control-small.shared-controls-spinnercontrol input{padding-right:55px}.control-small.shared-controls-spinnercontrol .increment-down,.control-small.shared-controls-spinnercontrol .increment-up{width:24px;line-height:24px}.control-small.shared-controls-spinnercontrol .increment-down{right:25px}.shared-controls-checkboxgroup label.checkbox{padding-top:2px;padding-bottom:2px}.control-group>.controls>.shared-controls-syntheticcheckboxcontrol:only-child{padding-top:4px}.shared-controls-keyvaluecontrol .shared-controls-textcontrol{margin-right:10px}.shared-controls-keyvaluecontrol .key-text-control-placeholder,.shared-controls-keyvaluecontrol .value-text-control-placeholder{float:left}.accumulator{width:700px}.controls-join .accumulator{width:100%}.accumulator .availableOptionsContainer,.accumulator .selectedOptionsContainer{float:left;width:calc(50% - 10px);margin:0 20px 0 0}.accumulator .addAllLink,.accumulator .removeAllLink{float:right}.accumulator .selectedOptionsContainer{margin-right:0}.accumulator .availableOptionsHeader{font-weight:400;font-size:14px;width:200px;margin-right:22px;padding-bottom:5px;line-height:0}.accumulator .selectedOptionsHeader{width:200px;margin-right:0}.accumulator ul.availableOptions,.accumulator ul.selectedOptions{border-radius:3px;height:100px;overflow:auto;list-style:none;margin:0;padding:0;border:1px solid #c3cbd4;clear:left}.accumulator .accDisabled ul.availableOptions,.accumulator .accDisabled ul.selectedOptions{background-color:#f7f8fa}.accumulator ul.availableOptions li,.accumulator ul.selectedOptions li{clear:left;padding:4px 5px;font-size:14px;cursor:pointer;line-height:1}.accumulator ul.availableOptions li:hover,.accumulator ul.selectedOptions li:hover{background-color:#f7f8fa}.accumulator ul.availableOptions li span,.accumulator ul.selectedOptions li span{margin:0 8px 0 0;display:block;float:left}.accumulator ul span.splIcon-arrow-e{background-color:#007abd}.accumulator .accDisabled ul li,.accumulator ul.availableOptions li.selected{color:#6b7785}.accumulator .accDisabled ul li span.splIcon,.accumulator ul.availableOptions li.selected span.splIcon{background-color:#c3cbd4}.accumulator .selected{background-color:transparent}.control-group.error .accumulator ul{border-color:#dc4e41}.accumulator .icon-class{color:#6b7785}.accumulator div.wide{width:340px}table.form td{padding-right:10px;padding-bottom:5px}table.form tr:last-child td{padding-bottom:0}table.form tr:last-child .help-block{margin-bottom:0}.form-format .control-label{width:100px}.form-format .control-group:last-child{margin-bottom:0}.form-format .controls{margin-left:120px}.form-horizontal.align-left .control-label{width:auto;text-align:left;display:inline-block;float:none}.form-horizontal.align-left .controls{margin-left:15px;display:inline-block}.shared-controls-textcontrol.input-prepend{display:-webkit-box;display:-ms-flexbox;display:flex}.shared-controls-textcontrol.input-prepend .uneditable-input,.shared-controls-textcontrol.input-prepend>input{border-top-left-radius:0;border-bottom-left-radius:0;-webkit-box-flex:1;-ms-flex:1 0 auto;flex:1 0 auto;width:0}.shared-controls-textcontrol.input-prepend>.btn:first-child{border-top-right-radius:0;border-bottom-right-radius:0;border-right:none}.shared-controls-textbrowsecontrol,.shared-controls-textcontrol.input-append{display:-webkit-box;display:-ms-flexbox;display:flex}.shared-controls-textbrowsecontrol .uneditable-input,.shared-controls-textbrowsecontrol>input,.shared-controls-textcontrol.input-append .uneditable-input,.shared-controls-textcontrol.input-append>input{border-top-right-radius:0;border-bottom-right-radius:0;-webkit-box-flex:1;-ms-flex:1 0 auto;flex:1 0 auto;width:0}.shared-controls-textbrowsecontrol .uneditable-input+.btn,.shared-controls-textbrowsecontrol>input+.btn,.shared-controls-textcontrol.input-append .uneditable-input+.btn,.shared-controls-textcontrol.input-append>input+.btn{border-top-left-radius:0;border-bottom-left-radius:0;border-left:none}.shared-controls-textbrowsecontrol .add-on,.shared-controls-textcontrol.input-append .add-on{display:inline-block;height:auto;line-height:20px;font-size:14px;-webkit-box-sizing:border-box;box-sizing:border-box;padding:5px 14px;margin-bottom:0;font-weight:400;text-align:center;vertical-align:middle;border-top-right-radius:3px;border-bottom-right-radius:3px;background-color:#f7f8fa;border:1px solid #c3cbd4;border-left:#c3cbd4;color:#5c6773;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.shared-controls-textbrowsecontrol .add-on[disabled],.shared-controls-textcontrol.input-append .add-on[disabled]{color:#c3cbd4;border-color:#e1e6eb;cursor:not-allowed}.form-complex{width:100%}.form-complex .controls{position:relative}.form-complex .control-group{width:440px}.form-complex .control-heading{padding-top:5px;text-align:right;width:160px;font-weight:700}.form-complex .help-block,.form-complex .help-outer{position:absolute;top:4px;left:100%;margin-left:10px;margin-top:0!important;width:280px}.form-complex .outline{border:1px solid #c3cbd4;border-radius:3px;margin-bottom:10px;margin-top:0;padding-top:10px}.form-complex fieldset{border:1px solid transparent}.form-complex .btn-check{display:inline-block;padding:0;height:auto;line-height:20px;font-size:14px;-webkit-box-sizing:border-box;box-sizing:border-box;text-align:center;vertical-align:middle;width:20px}.form-complex .control-feedback{display:block;width:100%}.control-feedback{color:#5c6773;background-color:#fff;border-radius:3px;font-size:85%;text-align:center;margin-top:3px}.shared-controls-syntheticradiocontrol>.tooltip{white-space:normal}.shared-controls-syntheticradiocontrol .btn-radio{-webkit-animation:none 0s ease 0s 1 normal none running;animation:none 0s ease 0s 1 normal none running;-webkit-backface-visibility:visible;backface-visibility:visible;background:transparent none repeat 0 0/auto auto padding-box border-box scroll;border-collapse:separate;-o-border-image:none;border-image:none;border-radius:0;border-spacing:0;bottom:auto;-webkit-box-shadow:none;box-shadow:none;-webkit-box-sizing:content-box;box-sizing:content-box;caption-side:top;clear:none;clip:auto;color:#000;-webkit-columns:auto;-webkit-column-count:auto;-webkit-column-fill:balance;column-fill:balance;-webkit-column-gap:normal;column-gap:normal;-webkit-column-rule:medium none currentColor;column-rule:medium none currentColor;-webkit-column-span:1;column-span:1;-webkit-column-width:auto;columns:auto;content:normal;counter-increment:none;counter-reset:none;cursor:auto;direction:ltr;display:inline;empty-cells:show;float:none;font-family:serif;font-size:medium;font-style:normal;font-variant:normal;font-weight:400;font-stretch:normal;line-height:normal;height:auto;-webkit-hyphens:none;-ms-hyphens:none;hyphens:none;left:auto;letter-spacing:normal;list-style:disc outside none;margin:0;max-height:none;max-width:none;min-height:0;min-width:0;opacity:1;orphans:2;overflow:visible;overflow-x:visible;overflow-y:visible;page-break-after:auto;page-break-before:auto;page-break-inside:auto;-webkit-perspective:none;perspective:none;-webkit-perspective-origin:50% 50%;perspective-origin:50% 50%;position:static;right:auto;-moz-tab-size:8;-o-tab-size:8;tab-size:8;table-layout:auto;text-align:left;text-align-last:auto;text-indent:0;text-shadow:none;text-transform:none;top:auto;-webkit-transform:none;transform:none;-webkit-transform-origin:50% 50% 0;transform-origin:50% 50% 0;-webkit-transform-style:flat;transform-style:flat;-webkit-transition:none 0s ease 0s;transition:none 0s ease 0s;unicode-bidi:normal;vertical-align:baseline;visibility:visible;white-space:normal;widows:2;width:auto;word-spacing:normal;z-index:auto;font-family:Splunk Platform Sans,Proxima Nova,Roboto,Droid,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;-webkit-box-sizing:border-box;box-sizing:border-box;display:block;border:1px;visibility:inherit;outline:medium none #00a4fd;outline:medium none invert;position:relative;padding:3px 0 3px 20px;color:#3c444d;text-decoration:none}.shared-controls-syntheticradiocontrol .btn-radio:before{content:"";background-color:#f7f8fa;border:1px solid #c3cbd4;color:#5c6773;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none;position:absolute;left:0;top:4px;-webkit-box-sizing:border-box;box-sizing:border-box;width:16px;height:16px;border-radius:8px}.shared-controls-syntheticradiocontrol .btn-radio.disabled{cursor:not-allowed;color:#c3cbd4;opacity:.65}.shared-controls-syntheticradiocontrol .btn-radio.disabled:before{background:#f7f8fa;-webkit-filter:none;filter:none;border-color:#e1e6eb}.shared-controls-syntheticradiocontrol .btn-radio:not(.disabled):hover:before{background-color:#ebeeef;border-color:#c3cbd4;color:#5c6773;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.shared-controls-syntheticradiocontrol .btn-radio:focus:before{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.shared-controls-syntheticradiocontrol .btn-radio:focus:before:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.shared-controls-syntheticradiocontrol .btn-radio.active:after{content:"";position:absolute;left:4px;top:8px;-webkit-box-sizing:border-box;box-sizing:border-box;width:8px;height:8px;border-radius:4px;background-color:currentColor}.radio-control-list{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.error .btn{background-color:#f1b9b3;border-color:#dc4e41;color:#dc4e41;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.error .btn.active{background-image:none}.error .btn.active,.error .btn:hover{background-color:#ea958d;border-color:#dc4e41;color:#dc4e41;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.required{color:#dc4e41}.color-square{display:block;width:32px;height:32px;background:#53a051;border:1px solid #c3cbd4;border-radius:2px;-webkit-box-sizing:border-box;box-sizing:border-box}.color-square:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.color-square:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.color-square-standalone{margin-top:3px}table{max-width:100%;background-color:transparent;border-collapse:collapse;border-spacing:0}.table{width:auto;min-width:100%;max-width:none;margin-bottom:20px}.table td,.table th{text-align:left;vertical-align:top;padding:6px 12px;line-height:20px;border-bottom:1px solid #e1e6eb}.table td td:focus,.table th td:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd}.table td td:focus:active:not([disabled]),.table th td:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.table td .tooltip-link,.table th .tooltip-link{top:-.5em;position:relative;font-size:75%;line-height:0;vertical-align:baseline;cursor:default;font-weight:400}.table th div{padding:6px 12px}.table thead th{vertical-align:bottom}.table caption+thead tr:first-child td,.table caption+thead tr:first-child th,.table colgroup+thead tr:first-child td,.table colgroup+thead tr:first-child th,.table thead:first-child tr:first-child td,.table thead:first-child tr:first-child th{border-top:0}.table tbody+tbody{border-top:2px solid #e1e6eb}.table .sorts{white-space:nowrap;cursor:pointer}.table .sorts a{color:inherit}.table .sorts a:hover{text-decoration:none}.table .sorts:hover{color:#006eaa}.table .sorts .icon-sorts:before{font-family:Splunk Icons;content:"\2195";padding-left:5px;color:#818d99}.table .sorts.active .icon-sorts:before{color:#006eaa}.table .sorts .asc:before,.table .sorts .Asc:before{content:"\21A5";color:inherit}.table .sorts .desc:before,.table .sorts .Desc:before{content:"\21A7";color:inherit}.table .sorts[tabindex]:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #e1e6eb,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #e1e6eb,inset 0 0 0 2px #00a4fd}.table .sorts[tabindex]:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.table .table{background-color:transparent}.table-condensed td,.table-condensed th{padding:3px 6px}.table-bordered{border:1px solid #e1e6eb;border-collapse:separate;border-left:0}.table-bordered-lite td,.table-bordered-lite th,.table-bordered td,.table-bordered th{border-left:1px solid #e1e6eb}.table-bordered-lite td:first-child,.table-bordered-lite th:first-child{border-left:none}.table-dotted td,.table-dotted th{border-top:1px dashed #c3cbd4}.table-striped>thead>tr>th{background-color:#fff;border-top:1px solid #e1e6eb}.table-striped>tbody>tr:nth-child(odd)>td,.table-striped>tbody>tr:nth-child(odd)>th{background-color:#f2f4f5}.table-striped>tbody>tr:nth-child(2n)>td{background-color:#fff}.table-striped>tbody>tr.odd>td,.table-striped>tbody>tr.odd>th{background-color:#f2f4f5}.table-striped>tbody>tr.even>td,.table-striped>tbody>tr.even>th{background-color:#fff}.table-striped>tbody>tr>td{border:none}.table-striped.table-chrome>tbody>tr.even>td,.table-striped.table-chrome>tbody>tr:nth-child(2n)>td,.table-striped.table-chrome>tbody>tr:nth-child(odd).even>td{background-color:#f2f4f5}.table-striped.table-chrome>tbody>tr.odd>td,.table-striped.table-chrome>tbody>tr:nth-child(2n).odd>td,.table-striped.table-chrome>tbody>tr:nth-child(odd)>td{background-color:#fff}.table-chrome,.table-chrome.table-row-expanding{border:none}.table-chrome>thead>tr>th{font-weight:400;background-color:#e1e6eb;border-right:1px solid #fff;border-bottom:none;-webkit-box-shadow:none;box-shadow:none}.table-chrome>thead>tr>th:last-child{border-right:none}.table-chrome .sorts{border-bottom:none}@media screen and (-webkit-min-device-pixel-ratio:0){.table-chrome>thead>tr>th{position:relative}}.table-hover>tbody>tr>td,.table-hover>tbody>tr>th{-webkit-transition:background .05s;transition:background .05s}.table-hover>tbody>tr:hover>td,.table-hover>tbody>tr:hover>th{background-color:#ecf8ff!important}.row-fluid table td[class*=span],.row-fluid table th[class*=span],table td[class*=span],table th[class*=span]{display:table-cell;float:none;margin-left:0}.table td.span1,.table th.span1{float:none;width:44px;margin-left:0}.table td.span2,.table th.span2{float:none;width:124px;margin-left:0}.table td.span3,.table th.span3{float:none;width:204px;margin-left:0}.table td.span4,.table th.span4{float:none;width:284px;margin-left:0}.table td.span5,.table th.span5{float:none;width:364px;margin-left:0}.table td.span6,.table th.span6{float:none;width:444px;margin-left:0}.table td.span7,.table th.span7{float:none;width:524px;margin-left:0}.table td.span8,.table th.span8{float:none;width:604px;margin-left:0}.table td.span9,.table th.span9{float:none;width:684px;margin-left:0}.table td.span10,.table th.span10{float:none;width:764px;margin-left:0}.table td.span11,.table th.span11{float:none;width:844px;margin-left:0}.table td.span12,.table th.span12{float:none;width:924px;margin-left:0}.table>tbody>tr.even>td:focus,.table>tbody>tr.odd>td:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd}.table>tbody>tr.even>td:focus:active:not([disabled]),.table>tbody>tr.odd>td:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.table>tbody>tr.even:focus,.table>tbody>tr.odd:focus,.table>tbody>tr:focus{outline:none}.table>tbody>tr.even:focus>td,.table>tbody>tr.odd:focus>td,.table>tbody>tr:focus>td{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd}.table>tbody>tr.even:focus>td:active:not([disabled]),.table>tbody>tr.odd:focus>td:active:not([disabled]),.table>tbody>tr:focus>td:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.table tbody tr.success>td{background-color:#ddecdd}.table tbody tr.error>td{background-color:#f8dcd9}.table tbody tr.warning>td{background-color:#fef2d7}.table tbody tr.info>td{background-color:#cce2eb}.table-hover tbody tr.success:hover>td{background-color:#cee3ce}.table-hover tbody tr.error:hover>td{background-color:#f4c8c3}.table-hover tbody tr.warning:hover>td{background-color:#fdeabe}.table-hover tbody tr.info:hover>td{background-color:#b9d8e4}.table-embed{width:100%;border:0}.table-embed td{border-bottom:1px dashed #c3cbd4;border-left:0;padding:0;background-color:transparent!important}.table-embed td:first-child{padding-right:10px}.table-row-expanding{width:100%;table-layout:fixed;margin-bottom:-1px;border-bottom:1px solid #c3cbd4}.table-row-expanding>tbody>tr>td.expands{cursor:pointer;border-right:1px solid #fff;padding:0}.table-row-expanding>tbody>tr>td.expands.disabled{color:#c3cbd4;cursor:default}.table-row-expanding>tbody>tr>td.expands.disabled>span,.table-row-expanding>tbody>tr>td.expands.disabled a{color:inherit;cursor:inherit}.table-row-expanding>tbody>tr>td.expands>i,.table-row-expanding>tbody>tr>td.expands>span,.table-row-expanding>tbody>tr>td.expands a{color:#3c444d;display:block;padding:6px 10px;width:15px;height:100%;text-decoration:none;text-align:center}.table-row-expanding>tbody>tr>td.expands a:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd}.table-row-expanding>tbody>tr>td.expands a:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.table-row-expanding>tbody>tr>td>.btn-combo{margin:-4px 5px -6px 20px}.table-row-expanding>tbody>tr>td>.btn-combo:first-child{margin-left:0}.table-row-expanding>tbody>tr>td.title>a,.table-row-expanding>tbody>tr>td.title>span{margin:-6px -12px;padding:6px 12px;display:block;white-space:nowrap;text-overflow:ellipsis;overflow:hidden;font-size:14px;line-height:20px}.table-row-expanding>tbody>tr>td.title>a:focus,.table-row-expanding>tbody>tr>td.title>span:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd}.table-row-expanding>tbody>tr>td.title>a:focus:active:not([disabled]),.table-row-expanding>tbody>tr>td.title>span:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.table-row-expanding>tbody>tr>td.title>.disabled{color:#c3cbd4}.table-row-expanding>tbody>tr>td:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd}.table-row-expanding>tbody>tr>td:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.table-row-expanding>tbody>tr.info-row>td,.table-row-expanding>tbody>tr.more-info{border-top:none;background-color:#ecf8ff}.table-row-expanding>tbody>tr.expanded>td{background-color:#ecf8ff}.table-row-expanding>tbody>tr.expanded>td.title>a{white-space:normal}.table-row-expanding th.col-info{width:15px;padding-left:10px;padding-right:10px;text-align:center;vertical-align:top;font-size:100%;border-right:1px solid #fff}.table-row-expanding th.col-info a{text-decoration:none;color:#000;-webkit-box-shadow:none;box-shadow:none}.table-row-expanding th.col-info .icon-info{width:15px;display:block}.table-row-expanding td.col-info:hover:not(.disabled),.table-row-expanding td.expands:hover:not(.disabled){border-right:1px solid #fff!important}.table-row-expanding td.col-info:hover:not(.disabled) a>i,.table-row-expanding td.expands:hover:not(.disabled) a>i{color:#006eaa}.table-row-expanding td.col-info.disabled:hover,.table-row-expanding td.expands.disabled:hover{background-color:inherit!important}.table-row-expanding td.expands .icon-triangle-right-small:before{content:"\203A"}.table-row-expanding td.expands .icon-triangle-down-small:before{content:"\2C5"}.table-chrome .sorts th.col-info:after{content:""}.table-padded{padding:0 20px}td.row-number,th.row-number{width:1px}td.line-num,td.row-number{text-align:right;color:#171d21}td.numeric,th.numeric{text-align:right}td.end-group{border-right:1px solid #fff}.header-table-docked{position:fixed;top:0;z-index:405;overflow:hidden;-webkit-box-shadow:0 2px 4px #c3cbd4;box-shadow:0 2px 4px #c3cbd4;background:#fff}.header-table-docked>.disable{display:block;position:absolute;top:0;right:0;bottom:0;left:0;background-color:#5c6773;opacity:.3}.header-table-docked>table{table-layout:fixed;margin-bottom:0;max-width:inherit}.main-section>.header-table-docked,.table-padded>.header-table-docked{width:calc(100% - 40px);margin-left:20px!important}.table-scroll-bar-docked{position:fixed;bottom:0;left:0;right:0;overflow-x:auto}.header-table-static{height:0;position:relative;z-index:405}.header-table-static>table{margin-bottom:0}.header-table-wrapper{overflow:hidden;border-bottom:1px solid #e1e6eb}.header-table-wrapper .table{margin-bottom:0}.scroll-table-wrapper{height:380px;width:100%;overflow:auto}.scrolling-table-wrapper{width:100%;overflow-x:auto;position:relative}.vertical-scrolling-table-wrapper{width:100%;overflow-y:auto}.modalize-table-bottom,.modalize-table-overlay,.modalize-table-top{position:absolute;left:0;background-color:#5c6773;opacity:.3}.modalize-table-top{top:0}.modalize-table-bottom{bottom:0}.modalize-table-overlay{position:fixed;top:0;bottom:0;right:0}.table-drilldown>tbody>tr>td,.table-drilldown>tbody>tr>td:hover{color:#006eaa}.table-drilldown>tbody>tr>td.row-number{color:#6b7785}.table-drilldown-row>tbody>tr:hover>td{color:#006eaa}.table-drilldown-row>tbody>tr:hover>td.row-number{color:#6b7785}.table-drilldown-cell>tbody>tr>td:hover .multivalue-subcell,.table-drilldown-cell>tbody>tr>td:hover .multivalue-subcell:hover{color:#006eaa}.ui-grid-body-table,.ui-grid-head-table{margin-bottom:0}.table-scroll tbody{max-height:200px;overflow-y:scroll}.table-border-row,.table-border-row td,.table-border-row th{border-top:1px solid #e1e6eb}.table-fixed{table-layout:fixed}.table-fixed tr>td:first-child{max-width:300px;word-break:break-all}.table-chrome .sorts th.row-number:after{content:""}@media print{body table{table-layout:auto!important}body .events-viewer-wrapper,body .results-table,body .results-wrapper,body .scrolling-table-wrapper,body table{max-width:100%!important;width:100%!important;overflow:hidden!important}body td,body th{background:none!important;word-break:break-all!important;word-wrap:break-word!important;overflow-wrap:break-word!important;white-space:normal!important;width:auto!important;page-break-inside:auto}body .table-chrome .sorts:after{content:""}body .header-table-docked,body .table-scroll-bar-docked{display:none!important}}body.print table{table-layout:auto!important}body.print .events-viewer-wrapper,body.print .results-table,body.print .results-wrapper,body.print .scrolling-table-wrapper,body.print table{max-width:100%!important;width:100%!important;overflow:hidden!important}body.print td,body.print th{background:none!important;word-break:break-all!important;word-wrap:break-word!important;overflow-wrap:break-word!important;white-space:normal!important;width:auto!important;page-break-inside:auto}body.print .table-chrome .sorts:after{content:""}body.print .header-table-docked,body.print .table-scroll-bar-docked{display:none!important}.table-caption,.table-caption-inner{min-height:42px;text-align:center;margin-bottom:5px}.table-caption-inner.affix-top{left:0;top:0;right:0;background-color:#f2f4f5;z-index:405;position:fixed}.table-caption h3,.table-caption span.shared-collectioncount{font-size:14px;font-weight:400;float:left;padding-left:20px;line-height:42px;margin:0;min-width:140px;text-align:left}.table-caption .shared-waitspinner{float:left;width:14px;height:14px;margin:12px 5px 2px 0}.table-caption form.shared-tablecaption-input{display:inline-block;margin:5px 0}.table-caption form.shared-tablecaption-input input{width:250px}.table-caption .btn-group{display:inline-block;margin-right:10px}.shared-tablecaption-input{position:relative}.table-caption div.shared-controls-controlgroup{display:inline-block;margin:0 10px 0 0}.table-caption .pagination{min-width:150px;margin:5px 20px 0}.tourbar{background-color:#171d21;min-height:46px;position:relative}.tourbar .info-container{margin:0 200px;padding:10px;background-color:#3c444d;min-height:26px}.tourbar .info-container .info{font-size:14px;color:#e1e6eb}.tourbar .btn{background:transparent;-webkit-filter:none;filter:none;border-color:#c3cbd4;color:#e1e6eb;text-shadow:none;-webkit-box-shadow:none;box-shadow:none;top:50%;margin-top:-13px;position:absolute}.tourbar .btn.next{right:158px}.tourbar .btn.previous{left:158px}.tourbar .btn.close-btn{right:10px}.tourbar .close-container{float:right;margin:10px 25px}.tourbar .next-container{float:right;margin:10px 0 10px 25px}.tourbar .previous-container{float:left;margin:10px 25px}.tour-highlight{position:relative}.tour-highlight:after{content:"";position:absolute;right:-20px;top:-20px;height:30px;width:30px;z-index:99999;background:url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMjAiIGhlaWdodD0iMjAiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHBhdGggZD0iTTYuNzE0IDYuNzE0TDAgMHYyMGgyMGwtNi4yMTQtNi4yMTQgNi4yNi02LjI2TDEyLjk3NS40NTNsLTYuMjYgNi4yNnoiIGZpbGw9IiNEODVEM0MiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjwvc3ZnPg==);background-size:30px 30px;-webkit-animation:highlightedElementAnimation 2s infinite alternate;animation:highlightedElementAnimation 2s infinite alternate}@-webkit-keyframes highlightedElementAnimationFrames{0%{right:-20px;top:-20px}to{right:-30px;top:-30px}}@keyframes highlightedElementAnimationFrames{0%{right:-20px;top:-20px}to{right:-30px;top:-30px}}.image-tour-container .carousel{width:960px;height:718px;background:#3c444d;margin-bottom:0}.image-tour-container .carousel .carousel-control{top:52%;background:none;border:none;color:#5cc05c;opacity:1;left:45px;font-size:48px;z-index:60}.image-tour-container .carousel .carousel-control polygon{fill:#5cc05c}.image-tour-container .carousel .carousel-control:hover polygon{fill:#7ecd7e}.image-tour-container .carousel .carousel-control.disabled{display:none}.image-tour-container .carousel .carousel-control:focus{-webkit-box-shadow:none;box-shadow:none}.image-tour-container .carousel .carousel-control.right{right:45px;left:auto}.image-tour-container .carousel .carousel-indicators{bottom:18px;top:inherit;right:50%;-webkit-transform:translate(50%);transform:translate(50%);z-index:60}.image-tour-container .carousel .carousel-indicators li{height:6px;width:6px;cursor:pointer;background:#818d99;border:none;margin-left:10px;margin-bottom:0}.image-tour-container .carousel .carousel-indicators li.active{background-color:#5cc05c}.image-tour-container .carousel .carousel-indicators li:first-child{margin-left:0}.image-tour-container .carousel .item{width:960px;height:716px}.image-tour-container .carousel .item img{width:100%}.image-tour-container .carousel .item.active img:hover{cursor:pointer}.image-tour-container .carousel .help-link{position:absolute;width:150px;height:30px;top:122px;left:563px}.image-tour-container .carousel a#splunk-answers{top:160px;left:504px;width:140px}.image-tour-container .tour-links{position:absolute;top:15px;right:5px;padding:5px;text-align:right;z-index:50;font-size:12px}.image-tour-container .tour-links a{color:#fff;margin-left:15px}.image-tour-container .tour-links a:hover{text-decoration:underline}.image-tour-container .welcome-slide{position:absolute;top:0;left:0;z-index:100}.image-tour-container .tour-btn{background:rgba(0,0,0,.3);position:absolute;top:300px;left:50%;padding:30px 40px;font-size:30px;color:#fff;cursor:pointer;-webkit-transform:translate(-50%);transform:translate(-50%)}.image-tour-container .exit-tour,.image-tour-container .start-tour{color:#5cc05c}.image-tour-container .tour-gutter{background:rgba(60,68,77,.9);height:132px;width:962px;font-size:16px;color:#fff;position:absolute;bottom:0;z-index:50;left:50%;-webkit-transform:translate(-50%);transform:translate(-50%)}.image-tour-container .tour-gutter div.gutter-text{-webkit-transform:translateY(-50%);transform:translateY(-50%);margin:0 auto;position:relative;top:50%;line-height:150%;width:720px;text-align:center}.image-tour-container .tour-gutter a{color:#fff;text-decoration:underline}.image-tour-container .carousel-assets{position:absolute;height:132px;width:960px;bottom:0}.image-tour-container .next-tour,.image-tour-container .try-it-now{display:none}.image-tour-container .try-it-now{position:absolute;right:30px;z-index:500;bottom:50px}@media only screen and (max-height:750px){.image-tour-container .carousel-assets,.image-tour-container .tour-gutter{position:fixed}.image-tour-container .carousel-assets{bottom:-132px;z-index:60}.image-tour-container .carousel-assets .carousel-control{top:inherit;bottom:175px}.image-tour-container .carousel-assets .carousel-indicators{bottom:150px}.image-tour-container .carousel-assets .tour-links{top:inherit;bottom:220px}.image-tour-container .carousel-assets .try-it-now{top:inherit;bottom:180px}}.image-tour .tour-modal{width:960px;margin-left:-480px;height:716px;background:#3c444d;z-index:1062}.image-tour .tour-modal.fade.in{top:15px}.modal-backdrop.tour-backdrop.fade{background:#3c444d;z-index:1061}.modal-backdrop.tour-backdrop.fade.in{opacity:1;background:#3c444d}.shard-interactivetour.modal,.shared-tour-imagetour.modal,.shared-tour-producttours.modal{background-clip:border-box}.shard-interactivetour.modal .modal-header,.shared-tour-imagetour.modal .modal-header,.shared-tour-producttours.modal .modal-header{padding-bottom:10px}.shard-interactivetour.modal .modal-body,.shared-tour-imagetour.modal .modal-body,.shared-tour-producttours.modal .modal-body{padding:0 10px 10px;border-top:0}.shard-interactivetour.modal .modal-body:last-child,.shared-tour-imagetour.modal .modal-body:last-child,.shared-tour-producttours.modal .modal-body:last-child{max-height:none}.introjs-overlay{position:absolute;z-index:999999;background-color:#000;opacity:0;background:radial-gradient(center,ellipse cover,rgba(0,0,0,.4) 0,rgba(0,0,0,.9) 100%)}.introjs-fixParent{z-index:auto!important;opacity:1!important;position:absolute!important;-webkit-transform:none!important;transform:none!important;display:block!important}.introjs-showElement,tr.introjs-showElement>td,tr.introjs-showElement>th{z-index:9999999!important}.introjs-disableInteraction{z-index:99999999!important;position:absolute}a.introjs-showElement{display:inline-block!important}.introjs-relativePosition,tr.introjs-showElement>td,tr.introjs-showElement>th{position:relative}.introjs-helperLayer{position:absolute;z-index:9999998;background-color:hsla(0,0%,100%,.9);border:1px solid rgba(0,0,0,.5);border-radius:4px;-webkit-box-shadow:0 2px 15px rgba(0,0,0,.4);box-shadow:0 2px 15px rgba(0,0,0,.4)}.introjs-tooltipReferenceLayer{position:absolute;z-index:10000000;background-color:transparent}.introjs-helperLayer *,.introjs-helperLayer :after,.introjs-helperLayer :before{-webkit-box-sizing:content-box;box-sizing:content-box}.introjs-helperNumberLayer{position:absolute;top:-16px;left:-16px;z-index:9999999999!important;padding:2px;font-size:13px;font-weight:700;color:#fff;text-align:center;text-shadow:1px 1px 1px rgba(0,0,0,.3);background:-webkit-gradient(linear,left top,left bottom,from(#dc4e41),to(#f7f8fa));background:linear-gradient(180deg,#dc4e41 0,#f7f8fa);width:20px;height:20px;line-height:20px;border:3px solid #fff;border-radius:50%;-webkit-box-shadow:0 2px 5px rgba(0,0,0,.4);box-shadow:0 2px 5px rgba(0,0,0,.4)}.introjs-arrow{border:8px solid rgba(60,68,77,.9);content:"";position:absolute}.introjs-arrow.top,.introjs-arrow.top-right{top:-15px;border-color:transparent transparent rgba(60,68,77,.9)}.introjs-arrow.top-right{right:10px}.introjs-arrow.top-middle{top:-15px;left:50%;margin-left:-5px;border-color:transparent transparent rgba(60,68,77,.9)}.introjs-arrow.right{top:15px}.introjs-arrow.right,.introjs-arrow.right-bottom{right:-15px;border-color:transparent transparent transparent rgba(60,68,77,.9)}.introjs-arrow.right-bottom{bottom:10px}.introjs-arrow.bottom{bottom:-15px;border-color:rgba(60,68,77,.9) transparent transparent}.introjs-arrow.left{top:10px}.introjs-arrow.left,.introjs-arrow.left-bottom{left:-15px;border-color:transparent rgba(60,68,77,.9) transparent transparent}.introjs-arrow.left-bottom{bottom:10px}.introjs-tooltip{position:absolute;padding:40px 60px 10px;text-align:center;color:#fff;background-color:rgba(60,68,77,.9);min-width:400px;max-width:500px;border-radius:0;-webkit-box-shadow:0 1px 10px rgba(0,0,0,.4);box-shadow:0 1px 10px rgba(0,0,0,.4)}.introjs-tooltiptext a{color:#fff;text-decoration:underline}.introjs-tooltipbuttons{text-align:right;white-space:nowrap}.introjs-button{overflow:visible;padding:5px;margin:0;color:#5cc05c;fill:#5cc05c;text-decoration:none;font-size:25px;cursor:pointer;outline:none;position:absolute;top:50%;-webkit-transform:translateY(-45%);transform:translateY(-45%)}.introjs-button:hover polygon{fill:#82ce82}.introjs-button.introjs-disabled{display:none}.introjs-button:focus{-webkit-box-shadow:none;box-shadow:none;background:none}.introjs-tooltiplinks{position:absolute;top:10px;right:5px}.introjs-nexttourbutton,.introjs-skipbutton{font-size:12px;color:#fff;position:relative}.introjs-nexttourbutton:focus,.introjs-nexttourbutton:hover,.introjs-skipbutton:focus,.introjs-skipbutton:hover{color:#fff}.introjs-skipbutton.done{color:#5cc05c}.introjs-prevbutton{left:10px}.introjs-nextbutton{right:10px}.introjs-disabled,.introjs-disabled:focus,.introjs-disabled:hover{color:#818d99;-webkit-box-shadow:none;box-shadow:none;cursor:default;background-image:none;text-decoration:none}.introjs-bullets{text-align:center;padding-top:30px}.introjs-bullets ul{clear:both;margin:15px auto 0;padding:0;display:inline-block}.introjs-bullets ul li{list-style:none;float:left;margin:0 5px}.introjs-bullets ul li a{display:block;width:6px;height:6px;background:#c3cbd4;border-radius:10px;text-decoration:none}.introjs-bullets ul li a.active{background:#5cc05c}.introjs-progress{overflow:hidden;height:10px;margin:10px 0 5px;border-radius:4px;background-color:#e1e6eb}.introjs-progressbar{float:left;width:0;height:100%;font-size:10px;line-height:10px;text-align:center;background-color:#006d9c}.introjsFloatingElement{position:absolute;height:0;width:0;left:50%;top:50%}.introjs-tooltiptext{font-size:16px;line-height:24px}.tours-links{text-align:center;margin:0;display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.tours-links li{position:relative;list-style:none;margin-bottom:20px;display:inline-block;text-align:center}.tours-links .mask{position:absolute;top:0;bottom:0;left:0;right:0;opacity:0;border-radius:3px;cursor:pointer;background-color:#5cc05c;-webkit-transition:opacity .15s linear;transition:opacity .15s linear}.tours-links .mask:hover{opacity:.1}.tours-links .svg-wrapper{height:84px;padding:10px;-webkit-box-sizing:border-box;box-sizing:border-box}.tours-links .svg-wrapper svg{width:84px;fill:#5cc05c}.tour-link{position:relative;padding:10px;margin:10px;display:inline-block;color:#3c444d!important;font-weight:500;-webkit-box-flex:1;-ms-flex:1 1 0px;flex:1 1 0;max-width:25%;-webkit-transition:opacity .125s,background .05s;transition:opacity .125s,background .05s}.tour-link:hover{background:rgba(195,203,212,.1);text-decoration:none}.tour-link:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.tour-link:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.tour-link i{height:84px;padding:32px 40px;-webkit-box-sizing:border-box;box-sizing:border-box;font-size:76px;line-height:60px;color:#5cc05c}[class*=" icon-"]:before,[class^=icon-]:before{font-family:Splunk Icons;font-style:normal;font-weight:400;text-decoration:inherit;line-height:inherit}a [class*=" icon-"],a [class^=icon-]{display:inline-block;text-decoration:none;line-height:inherit}.icon-large{font-size:1.3333333333333333em;vertical-align:middle}.font-icon{font-family:Splunk Icons;font-size:inherit;line-height:inherit}.icon-no-underline:first-child{padding-right:.3em}.icon-no-underline:last-child{padding-left:.3em}.icon-no-underline:first-child:last-child{padding-right:0;padding-left:0}.icon-no-underline:before{text-decoration:none}.padded-icon{margin-right:.5em}.ir{position:relative;display:inline-block;min-width:.5em;text-indent:-9999px;outline:none}.ir:before{position:absolute;top:0;left:0;text-indent:0}.icon-splunk:before{content:"splunk"}.icon-greater:before{content:">"}.icon-hunk:before{content:"\F000"}.icon-enterprise:before{content:"\F001"}.icon-cloud-logo:before{content:"\F002"}.icon-splunk-light:before{content:"\F003"}.icon-circle:before{content:"\ECD0"}.icon-circle-filled:before{content:"\25CF"}.icon-box-filled:before{content:"\25A0"}.icon-triangle-up-small:before{content:"\25B4"}.icon-triangle-right:before{content:"\25B6"}.icon-triangle-right-small:before{content:"\25B8"}.icon-triangle-down:before{content:"\25BC"}.icon-triangle-down-small:before{content:"\25BE"}.icon-triangle-left:before{content:"\25C0"}.icon-triangle-left-small:before{content:"\25C2"}.icon-arrow-up:before{content:"\EC01"}.icon-arrow-right:before{content:"\27A1"}.icon-arrow-down:before{content:"\EC02"}.icon-arrow-left:before{content:"\EC00"}.icon-two-arrows-cycle:before{content:"\EC12"}.icon-external:before{content:"\EC13"}.icon-rotate-counter:before{content:"\21BA"}.icon-rotate:before{content:"\21BB"}.icon-location:before{content:"\EC80"}.icon-chevron-left:before{content:"\2039"}.icon-chevron-right:before{content:"\203A"}.icon-chevron-up:before{content:"\2C4"}.icon-chevron-down:before{content:"\2C5"}.icon-trash:before{content:"\EC66"}.icon-share:before{content:"\27A6"}.icon-export:before{content:"\EC68"}.icon-print:before{content:"\EC89"}.icon-search:before{content:"\EC9B"}.icon-search-thin:before{content:"\ECC2"}.icon-pivot:before{content:"\EC12"}.icon-clone:before{content:"\ECE8"}.icon-pause:before{content:"\EC50"}.icon-stop:before{content:"\25A0"}.icon-play:before{content:"\25B6"}.icon-sort:before{content:"\2195"}.icon-sorted-up:before{content:"\21A5"}.icon-sorted-down:before{content:"\21A7"}.icon-minus:before{content:"\2212"}.icon-minus-circle:before{content:"\2296";margin-right:.25em}.icon-plus:before{content:"+"}.icon-plus-circle:before{content:"\2295"}.icon-x:before{content:"\2717"}.icon-x-circle:before{content:"\2297"}.icon-cancel:before,.icon-close:before{content:"\2717"}.icon-collapse-left:before{content:"\ECE0"}.icon-expand-right:before{content:"\ECE1"}.icon-activity:before{content:"\ECAE"}.icon-string:before{content:"a"}.icon-number:before{content:"#"}.icon-text:before{content:"\ECD9"}.icon-not-allowed:before{content:"\EC9E"}.icon-data:before{content:"\ECA4"}.icon-data-input:before{content:"\ECA3"}.icon-settings:before{content:"\ECA5"}.icon-distributed-environment:before{content:"\ECA6"}.icon-visible:before{content:"\ECC0"}.icon-hidden:before{content:"\ECC1"}.icon-boolean:before{content:"\ECD2"}.icon-menu:before,.icon-rows:before{content:"\EC56"}.icon-tiles:before{content:"\ECF0"}.icon-metric:before{content:"\ECF5"}.icon-event:before{content:"\ECF6"}.icon-rollup:before{content:"\ECF8"}.icon-info:before{content:"i"}.icon-info-circle:before{content:"I"}.icon-question:before{content:"?";font-family:inherit}.icon-question-circle:before{content:"\EC9D"}.icon-box-unchecked:before{content:"\2610"}.icon-box-checked:before{content:"\2611"}.icon-check-circle:before{content:"\ECD3"}.icon-alert-circle:before{content:"\ECD4"}.icon-code:before{content:"\ECD7"}.icon-code-thin:before{content:"\ECD6"}.icon-alert:before{content:"\26A0"}.icon-error:before{content:"\ECE2"}.icon-warning:before{content:"\26A0"}.icon-fullscreen:before{content:"\ECF3"}.icon-bell:before{content:"\EC9C"}.icon-bookmark:before{content:"\ECA1"}.icon-bulb:before{content:"\EC98"}.icon-calendar:before{content:"\EC9A"}.icon-check:before{content:"\2713"}.icon-clock:before{content:"\231A"}.icon-cloud:before{content:"\2601"}.icon-flag:before{content:"\2691"}.icon-gear:before{content:"\2699"}.icon-lightning:before{content:"\2301"}.icon-link:before{content:"\ECF1"}.icon-lock:before{content:"\EC9F"}.icon-lock-unlocked:before{content:"\ECA0"}.icon-mail:before{content:"\2709"}.icon-pencil:before{content:"\270F"}.icon-speech-bubble:before{content:"\EC99"}.icon-star:before{content:"\2605"}.icon-user:before{content:"\EC84"}.icon-clipboard:before{content:"\ECD5"}.icon-paintbrush:before{content:"\ECCA"}.icon-warning-sign:before{content:"\26A0"}.icon-chart-area:before{content:"\ECA9"}.icon-chart-bar:before{content:"\ECAA"}.icon-chart-column:before{content:"\ECAB"}.icon-chart-pie:before{content:"\ECAC"}.icon-chart-scatter:before{content:"\ECAD"}.icon-chart-bubble:before{content:"\ECB8"}.icon-chart-line:before{content:"\ECAE"}.icon-single-value:before{content:"\ECAF"}.icon-gauge-radial:before{content:"\ECA2"}.icon-gauge-marker:before{content:"\ECB0"}.icon-gauge-filler:before{content:"\ECB1"}.icon-choropleth-map:before{content:"\ECB9";-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.icon-external-viz:before{content:"\ECF2"}.icon-label-rotation--90:before{content:"\ECE3"}.icon-label-rotation--45:before{content:"\ECE4"}.icon-label-rotation-0:before{content:"\ECE5"}.icon-label-rotation-45:before{content:"\ECE6"}.icon-label-rotation-90:before{content:"\ECE7"}.icon-trellis-layout:before{content:"\F004"}.icon-chart-area-plus-table:before{content:"\ECA9 + \ECA8"}.icon-chart-bar-plus-table:before{content:"\ECAA + \ECA8"}.icon-chart-column-plus-table:before{content:"\ECAB + \ECA8"}.icon-chart-pie-plus-table:before{content:"\ECAC + \ECA8"}.icon-chart-scatter-plus-table:before{content:"\ECAD + \ECA8"}.icon-chart-bubble-plus-table:before{content:"\ECB8 + \ECA8"}.icon-chart-line-plus-table:before{content:"\ECAE + \ECA8"}.icon-single-value-plus-table:before{content:"\ECAF + \ECA8"}.icon-gauge-radial-plus-table:before{content:"\ECA2 + \ECA8"}.icon-gauge-marker-plus-table:before{content:"\ECB0 + \ECA8"}.icon-gauge-filler-plus-table:before{content:"\ECB1 + \ECA8"}.icon-location-plus-table:before{content:"\EC80 + \ECA8"}.icon-choropleth-map-plus-table:before{content:"\ECB9 + \ECA8";-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.icon-external-viz-plus-table:before{content:"\ECF2 + \ECA8"}.icon-list:before{content:"\ECA7"}.icon-table:before{content:"\ECA8"}.icon-bar-beside:before{content:"\ECB2"}.icon-bar-stacked:before{content:"\ECB3"}.icon-bar-stacked-100:before{content:"\ECB4"}.icon-missing-value-skipped:before{content:"\ECB5"}.icon-missing-value-zero:before{content:"\ECB6"}.icon-missing-value-join:before{content:"\ECB7"}.icon-folder:before{content:"\ECE9"}.icon-document:before,.icon-report:before{content:"\ECC3"}.icon-report-search:before{content:"\ECC4"}.icon-report-pivot:before{content:"\ECC5"}.icon-dashboard:before{content:"\ECC6"}.icon-panel:before{content:"\ECC7"}.icon-panel-search:before{content:"\ECC8"}.icon-panel-pivot:before{content:"\ECC9"}.popdown{position:relative}.popdown-dialog{background-color:#fff;border:1px solid #c3cbd4;-webkit-box-shadow:1px 2px 5px rgba(0,0,0,.2);box-shadow:1px 2px 5px rgba(0,0,0,.2);border-radius:2px;top:100%;left:50%;margin:8px 0 0 -103px;display:none;position:absolute;z-index:1060;white-space:normal}.popdown-dialog .arrow{border-bottom:8px solid #c3cbd4;top:-8px;left:50%;margin-left:-4px}.popdown-dialog .arrow,.popdown-dialog .arrow:before{position:absolute;height:0;width:0;border-left:8px solid transparent;border-right:8px solid transparent;content:"";display:block;border-top:0}.popdown-dialog .arrow:before{border-bottom:8px solid #fff;top:1px;left:-8px}.popdown-dialog.up{margin-top:0}.popdown-dialog.up>.arrow{border-top:8px solid #c3cbd4;bottom:-8px}.popdown-dialog.up>.arrow,.popdown-dialog.up>.arrow:before{position:absolute;height:0;width:0;border-left:8px solid transparent;border-right:8px solid transparent;content:"";display:block;border-bottom:0;top:auto}.popdown-dialog.up>.arrow:before{border-top:8px solid #fff;bottom:1px}.popdown-dialog.right{margin-left:5px;margin-top:0}.popdown-dialog.right .arrow{border-right:8px solid #c3cbd4;left:-8px}.popdown-dialog.right .arrow,.popdown-dialog.right .arrow:before{position:absolute;height:0;width:0;border-bottom:8px solid transparent;border-top:8px solid transparent;content:"";display:block;border-left:0;top:50%;margin:-8px 0 0}.popdown-dialog.right .arrow:before{border-right:8px solid #fff;left:1px}.popdown-dialog.pull-right .arrow{left:auto;right:8px}.popdown-dialog.open{display:block}.popdown-dialog:after{content:"";font-size:0;display:inline;overflow:hidden}.popdown-dialog-body{margin:0;border-radius:1px;background-color:#fff}.popdown-dialog-body:after,.popdown-dialog-body:before{display:table;content:"";line-height:0}.popdown-dialog-body:after{clear:both}.popdown-dialog-footer{border-top:1px solid #c3cbd4;padding:5px;border-bottom-left-radius:1px;border-bottom-right-radius:1px}.popdown-dialog-footer:after,.popdown-dialog-footer:before{display:table;content:"";line-height:0}.popdown-dialog-footer:after{clear:both}.popdown-dialog-padded{padding:10px}.dropdown,.dropup{position:relative}.dropdown-toggle:active,.open .dropdown-toggle{outline:0}.caret{display:inline-block;content:"";border:none;width:auto;height:auto;line-height:20px;margin:0;padding-left:.3em;vertical-align:baseline;font-family:Splunk Icons;font-weight:400}.caret,.caret:before{font-size:inherit;text-decoration:none}.caret:before{content:"\25BE"}.icon-no-underline+.caret{padding-left:0}.caret-char{font-family:Splunk Icons;font-weight:400}.caret-char:before{content:"\25BE"}.dropdown-menu{float:left;min-width:160px;list-style:none;word-wrap:break-word;width:20em;line-height:1.33333em;padding:0;background-clip:padding-box;background-color:#fff;border:1px solid #c3cbd4;-webkit-box-shadow:1px 2px 5px rgba(0,0,0,.2);box-shadow:1px 2px 5px rgba(0,0,0,.2);border-radius:2px;top:100%;left:50%;margin:8px 0 0 -103px;display:none;position:absolute;z-index:1060;white-space:normal}.open>.dropdown-menu{display:block}.dropdown-menu .arrow{border-bottom:8px solid #c3cbd4;top:-8px;left:50%;margin-left:-4px}.dropdown-menu .arrow,.dropdown-menu .arrow:before{position:absolute;height:0;width:0;border-left:8px solid transparent;border-right:8px solid transparent;content:"";display:block;border-top:0}.dropdown-menu .arrow:before{border-bottom:8px solid #fff;top:1px;left:-8px}.dropdown-menu.up{margin-top:0}.dropdown-menu.up>.arrow{border-top:8px solid #c3cbd4;bottom:-8px}.dropdown-menu.up>.arrow,.dropdown-menu.up>.arrow:before{position:absolute;height:0;width:0;border-left:8px solid transparent;border-right:8px solid transparent;content:"";display:block;border-bottom:0;top:auto}.dropdown-menu.up>.arrow:before{border-top:8px solid #fff;bottom:1px}.dropdown-menu.right{margin-left:5px;margin-top:0}.dropdown-menu.right .arrow{border-right:8px solid #c3cbd4;left:-8px}.dropdown-menu.right .arrow,.dropdown-menu.right .arrow:before{position:absolute;height:0;width:0;border-bottom:8px solid transparent;border-top:8px solid transparent;content:"";display:block;border-left:0;top:50%;margin:-8px 0 0}.dropdown-menu.right .arrow:before{border-right:8px solid #fff;left:1px}.dropdown-menu.pull-right .arrow{left:auto;right:8px}.dropdown-menu.open{display:block}.dropdown-menu .divider{height:1px;margin:9px 1px;overflow:hidden;background-color:#c3cbd4}.dropdown-menu .info,.dropdown-menu .title{color:#6b7785}.dropdown-menu ul li.info:not(:first-child){border-top:1px solid #c3cbd4}.dropdown-menu ul{list-style:none;margin:0;border-radius:1px;background-color:#fff;overflow-x:hidden;overflow-y:auto;max-width:100%;max-height:270px;-webkit-box-sizing:border-box;box-sizing:border-box;border-radius:0}.dropdown-menu ul:after,.dropdown-menu ul:before{display:table;content:"";line-height:0}.dropdown-menu ul:after{clear:both}.dropdown-menu ul+ul{margin-top:-1px}.dropdown-menu ul+ul li.title:first-child,.dropdown-menu ul+ul li:first-child>a{border-top:1px solid #c3cbd4}.dropdown-menu .arrow+ul,.dropdown-menu .arrow+ul>li:first-child>a{border-top-left-radius:1px;border-top-right-radius:1px;border-top:none}.dropdown-menu ul:last-of-type,.dropdown-menu ul:last-of-type>li:last-of-type>a{border-bottom-left-radius:1px;border-bottom-right-radius:1px}.dropdown-menu a .icon-check{position:absolute;left:5px;top:5px;color:#00a4fd}.dropdown-menu [class*=" icon-"],.dropdown-menu [class^=icon-]{width:1.25em;text-align:center}.dropdown-menu li{position:relative}.dropdown-menu li.info{padding:5px 10px}.dropdown-menu li.title{text-transform:uppercase;padding:3px 10px}.dropdown-menu li.message{padding:5px 10px}.dropdown-menu li>span.field-value{white-space:nowrap;overflow:hidden;text-overflow:ellipsis;display:block;word-wrap:normal}.dropdown-menu li>a{display:block;clear:both;font-weight:400;line-height:20px;position:relative;color:#5c6773;padding:5px 10px;white-space:normal;text-decoration:none}.dropdown-menu li>a>.info{display:block;font-size:12px}.dropdown-menu li>a:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd}.dropdown-menu li>a:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.dropdown-menu li>a:hover{color:#5c6773;background:#f2f4f5}.dropdown-menu li>a.primary-link{margin-right:40px;border-top-right-radius:0;border-bottom-right-radius:0}.dropdown-menu li>a.secondary-link{position:absolute;right:0;top:0;bottom:0;width:40px;padding-left:0;padding-right:0;font-size:16px;text-align:center;border-top-left-radius:0;border-bottom-left-radius:0}.dropdown-menu li>a>.link-description{color:#6b7785;display:block;font-size:.85em}.dropdown-menu>.disabled>a,.dropdown-menu>.disabled>a:focus,.dropdown-menu>.disabled>a:hover,.dropdown-menu li>a.disabled,.dropdown-menu li>a.disabled:focus,.dropdown-menu li>a.disabled:hover{color:#c3cbd4;cursor:not-allowed;text-decoration:none;background-color:transparent;background-image:none;-webkit-box-shadow:none;box-shadow:none}.dropdown-menu .divider{border:none;border-top:1px solid #c3cbd4;margin:0;height:0}.dropdown-menu .divider+li>a{border-top:none}.dropdown-menu .input-container .shared-findinput{width:100%;-webkit-box-sizing:border-box;box-sizing:border-box;padding:5px;margin:0}.dropdown-menu .input-container .search-query{width:100%}.dropdown-truncated li>a{white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.dropdown-menu-narrow{width:10em}.dropdown-menu-medium{width:25em}.dropdown-menu-wide{width:30em}.dropdown-menu-width-auto{width:auto;max-width:20em}.dropdown-menu-width-auto.dropdown-menu-narrow{max-width:10em}.dropdown-menu-width-auto.dropdown-menu-medium{max-width:25em}.dropdown-menu-width-auto.dropdown-menu-wide{max-width:30em}.dropdown-menu-selectable li>a{padding-left:24px}.navbar .nav>li>.dropdown-menu:after,.navbar .nav>li>.dropdown-menu:before{display:none}.dropdown-header{display:block;padding:3px 20px;font-size:12px;line-height:1.42857143;color:#6b7785}.dropdown-menu-tall ul{max-height:20em;overflow:auto}.dropdown-menu-short ul{max-height:10em;overflow:auto}.dropdown-menu-noscroll ul{max-height:none}.dropup .caret,.navbar-fixed-bottom .dropdown .caret{border-top:0;border-bottom:4px solid #000;content:""}.dropup .dropdown-menu,.navbar-fixed-bottom .dropdown .dropdown-menu{top:auto;bottom:100%;margin-bottom:1px}.dropdown-submenu{position:relative}.dropdown-submenu>.dropdown-menu{top:0;left:100%;margin-top:-6px;margin-left:-1px;border-radius:2px 2px 2px 2px}.dropdown-submenu:hover>.dropdown-menu{display:block}.dropdown-submenu:focus>a,.dropdown-submenu:hover>a{text-decoration:none;color:#006eaa;background:#f7f8fa}.dropdown-submenu>a{paddin-right:20px}.dropdown-submenu>a:after{display:block;content:"";position:absolute;right:8px;top:50%;-webkit-transform:translateY(-50%);transform:translateY(-50%);width:0;height:0;border-color:transparent transparent transparent #ccc;border-style:solid;border-width:5px 0 5px 5px}.dropdown-submenu>ul{overflow-x:hidden;overflow-y:auto}.dropdown-submenu.pull-left{float:none}.dropdown-submenu.pull-left>.dropdown-menu{left:-100%;margin-left:10px;border-radius:6px 0 6px 6px}.dropup .dropdown-submenu>.dropdown-menu{top:auto;bottom:0;margin-top:0;margin-bottom:-2px;border-radius:5px 5px 5px 0}.dropdown .dropdown-menu .nav-header{padding-left:20px;padding-right:20px}.typeahead{z-index:1051;margin-top:2px;border-radius:3px}.fade{opacity:0;-webkit-transition:opacity .125s;transition:opacity .125s}.fade.in{opacity:1}.collapse{position:relative;height:0;overflow:hidden;-webkit-transition:height .2s ease;transition:height .2s ease}.collapse.in{height:auto}.close{float:right;border-radius:3px;width:27px;height:27px;color:transparent;font-size:0;line-height:0;text-align:center;-webkit-transition:background .2s,color .2s;transition:background .2s,color .2s}.close:before{font-family:Splunk Icons;content:"\2717";font-size:20px;color:#5c6773;line-height:28px;-webkit-transition:color .2s;transition:color .2s}.close:hover{background-color:#f7f8fa;cursor:pointer;text-decoration:none}.close:hover:before{color:#006eaa}.close:focus{-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.close:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.close:focus:before{color:#006eaa}button.close{padding:0;cursor:pointer;background:transparent;border:0;-webkit-appearance:none}.btn{display:inline-block;height:auto;line-height:20px;font-size:14px;-webkit-box-sizing:border-box;box-sizing:border-box;padding:5px 14px;margin-bottom:0;font-weight:400;text-align:center;vertical-align:middle;cursor:pointer;border-radius:3px;white-space:nowrap;background-color:#f7f8fa;border:1px solid #c3cbd4}.btn,.btn:hover{color:#5c6773;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.btn:hover{background-color:#ebeeef;border-color:#c3cbd4}.btn:focus{background-color:#f7f8fa;border-color:#c3cbd4;color:#5c6773;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none;-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.btn:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.btn.active,.btn:active{background-color:#e1e6eb;border-color:#c3cbd4;color:#3c444d;-webkit-box-shadow:none;box-shadow:none;text-decoration:none;text-shadow:none;-webkit-transition:none;transition:none;-webkit-filter:none;filter:none}.btn.disabled,.btn.disabled:active,.btn.disabled:focus,.btn.disabled:hover,.btn[disabled],.btn[disabled]:active,.btn[disabled]:focus,.btn[disabled]:hover{background-color:#f7f8fa;border-color:#e1e6eb;color:#6b7785;-webkit-box-shadow:inset 0 -1px 0 #e1e6eb;box-shadow:inset 0 -1px 0 #e1e6eb;text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none;cursor:not-allowed}.btn-primary{padding:6px 15px;font-weight:500;background-color:#5cc05c;border:transparent}.btn-primary,.btn-primary:hover{color:#fff;-webkit-box-shadow:inset 0 -2px 0 rgba(0,0,0,.1);box-shadow:inset 0 -2px 0 rgba(0,0,0,.1);text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.btn-primary:hover{background-color:#40a540;border-color:transparent}.btn-primary:focus{background-color:#5cc05c;border-color:transparent;color:#fff;-webkit-box-shadow:inset 0 -2px 0 rgba(0,0,0,.1);box-shadow:inset 0 -2px 0 rgba(0,0,0,.1);text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none;-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.btn-primary:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.btn-primary.active,.btn-primary:active{background-color:#389038;color:#fff;-webkit-box-shadow:none;box-shadow:none}.btn-primary.active,.btn-primary.disabled,.btn-primary.disabled:active,.btn-primary.disabled:focus,.btn-primary.disabled:hover,.btn-primary:active,.btn-primary[disabled],.btn-primary[disabled]:active,.btn-primary[disabled]:focus,.btn-primary[disabled]:hover{border-color:transparent;text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.btn-primary.disabled,.btn-primary.disabled:active,.btn-primary.disabled:focus,.btn-primary.disabled:hover,.btn-primary[disabled],.btn-primary[disabled]:active,.btn-primary[disabled]:focus,.btn-primary[disabled]:hover{background-color:#9ed99e;color:#dff2df;-webkit-box-shadow:inset 0 -2px 0 rgba(0,0,0,.1);box-shadow:inset 0 -2px 0 rgba(0,0,0,.1);cursor:not-allowed}.btn-secondary{font-weight:500}.btn-secondary:hover{background-color:#ebeeef}.btn-secondary:focus,.btn-secondary:hover{border-color:#c3cbd4;color:#5c6773;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.btn-secondary:focus{background-color:#f7f8fa;-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0}.btn-secondary:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.btn-secondary.active,.btn-secondary:active{background-color:#e1e6eb;border-color:#c3cbd4;color:#3c444d;-webkit-box-shadow:none;box-shadow:none;text-decoration:none;text-shadow:none;-webkit-transition:none;transition:none;-webkit-filter:none;filter:none}.btn-secondary.disabled,.btn-secondary.disabled:active,.btn-secondary.disabled:focus,.btn-secondary.disabled:hover,.btn-secondary[disabled],.btn-secondary[disabled]:active,.btn-secondary[disabled]:focus,.btn-secondary[disabled]:hover{background-color:#f7f8fa;border-color:#e1e6eb;color:#6b7785;-webkit-box-shadow:inset 0 -1px 0 #e1e6eb;box-shadow:inset 0 -1px 0 #e1e6eb;cursor:not-allowed}.btn-pill,.btn-secondary.disabled,.btn-secondary.disabled:active,.btn-secondary.disabled:focus,.btn-secondary.disabled:hover,.btn-secondary[disabled],.btn-secondary[disabled]:active,.btn-secondary[disabled]:focus,.btn-secondary[disabled]:hover{text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.btn-pill{display:inline-block;padding:5px 14px;line-height:20px;border-radius:3px;background-color:none;border:1px solid transparent;color:#5c6773;-webkit-box-shadow:none;box-shadow:none}.btn-pill:hover{color:#006eaa;background:#ebeeef;border-color:#c3cbd4;text-decoration:none}.btn-pill:focus{color:#5c6773;background:none;border-color:transparent;-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.btn-pill:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.btn-pill.active,.btn-pill:active{color:#5c6773;background:#e1e6eb;border-color:transparent;text-decoration:none}.btn-pill.disabled,.btn-pill.disabled:active,.btn-pill.disabled:focus,.btn-pill.disabled:hover,.btn-pill[disabled],.btn-pill[disabled]:active,.btn-pill[disabled]:focus,.btn-pill[disabled]:hover{color:#c3cbd4;background:none;border-color:transparent;text-decoration:none;-webkit-box-shadow:none;box-shadow:none;cursor:not-allowed}.btn-link{background-color:transparent;border-color:transparent;color:#006eaa;-webkit-box-shadow:none;box-shadow:none;text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.btn-link:hover{color:#006eaa;text-decoration:underline}.btn-link:focus{color:#006eaa;-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.btn-link:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.btn-link.active,.btn-link:active{color:#006eaa;text-decoration:none}.btn-link.disabled,.btn-link.disabled:active,.btn-link.disabled:focus,.btn-link.disabled:hover,.btn-link[disabled],.btn-link[disabled]:active,.btn-link[disabled]:focus,.btn-link[disabled]:hover{color:#6b7785;text-decoration:none;cursor:not-allowed}.btn-block{display:block;width:100%;padding-left:0;padding-right:0;-webkit-box-sizing:border-box;box-sizing:border-box}.btn-block+.btn-block{margin-top:5px}input[type=button].btn-block,input[type=reset].btn-block,input[type=submit].btn-block{width:100%}.btn-draggable{cursor:move;width:150px;overflow:hidden;white-space:nowrap;text-overflow:ellipsis;-webkit-box-sizing:border-box;box-sizing:border-box}.btn-draggable .before,.btn-draggable:before{content:"";float:left;margin-left:-8px;height:18px;width:6px;background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='4' height='4'%3E%3Cpath fill='%23818D99' d='M0 0h2v2H0z'/%3E%3C/svg%3E");cursor:move}.btn-draggable.btn-small:before{height:14px}.btn-draggable.btn-mini:before{height:12px}.btn-large{padding:8px 28px}.btn-large [class*=" icon-"],.btn-large [class^=icon-]{margin-top:4px}.btn-large.btn-primary{padding:9px 29px}.btn-small{padding:3px 14px}.btn-small [class*=" icon-"],.btn-small [class^=icon-]{margin-top:0}.btn-small.btn-primary{padding:4px 15px}.btn-mini{padding:0 7px}.btn-mini [class*=" icon-"],.btn-mini [class^=icon-]{margin-top:-1px}.btn-mini.btn-primary{padding:1px 8px}.btn-group>.btn-mini,.btn-mini{font-size:12px;font-weight:500;line-height:18px}.btn-square{padding:6px 0;height:32px;width:32px;text-align:center;-webkit-box-sizing:border-box;box-sizing:border-box}@media print{.btn{background:none!important;border:none!important;padding:0!important;color:#3c444d!important;text-shadow:none!important;-webkit-box-shadow:none!important;box-shadow:none!important}.caret{display:none!important}}.btn-combo,.btn-group{position:relative;display:inline-block;font-size:0;white-space:nowrap;vertical-align:middle}.btn-combo+.btn-combo,.btn-group+.btn-group{margin-left:10px}.btn-group>.btn,.btn-group>.btn-combo>.btn{position:relative;border-radius:0}.btn-group>.btn+.btn,.btn-group>.btn+.btn-combo,.btn-group>.btn-combo+.btn,.btn-group>.btn-combo+.btn-combo{margin-left:-1px}.btn-group .btn-pill,.btn-group .dropdown-toggle,.btn-group .popdown-dialog,.btn-group>.btn,.btn-group>.btn-large,.btn-group>.btn-small,.btn-group>.dropdown-menu,.btn-group>.popover,.btn-group ul{font-size:14px}.btn-group>.btn-mini{font-size:12px}.btn-group>.btn-combo:first-child>.btn:first-child,.btn-group>.btn-combo:first-child>.drodown-toggle,.btn-group>.btn:first-child{margin-left:0;border-top-left-radius:3px;border-bottom-left-radius:3px}.btn-group>.btn-combo:last-child>.btn:last-child,.btn-group>.btn-combo:last-child>.dropdown-toggle,.btn-group>.btn:last-child,.btn-group>.dropdown-toggle{border-top-right-radius:3px;border-bottom-right-radius:3px}.btn-group>.btn-combo:first-child>.btn.large:first-child,.btn-group>.btn.large:first-child{margin-left:0;border-top-left-radius:3px;border-bottom-left-radius:3px}.btn-group>.btn-combo:last-child>.btn.large:last-child,.btn-group>.btn-combo:last-child>.large.dropdown-toggle,.btn-group>.btn.large:last-child,.btn-group>.large.dropdown-toggle{border-top-right-radius:3px;border-bottom-right-radius:3px}.btn-group>.btn-combo>.btn.active,.btn-group>.btn-combo>.btn:active,.btn-group>.btn-combo>.btn:hover,.btn-group>.btn.active,.btn-group>.btn:active,.btn-group>.btn:hover{z-index:2}.btn-group>.btn-combo>.btn:focus,.btn-group>.btn:focus{z-index:3}.btn-group .dropdown-toggle:active,.btn-group.open .dropdown-toggle{outline:0}.btn-combo>.btn:first-child{border-top-right-radius:0;border-bottom-right-radius:0}.btn-combo>.btn:last-child,.btn-combo>.dropdown-toggle{border-top-left-radius:0;border-bottom-left-radius:0}.btn-combo>.btn+.btn{margin-left:-1px}.btn-combo .btn-pill,.btn-combo .dropdown-toggle,.btn-combo .popdown-dialog,.btn-combo>.btn,.btn-combo>.btn-large,.btn-combo>.btn-small,.btn-combo>.dropdown-menu,.btn-combo ul{font-size:14px}.btn-combo>.btn-mini{font-size:12px}.btn-combo:first-child>.btn:first-child{margin-left:0;border-top-left-radius:3px;border-bottom-left-radius:3px}.btn-combo>.dropdown-toggle{border-top-right-radius:3px;border-bottom-right-radius:3px}.btn-toolbar{font-size:0;margin-top:10px;margin-bottom:10px}.btn-toolbar .btn-combo{display:inline-block}.btn-toolbar>.btn+.btn,.btn-toolbar>.btn+.btn-combo,.btn-toolbar>.btn+.btn-group,.btn-toolbar>.btn-combo+.btn,.btn-toolbar>.btn-group+.btn{margin-left:5px}.btn-combo>.btn+.dropdown-toggle,.btn-group>.btn-combo>.btn+.dropdown-toggle{padding-left:8px;padding-right:8px;-webkit-box-shadow:inset 1px 0 0 hsla(0,0%,100%,.125),inset 0 1px 0 hsla(0,0%,100%,.2),0 1px 2px rgba(0,0,0,.05);box-shadow:inset 1px 0 0 hsla(0,0%,100%,.125),inset 0 1px 0 hsla(0,0%,100%,.2),0 1px 2px rgba(0,0,0,.05)}.btn-group>.btn-combo>.btn-mini+.dropdown-toggle,.btn-group>.btn-mini+.dropdown-toggle{padding-left:5px;padding-right:5px}.btn-group>.btn-combo>.btn-large+.dropdown-toggle,.btn-group>.btn-large+.dropdown-toggle{padding-left:12px;padding-right:12px}.btn-group.open .dropdown-toggle{background-image:none;-webkit-box-shadow:inset 0 2px 4px rgba(0,0,0,.15),0 1px 2px rgba(0,0,0,.05);box-shadow:inset 0 2px 4px rgba(0,0,0,.15),0 1px 2px rgba(0,0,0,.05)}.btn-group.open .btn.dropdown-toggle{background-color:#ebeeef}.btn-group.open .btn-primary.dropdown-toggle{background-color:#40a540}.btn-group.open .btn-danger.dropdown-toggle{background-color:#ea958d}.btn-group.open .btn-success.dropdown-toggle{background-color:#40a540}.btn-group>.btn+div.tooltip+.btn{margin-left:-1px}.btn-group-vertical{display:inline-block}.btn-group-vertical>.btn{display:block;float:none;max-width:100%;border-radius:0}.btn-group-vertical>.btn+.btn{margin-left:0;margin-top:-1px}.btn-group-vertical:first-child{border-radius:3px 3px 0 0}.btn-group-vertical:last-child{border-radius:0 0 3px 3px}.btn-group-vertical>.btn-large:first-child{border-radius:3px 3px 0 0}.btn-group-vertical>.btn-large:last-child{border-radius:0 0 3px 3px}.btn-group-radio>.btn{text-overflow:ellipsis;overflow:hidden;border-color:#c3cbd4}.btn-group-radio>.btn:hover{background-color:#ebeeef}.btn-group-radio>.btn.active,.btn-group-radio>.btn:hover{-webkit-box-shadow:inset 0 2px 0 #d8dfe6;box-shadow:inset 0 2px 0 #d8dfe6}.btn-group-radio>.btn.active{cursor:default;background-color:#e1e6eb;border-color:#c3cbd4}.btn-group-radio>.btn.active:focus{cursor:default;-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.btn-group-radio>.btn.active:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.btn-group-radio>.btn.active[disabled]{cursor:not-allowed;background-color:#e1e6eb;-webkit-box-shadow:inset 0 2px 0 #d8dfe6;box-shadow:inset 0 2px 0 #d8dfe6;border-color:#e1e6eb}.btn-group-radio>.btn:disabled{-webkit-box-shadow:none;box-shadow:none;border-color:#e1e6eb;background-color:#f7f8fa}body.locale-de .btn-group-radio.locale-responsive-layout{display:block}body.locale-de .btn-group-radio.locale-responsive-layout .btn{border-radius:0;display:block;width:100%;margin-left:0;border-bottom-width:0}body.locale-de .btn-group-radio.locale-responsive-layout .btn:first-child{border-radius:3px 3px 0 0}body.locale-de .btn-group-radio.locale-responsive-layout .btn:last-child{border-radius:0 0 3px 3px;border-bottom-width:1px}.alerts:not(.alerts-view){max-height:500px;overflow-y:auto}.alert{margin-bottom:20px;border-radius:3px;position:relative;padding:8px 35px 8px 27px;word-wrap:break-word;color:#3c444d}.alert .icon-alert{font-size:200%;position:absolute;left:0;top:8px}.alert h4{color:inherit;margin:0}.alert .close{position:relative;top:-2px;right:-21px;line-height:20px}.alert-inline{display:inline-block;border:0;margin-bottom:0}.alert-warning .icon-alert{color:#f8be34}.alert-info .icon-alert{color:#006d9c}.alert-info .icon-alert:before{content:"I"}.alert-success .icon-alert{color:#53a051}.alert-success .icon-alert:before{content:"I"}.alert-404,.alert-error .icon-alert{color:#dc4e41}.alert-404:before,.alert-error .icon-alert:before{content:"\ECE2"}.nav{margin-left:0;margin-bottom:0;list-style:none}.nav>li>a{display:block}.nav>li>a:focus,.nav>li>a:hover{text-decoration:none}.nav>.pull-right{float:right}.nav-header{display:block;padding:3px 15px;font-size:12px;font-weight:700;line-height:20px;color:#818d99;text-shadow:0 1px 0 hsla(0,0%,100%,.5);text-transform:uppercase}.nav li+.nav-header{margin-top:9px}.nav-list{padding-left:15px;padding-right:15px;margin-bottom:0}.nav-list .nav-header,.nav-list>li>a{margin-left:-15px;margin-right:-15px;text-shadow:0 1px 0 hsla(0,0%,100%,.5)}.nav-list>li>a{padding:3px 15px}.nav-list>.active>a,.nav-list>.active>a:focus,.nav-list>.active>a:hover{color:#fff;text-shadow:0 -1px 0 rgba(0,0,0,.2);background-color:#006eaa}.nav-list [class*=" icon-"],.nav-list [class^=icon-]{margin-right:2px}.nav-list .divider{height:1px;margin:9px 1px;overflow:hidden;background-color:#c3cbd4}.nav-pills:after,.nav-pills:before,.nav-tabs:after,.nav-tabs:before{display:table;content:"";line-height:0}.nav-pills:after,.nav-tabs:after{clear:both}.nav-pills>li,.nav-tabs>li{float:left}.nav-pills>li>a,.nav-tabs>li>a{padding-right:15px;padding-left:15px;margin-right:2px;line-height:14px}.nav-tabs{padding:0 5px;height:38px;background-color:#fff;border-bottom:1px solid #e1e6eb}.nav-tabs>li{position:relative}.nav-tabs>li>a{line-height:34px;padding:2px 15px;color:#5c6773}.nav-tabs>li>a:before{content:"";position:absolute;width:calc(100% - 30px);height:0;bottom:0;left:14px;background-color:#e1e6eb;-webkit-transition:height .2s;transition:height .2s}.nav-tabs>li>a:hover{background:transparent}.nav-tabs>li>a:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;background-color:transparent;border-radius:3px}.nav-tabs>li>a:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.nav-tabs>li:not(.active):hover>a:before{height:3px}.nav-tabs>li.active>a:before{height:3px;background-color:#007abd}.nav-tabs>li.active,.nav-tabs>li>a.active{-webkit-box-shadow:none!important;box-shadow:none!important;border-radius:0!important;font-weight:500;color:#3c444d}.nav-pills>li>a{padding-top:8px;padding-bottom:8px;margin-top:2px;margin-bottom:2px;border-radius:5px}.nav-pills>.active>a,.nav-pills>.active>a:focus,.nav-pills>.active>a:hover{color:#fff;background-color:#006eaa}.nav-stacked>li{float:none}.nav-stacked>li>a{margin-right:0}.nav-stacked>li.nav-tabs{border-bottom:0}.nav-stacked>li.nav-tabs>li>a{border:1px solid #c3cbd4;border-radius:0}.nav-stacked>li.nav-tabs>li>a:focus,.nav-stacked>li.nav-tabs>li>a:hover{border-color:#c3cbd4;z-index:2}.nav-stacked>li.nav-tabs>li:first-child>a{border-top-right-radius:3px;border-top-left-radius:3px}.nav-stacked>li.nav-tabs>li:last-child>a{border-bottom-right-radius:3px;border-bottom-left-radius:3px}.nav-stacked>li.nav-pills>li>a{margin-bottom:3px}.nav-stacked>li.nav-pills>li:last-child>a{margin-bottom:1px}.nav-tabs .dropdown-menu{border-radius:0 0 3px 3px}.nav-pills .dropdown-menu{border-radius:3px}.nav .dropdown-toggle .caret{margin-top:6px}.nav .dropdown-toggle .caret,.nav .dropdown-toggle:focus .caret,.nav .dropdown-toggle:hover .caret{border-top-color:#006eaa;border-bottom-color:#006eaa}.nav-tabs .dropdown-toggle .caret{margin-top:8px}.nav .active .dropdown-toggle .caret{border-top-color:#fff;border-bottom-color:#fff}.nav-tabs .active .dropdown-toggle .caret{border-top-color:#5c6773;border-bottom-color:#5c6773}.nav>.dropdown.active>a:focus,.nav>.dropdown.active>a:hover{cursor:pointer}.nav-pills .open .dropdown-toggle,.nav-tabs .open .dropdown-toggle,.nav>li.dropdown.open.active>a:focus,.nav>li.dropdown.open.active>a:hover{color:#fff;background-color:#818d99;border-color:#818d99}.nav li.dropdown.open.active .caret,.nav li.dropdown.open .caret,.nav li.dropdown.open a:focus .caret,.nav li.dropdown.open a:hover .caret{border-top-color:#fff;border-bottom-color:#fff;opacity:1}.tabs-stacked .open>a:focus,.tabs-stacked .open>a:hover{border-color:#818d99}.tabbable:after,.tabbable:before{display:table;content:"";line-height:0}.tabbable:after{clear:both}.tab-content{overflow:auto}.tabs-below>.nav-tabs,.tabs-left>.nav-tabs,.tabs-right>.nav-tabs{border-bottom:0}.pill-content>.pill-pane,.tab-content>.tab-pane{display:none}.pill-content>.active,.tab-content>.active{display:block}.tabs-below>.nav-tabs{border-top:1px solid #c3cbd4}.tabs-below>.nav-tabs>li{margin-top:-1px;margin-bottom:0}.tabs-below>.nav-tabs>li>a{border-radius:0 0 3px 3px}.tabs-below>.nav-tabs>li>a:focus,.tabs-below>.nav-tabs>li>a:hover{border-bottom-color:transparent;border-top-color:#c3cbd4}.tabs-below>.nav-tabs>.active>a,.tabs-below>.nav-tabs>.active>a:focus,.tabs-below>.nav-tabs>.active>a:hover{border-color:transparent #c3cbd4 #c3cbd4}.tabs-left>li,.tabs-right>li{float:none}.tabs-left>li>a,.tabs-right>li>a{min-width:74px;margin-right:0;margin-bottom:3px}.tabs-left>.nav-tabs{float:left;margin-right:19px;border-right:1px solid #c3cbd4}.tabs-left>.nav-tabs>li>a{margin-right:-1px;border-radius:3px 0 0 3px}.tabs-left>.nav-tabs>li>a:focus,.tabs-left>.nav-tabs>li>a:hover{border-color:#e1e6eb #c3cbd4 #e1e6eb #e1e6eb}.tabs-left>.nav-tabs .active>a,.tabs-left>.nav-tabs .active>a:focus,.tabs-left>.nav-tabs .active>a:hover{border-color:#c3cbd4 transparent #c3cbd4 #c3cbd4}.tabs-right>.nav-tabs{float:right;margin-left:19px;border-left:1px solid #c3cbd4}.tabs-right>.nav-tabs>li>a{margin-left:-1px;border-radius:0 3px 3px 0}.tabs-right>.nav-tabs>li>a:focus,.tabs-right>.nav-tabs>li>a:hover{border-color:#e1e6eb #e1e6eb #e1e6eb #c3cbd4}.tabs-right>.nav-tabs .active>a,.tabs-right>.nav-tabs .active>a:focus,.tabs-right>.nav-tabs .active>a:hover{border-color:#c3cbd4 #c3cbd4 #c3cbd4 transparent}.nav-tabs .dropdown-toggle .caret,.nav .dropdown-toggle .caret,.navbar .nav .dropdown-toggle .caret{margin-top:0}.nav>.disabled>a{color:#c3cbd4}.nav>.disabled>a:focus,.nav>.disabled>a:hover{text-decoration:none;background-color:transparent;cursor:default}@media print{.app-bar,header{display:none!important}.main-tabs{border:none!important}.main-tabs li.active:after,.main-tabs li.active:before,.main-tabs li:not(.active){display:none!important}}.navbar{overflow:visible;margin-bottom:0}.navbar .container{width:auto}.navbar .brand{float:left;display:block;padding:7px 20px;margin-left:-20px;font-size:20px;font-weight:200;color:#006eaa;text-shadow:0 1px 0 #fff}.navbar .brand:focus,.navbar .brand:hover{text-decoration:none}.navbar .divider-vertical{height:34px;margin:0 9px;border-left:1px solid #171d21;border-right:1px solid #fff}.navbar .btn,.navbar .btn-group{margin-top:2px}.navbar .btn-group .btn,.navbar .input-append .btn,.navbar .input-append .btn-group,.navbar .input-prepend .btn,.navbar .input-prepend .btn-group{margin-top:0}.navbar-inner{min-height:34px;padding-left:20px;padding-right:20px;background-image:-webkit-gradient(linear,left top,left bottom,from(#fff),to(#171d21));background-image:linear-gradient(180deg,#fff,#171d21);border:1px solid #000;border-radius:3px;-webkit-box-shadow:0 1px 4px rgba(0,0,0,.065);box-shadow:0 1px 4px rgba(0,0,0,.065)}.navbar-inner:after,.navbar-inner:before{display:table;content:"";line-height:0}.navbar-inner:after{clear:both}.nav-collapse.collapse{height:auto;overflow:visible}.navbar-text{margin-bottom:0;line-height:34px}.navbar-link,.navbar-text{color:#c3cbd4}.navbar-link:focus,.navbar-link:hover{color:#3c444d}.navbar-form{margin-bottom:0}.navbar-form:after,.navbar-form:before{display:table;content:"";line-height:0}.navbar-form:after{clear:both}.navbar-form .checkbox,.navbar-form .radio,.navbar-form input,.navbar-form select{margin-top:2px}.navbar-form .btn,.navbar-form input,.navbar-form select{display:inline-block;margin-bottom:0}.navbar-form input[type=checkbox],.navbar-form input[type=image],.navbar-form input[type=radio]{margin-top:3px}.navbar-form .input-append,.navbar-form .input-prepend{margin-top:5px;white-space:nowrap}.navbar-form .input-append input,.navbar-form .input-prepend input{margin-top:0}.navbar-search{position:relative;float:left;margin-top:2px;margin-bottom:0}.navbar-search .search-query{margin-bottom:0;padding:4px 14px;font-family:Georgia,Times New Roman,Times,serif;font-size:13px;font-weight:400;line-height:1;border-radius:15px}.navbar-static-top{position:static;margin-bottom:0}.navbar-static-top .navbar-inner{border-radius:0}.navbar-fixed-bottom,.navbar-fixed-top{position:fixed;right:0;left:0;z-index:1030;margin-bottom:0}.navbar-fixed-bottom .navbar-inner,.navbar-fixed-top .navbar-inner{padding-left:0;padding-right:0;border-radius:0}.navbar-fixed-top .navbar-inner,.navbar-static-top .navbar-inner{border-width:0 0 1px;-webkit-box-shadow:0 1px 10px rgba(0,0,0,.1);box-shadow:0 1px 10px rgba(0,0,0,.1)}.navbar-fixed-top{top:0}.navbar-fixed-bottom{bottom:0}.navbar-fixed-bottom .navbar-inner{border-width:1px 0 0;-webkit-box-shadow:0 -1px 10px rgba(0,0,0,.1);box-shadow:0 -1px 10px rgba(0,0,0,.1)}.navbar-fixed-bottom .container,.navbar-fixed-top .container,.navbar-static-top .container{width:940px}.navbar .nav{position:relative;left:0;display:block;float:left;margin:0 10px 0 0}.navbar .nav.pull-right{float:right;margin-right:0}.navbar .nav>li{float:left}.navbar .nav>li>a{float:none;padding:7px 15px;color:#c3cbd4;text-decoration:none;text-shadow:0 1px 0 #fff}.navbar .nav>li>a:focus,.navbar .nav>li>a:hover{background-color:transparent;color:#3c444d;text-decoration:none}.navbar .nav>li>.dropdown-menu:before{content:"";display:inline-block;border-left:7px solid transparent;border-right:7px solid transparent;border-bottom:7px solid #c3cbd4;position:absolute;top:-7px;left:9px}.navbar .nav>li>.dropdown-menu:after{content:"";display:inline-block;border-left:6px solid transparent;border-right:6px solid transparent;border-bottom:6px solid #fff;position:absolute;top:-6px;left:10px}.navbar .nav>li.dropdown>a:focus .caret,.navbar .nav>li.dropdown>a:hover .caret{border-top-color:#3c444d;border-bottom-color:#3c444d}.navbar .nav>li.dropdown.active>.dropdown-toggle,.navbar .nav>li.dropdown.open.active>.dropdown-toggle,.navbar .nav>li.dropdown.open>.dropdown-toggle{background-color:#0d1012;color:#5c6773}.navbar .nav>li.dropdown.active>.dropdown-toggle .caret,.navbar .nav>li.dropdown.open.active>.dropdown-toggle .caret,.navbar .nav>li.dropdown.open>.dropdown-toggle .caret{border-top-color:#5c6773;border-bottom-color:#5c6773}.navbar .nav>li.dropdown>.dropdown-toggle .caret{border-top-color:#c3cbd4;border-bottom-color:#c3cbd4}.navbar .nav .dropdown-toggle .caret{margin-top:8px}.navbar .nav>.active>a,.navbar .nav>.active>a:focus,.navbar .nav>.active>a:hover{color:#5c6773;text-decoration:none;background-color:#0d1012;-webkit-box-shadow:inset 0 3px 8px rgba(0,0,0,.125);box-shadow:inset 0 3px 8px rgba(0,0,0,.125)}.navbar .btn-navbar{display:none;float:right;padding:7px 10px;margin-left:5px;margin-right:5px;background-color:#f7f8fa;border-color:#c3cbd4;color:#5c6773;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);box-shadow:inset 0 -1px 0 rgba(0,0,0,.1);text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none;-webkit-box-shadow:inset 0 1px 0 hsla(0,0%,100%,.1),0 1px 0 hsla(0,0%,100%,.075);box-shadow:inset 0 1px 0 hsla(0,0%,100%,.1),0 1px 0 hsla(0,0%,100%,.075)}.navbar .btn-navbar .icon-bar{display:block;width:18px;height:2px;background-color:#f5f5f5;border-radius:1px;-webkit-box-shadow:0 1px 0 rgba(0,0,0,.25);box-shadow:0 1px 0 rgba(0,0,0,.25)}.navbar .btn-navbar .icon-bar+.icon-bar{margin-top:3px}.navbar .nav>li>.dropdown-menu.pull-right,.navbar .pull-right>li>.dropdown-menu{left:auto;right:0}.navbar .nav>li>.dropdown-menu.pull-right:before,.navbar .pull-right>li>.dropdown-menu:before{left:auto;right:12px}.navbar .nav>li>.dropdown-menu.pull-right:after,.navbar .pull-right>li>.dropdown-menu:after{left:auto;right:13px}.navbar .nav>li>.dropdown-menu.pull-right .dropdown-menu,.navbar .pull-right>li>.dropdown-menu .dropdown-menu{left:auto;right:100%;margin-left:0;margin-right:-1px;border-radius:6px 0 6px 6px}.navbar-fixed-bottom .nav>li>.dropdown-menu:before{border-top:7px solid #c3cbd4;border-bottom:0;bottom:-7px;top:auto}.navbar-fixed-bottom .nav>li>.dropdown-menu:after{border-top:6px solid #fff;border-bottom:0;bottom:-6px;top:auto}.pagination{height:auto}.pagination>ul{display:inline-block;margin-left:0;margin-bottom:0;list-style:none}.pagination>ul>li{float:left}.pagination>ul>li>a,.pagination>ul>li>span{padding:5px 14px;float:left;line-height:20px;border-radius:3px;background-color:none;border:1px solid transparent;color:#5c6773;-webkit-box-shadow:none;box-shadow:none;text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.pagination>ul>li>a:hover,.pagination>ul>li>span:hover{color:#006eaa;background:#ebeeef;border-color:#c3cbd4;text-decoration:none}.pagination>ul>li>a:focus,.pagination>ul>li>span:focus{color:#006eaa;background:none;border-color:transparent;-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.pagination>ul>li>a:focus:active:not([disabled]),.pagination>ul>li>span:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.pagination>ul>li>a.active,.pagination>ul>li>a:active,.pagination>ul>li>span.active,.pagination>ul>li>span:active{color:#5c6773;background:#e1e6eb;border-color:transparent;text-decoration:none}.pagination>ul>li>a.disabled,.pagination>ul>li>a.disabled:active,.pagination>ul>li>a.disabled:focus,.pagination>ul>li>a.disabled:hover,.pagination>ul>li>a[disabled],.pagination>ul>li>a[disabled]:active,.pagination>ul>li>a[disabled]:focus,.pagination>ul>li>a[disabled]:hover,.pagination>ul>li>span.disabled,.pagination>ul>li>span.disabled:active,.pagination>ul>li>span.disabled:focus,.pagination>ul>li>span.disabled:hover,.pagination>ul>li>span[disabled],.pagination>ul>li>span[disabled]:active,.pagination>ul>li>span[disabled]:focus,.pagination>ul>li>span[disabled]:hover{color:#c3cbd4;background:none;border-color:transparent;text-decoration:none;-webkit-box-shadow:none;box-shadow:none;cursor:not-allowed}.pagination>ul>li>a:not(.page-controls),.pagination>ul>li>span:not(.page-controls){padding:5px 10px;margin:0 1px}.pagination>ul>li>a:not(.page-controls).btn-square,.pagination>ul>li>span:not(.page-controls).btn-square{padding:5px 0}.pagination>ul .active>a,.pagination>ul .active>a:hover{cursor:default;border:1px solid #007abd;color:#007abd}.pagination>ul .icon-chevron-left,.pagination>ul .icon-triangle-left-small{padding-right:6.66667px}.pagination>ul .icon-chevron-right,.pagination>ul .icon-triangle-right-small{padding-left:6.66667px}.pagination>ul>.disabled>a,.pagination>ul>.disabled>a:focus,.pagination>ul>.disabled>a:hover,.pagination>ul>.disabled>span{background-color:transparent;border-color:transparent;color:#c3cbd4;cursor:default;-webkit-box-shadow:none;box-shadow:none}.pagination .max-events-per-bucket{color:#f8be34;font-size:18px}.splunk-paginator.splunk-view{padding:0 10px}.splunk-paginator.splunk-view .disabled,.splunk-paginator.splunk-view a.selected{color:#c3cbd4;cursor:default}.splunk-paginator.splunk-view a.selected{color:#006eaa;border:1px solid #006eaa;background:transparent}.splunk-paginator.splunk-view a{border:1px solid transparent;border-radius:3px;color:#5c6773;padding:2px 8px;text-decoration:none;min-width:10px;line-height:20px;display:inline-block;text-align:center}.splunk-paginator.splunk-view a:hover{background:#f7f8fa}.splunk-paginator.splunk-view a:disabled{background:none}.splunk-paginator.splunk-view span{padding-left:5px;padding-right:5px}.pager{margin:20px 0;list-style:none;text-align:center}.pager:after,.pager:before{display:table;content:"";line-height:0}.pager:after{clear:both}.pager li{display:inline}.pager li>a,.pager li>span{display:inline-block;padding:5px 14px;background-color:#fff;border:1px solid #c3cbd4;border-radius:15px}.pager li>a:focus,.pager li>a:hover{text-decoration:none;background-color:#f7f8fa}.pager .next>a,.pager .next>span{float:right}.pager .previous>a,.pager .previous>span{float:left}.pager .disabled>a,.pager .disabled>a:focus,.pager .disabled>a:hover,.pager .disabled>span{text-decoration:none;background-color:#f7f8fa}.body-modal-open{overflow:hidden}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;z-index:1040;background-color:#3c444d}.modal-backdrop.fade{opacity:0}.modal-backdrop,.modal-backdrop.fade.in{opacity:.8}.modal{position:fixed;top:40px;left:50%;width:550px;margin-left:-275px;z-index:1050;background-color:#fff;border:none;-webkit-box-shadow:0 3px 7px rgba(0,0,0,.3);box-shadow:0 3px 7px rgba(0,0,0,.3);background-clip:border-box;outline:none}.modal .form-horizontal{width:550px;-webkit-box-sizing:border-box;box-sizing:border-box}.modal.fade{-webkit-transition:opacity .125s,top .125s ease;transition:opacity .125s,top .125s ease;top:0}.modal.fade.in{top:40px}.modal:after{content:"";font-size:0;display:inline;overflow:hidden}.modal-header{border:none;position:relative;background:#fff;padding:20px}.modal-header .modal-title,.modal-header h1,.modal-header h3{font-size:20px;font-weight:500;line-height:22px;margin:0;overflow-wrap:break-word;padding-right:40px}.modal-header .close{top:20px;right:20px;margin-top:-2px;position:absolute;background-color:none;border:1px solid transparent;color:#5c6773;-webkit-box-shadow:none;box-shadow:none;text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none}.modal-header .close:hover{color:#006eaa;background:#ebeeef;border-color:#c3cbd4;text-decoration:none}.modal-header .close:focus{color:#006eaa;background:none;border-color:transparent;-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.modal-header .close:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.modal-header .close.active,.modal-header .close:active{color:#5c6773;background:#e1e6eb;border-color:transparent;text-decoration:none}.modal-header .close.disabled,.modal-header .close.disabled:active,.modal-header .close.disabled:focus,.modal-header .close.disabled:hover,.modal-header .close[disabled],.modal-header .close[disabled]:active,.modal-header .close[disabled]:focus,.modal-header .close[disabled]:hover{color:#c3cbd4;background:none;border-color:transparent;text-decoration:none;-webkit-box-shadow:none;box-shadow:none;cursor:not-allowed}.modal-body{position:relative;padding:0 20px;overflow:visible;max-height:calc(100vh - 246px)}.modal-body:last-child{max-height:calc(100vh - 259px)}.modal-form{margin-bottom:0}.modal-body-scrolling{overflow-y:auto;padding:20px;position:relative;border-top:1px solid #e1e6eb;border-bottom:1px solid #e1e6eb}.modal-footer{padding:20px;margin-bottom:0;text-align:right;background:#fff}.modal-footer:after,.modal-footer:before{display:table;content:"";line-height:0}.modal-footer:after{clear:both}.modal-footer>.btn{min-width:80px}.modal-footer>.btn+.btn:not(.pull-left){margin-left:10px;margin-bottom:0}.modal-footer>.btn-group .btn+.btn{margin-left:-1px}.modal-footer>.btn-block+.btn-block{margin-left:0}.modal-footer:empty{padding:0}.modal-wide{width:800px;margin-left:-400px}.modal-wide .form-horizontal{width:800px;-webkit-box-sizing:border-box;box-sizing:border-box}.modal.disconnection-warning-modal{z-index:1090}.shared-splunkbar-messages-noconnectionoverlay .modal-backdrop{z-index:1080}.modal-loading{text-align:center;color:#6b7785}.shared-whatsnewdialog.modal{width:900px;margin-left:-450px}.shared-whatsnewdialog.modal .modal-body{padding-right:0}.shared-whatsnewdialog h2{font-weight:200;font-size:24px;margin:0 0 20px -20px;padding-left:20px}.shared-whatsnewdialog .feature{display:inline-block;width:260px;margin:0 20px 20px 0;position:relative;vertical-align:top}.shared-whatsnewdialog .feature>h3{margin:0 0 5px}.shared-whatsnewdialog .feature>img{display:block;width:100%;height:170px;border:1px solid #c3cbd4;margin-bottom:10px}.shared-whatsnewdialog .feature>p{margin:0}.shared-whatsnewdialog .feature+h2{padding-top:20px;border-top:1px dotted #c3cbd4}.tooltip{position:absolute;z-index:1070;display:block;visibility:visible;font-size:12px;line-height:1.4;opacity:0}.tooltip.in{opacity:.85}.tooltip.top{margin-top:-3px;padding:5px 0}.tooltip.right{margin-left:3px;padding:0 5px}.tooltip.bottom{margin-top:3px;padding:5px 0}.tooltip.left{margin-left:-3px;padding:0 5px}.tooltip-inner{max-width:200px;padding:6px 12px;color:#fff;text-align:center;text-decoration:none;background-color:#000}.tooltip-arrow{position:absolute;width:0;height:0;border-color:transparent;border-style:solid}.tooltip.top .tooltip-arrow{bottom:0;left:50%;margin-left:-5px;border-width:5px 5px 0;border-top-color:#000}.tooltip.right .tooltip-arrow{top:50%;left:0;margin-top:-5px;border-width:5px 5px 5px 0;border-right-color:#000}.tooltip.left .tooltip-arrow{top:50%;right:0;margin-top:-5px;border-width:5px 0 5px 5px;border-left-color:#000}.tooltip.bottom .tooltip-arrow{top:0;left:50%;margin-left:-5px;border-width:0 5px 5px;border-bottom-color:#000}.thumbnails{margin-left:-20px;list-style:none}.thumbnails:after,.thumbnails:before{display:table;content:"";line-height:0}.thumbnails:after{clear:both}.row-fluid .thumbnails{margin-left:0}.thumbnails>li{float:left;margin-bottom:20px;margin-left:20px}.thumbnail{display:block;padding:4px;line-height:20px;border:1px solid #ddd;border-radius:3px;-webkit-box-shadow:0 1px 3px rgba(0,0,0,.055);box-shadow:0 1px 3px rgba(0,0,0,.055);-webkit-transition:all .2s ease-in-out;transition:all .2s ease-in-out}a.thumbnail:focus,a.thumbnail:hover{border-color:#006eaa;-webkit-box-shadow:0 1px 4px rgba(0,105,214,.25);box-shadow:0 1px 4px rgba(0,105,214,.25)}.thumbnail>img{display:block;max-width:100%;margin-left:auto;margin-right:auto}.thumbnail .caption{padding:9px;color:#5c6773}.badge,.label{display:inline-block;padding:2px 4px;font-size:11.844px;font-weight:700;line-height:14px;color:#fff;vertical-align:baseline;white-space:nowrap;text-shadow:0 -1px 0 rgba(0,0,0,.25);background-color:#818d99}.label{border-radius:3px}.badge{padding-left:9px;padding-right:9px;border-radius:9px}.badge:empty,.label:empty{display:none}a.badge:focus,a.badge:hover,a.label:focus,a.label:hover{color:#fff;text-decoration:none;cursor:pointer}.badge-important,.label-important{background-color:#f8dcd9}.badge-important[href],.label-important[href]{background-color:#f0b4ad}.badge-warning,.label-warning{background-color:#f1813f}.badge-warning[href],.label-warning[href]{background-color:#ed6212}.badge-success,.label-success{background-color:#53a051}.badge-success[href],.label-success[href]{background-color:#417d3f}.badge-info,.label-info{background-color:#006d9c}.badge-info[href],.label-info[href]{background-color:#004b6b}.badge-inverse,.label-inverse{background-color:#3c444d}.badge-inverse[href],.label-inverse[href]{background-color:#262b31}.btn .badge,.btn .label{position:relative;top:-1px}.btn-mini .badge,.btn-mini .label{top:0}.label{padding:1px 4px 0;border-radius:4px;line-height:17px;font-size:12px;font-weight:400;text-transform:uppercase;color:#3c444d;text-shadow:none;background-color:#c3cbd4;border:1px solid #3c444d}.label [class*=icon-]{font-size:16px;margin-right:3px;vertical-align:middle}.label-important{background-color:#f8dcd9;border-color:#dc4e41;color:#dc4e41}.label-warning{background-color:#fdefe7;border-color:#f1813f;color:#f1813f}.label-success{background-color:#ddecdd;border-color:#53a051;color:#53a051}.label-info{background-color:#fef2d7;border-color:#f8be34;color:#f8be34}.label-inverse{background-color:#5c6773;border-color:#3c444d;color:#fff}@-webkit-keyframes progress-bar-stripes{0%{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{0%{background-position:40px 0}to{background-position:0 0}}.spinner-small{background-image:url(/static/img/skins/default/loading_small.png);background-position:0 0;width:14px;height:14px;background-size:280px 14px}.spinner-medium{background-image:url(/static/img/skins/default/loading_medium.png);background-position:0 0;width:19px;height:19px;background-size:380px 19px}@media (-webkit-min-device-pixel-ratio:2),(min-resolution:192dpi){.spinner-small{background-image:url(/static/img/skins/default/loading_small_2x.png)}.spinner-medium{background-image:url(/static/img/skins/default/loading_medium_2x.png)}}.progress{overflow:hidden;height:20px;margin-bottom:20px;background-image:-webkit-gradient(linear,left top,left bottom,from(#f5f5f5),to(#f9f9f9));background-image:linear-gradient(180deg,#f5f5f5,#f9f9f9);-webkit-box-shadow:inset 0 1px 2px rgba(0,0,0,.1);box-shadow:inset 0 1px 2px rgba(0,0,0,.1);background-color:#f7f8fa;border-radius:3px}.progress .bar,.progress .progress-bar{width:0;height:100%;color:#fff;float:left;font-size:12px;text-align:center;-webkit-transition:width .6s ease;transition:width .6s ease}.progress .bar{background-color:#007abd;-webkit-box-shadow:inset 0 -1px 0 rgba(0,0,0,.15);box-shadow:inset 0 -1px 0 rgba(0,0,0,.15);-webkit-box-sizing:border-box;box-sizing:border-box}.progress .bar+.bar{-webkit-box-shadow:inset 1px 0 0 rgba(0,0,0,.15),inset 0 -1px 0 rgba(0,0,0,.15);box-shadow:inset 1px 0 0 rgba(0,0,0,.15),inset 0 -1px 0 rgba(0,0,0,.15)}.progress .progress-bar{line-height:20px;background-color:#c3cbd4}.progress .progress-striped.progress-bar{background-color:#c3cbd4}.progress-striped .bar,.progress .progress-striped.progress-bar{background-image:linear-gradient(45deg,hsla(0,0%,100%,.15) 25%,transparent 0,transparent 50%,hsla(0,0%,100%,.15) 0,hsla(0,0%,100%,.15) 75%,transparent 0,transparent);background-size:40px 40px}.progress-striped .bar{background-color:#007abd}.active.progress-bar,.progress.active .bar{-webkit-animation:progress-bar-stripes 2s linear infinite;animation:progress-bar-stripes 2s linear infinite}.progress-danger .bar,.progress .bar-danger{background:#dc4e41}.progress-danger.progress-striped .bar,.progress-striped .bar-danger{background-color:#dc4e41;background-image:linear-gradient(45deg,hsla(0,0%,100%,.15) 25%,transparent 0,transparent 50%,hsla(0,0%,100%,.15) 0,hsla(0,0%,100%,.15) 75%,transparent 0,transparent)}.progress-success .bar,.progress .bar-success{background:#53a051}.progress-striped .bar-success,.progress-success.progress-striped .bar{background-color:#53a051;background-image:linear-gradient(45deg,hsla(0,0%,100%,.15) 25%,transparent 0,transparent 50%,hsla(0,0%,100%,.15) 0,hsla(0,0%,100%,.15) 75%,transparent 0,transparent)}.progress-info .bar,.progress .bar-info{background:#006d9c}.progress-info.progress-striped .bar,.progress-striped .bar-info{background-color:#006d9c;background-image:linear-gradient(45deg,hsla(0,0%,100%,.15) 25%,transparent 0,transparent 50%,hsla(0,0%,100%,.15) 0,hsla(0,0%,100%,.15) 75%,transparent 0,transparent)}.progress-warning .bar,.progress .bar-warning{background:#f1813f}.progress-striped .bar-warning,.progress-warning.progress-striped .bar{background-color:#f1813f;background-image:linear-gradient(45deg,hsla(0,0%,100%,.15) 25%,transparent 0,transparent 50%,hsla(0,0%,100%,.15) 0,hsla(0,0%,100%,.15) 75%,transparent 0,transparent)}.accordion{margin-bottom:0;background:#fff}.accordion-heading{border-bottom:0;position:relative}.accordion-heading .accordion-toggle{display:block;padding:5px 14px 5px 30px;line-height:20px;background-color:#f2f4f5;color:#5c6773;text-decoration:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none;cursor:pointer}.accordion-heading .accordion-toggle .icon-triangle-right-small:before{content:"\203A"}.accordion-heading .accordion-toggle .icon-triangle-down-small:before{content:"\2C5"}.accordion-group{margin-bottom:2px;border:none;border-radius:0}.accordion-group:first-child .accordion-toggle{border-top:none}.accordion-group.active:last-child .accordion-body,.accordion-group:last-child .accordion-toggle{border-bottom:none}.accordion-group .accordion-toggle:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #f2f4f5,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #f2f4f5,inset 0 0 0 2px #00a4fd}.accordion-group .accordion-toggle:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.accordion-group.active .accordion-toggle{background:#fff;border-bottom:none;cursor:default}.accordion-group.active .accordion-toggle:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #fff,inset 0 0 0 2px #00a4fd}.accordion-group.active .accordion-toggle:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.accordion-group:not(.active) .accordion-toggle:hover{background-color:#e1e6eb;-webkit-box-shadow:none;box-shadow:none}.accordion-group:not(.active) .accordion-toggle:hover:focus{-webkit-box-shadow:none;box-shadow:none;border-collapse:separate;outline:0;text-decoration:none;-webkit-box-shadow:inset 0 0 2px 1px #e1e6eb,inset 0 0 0 2px #00a4fd;box-shadow:inset 0 0 2px 1px #e1e6eb,inset 0 0 0 2px #00a4fd}.accordion-group:not(.active) .accordion-toggle:hover:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.icon-accordion-toggle{position:absolute;left:10px}.accordion-body{background-color:#fff}.accordion-inner{padding:10px 20px 20px;border:none;position:relative}.accordion-inner:after,.accordion-inner:before{display:table;content:"";line-height:0}.accordion-inner:after{clear:both}.carousel{position:relative;margin-bottom:20px;line-height:1}.carousel-inner{overflow:hidden;width:100%;position:relative}.carousel-inner>.item{display:none;position:relative;-webkit-transition:left .6s ease-in-out;transition:left .6s ease-in-out}.carousel-inner>.item>a>img,.carousel-inner>.item>img{display:block;line-height:1}.carousel-inner>.active,.carousel-inner>.next,.carousel-inner>.prev{display:block}.carousel-inner>.next,.carousel-inner>.prev{position:absolute;top:0;width:100%}.carousel-inner>.next{left:100%}.carousel-inner>.prev{left:-100%}.carousel-inner>.active,.carousel-inner>.next.left,.carousel-inner>.prev.right{left:0}.carousel-inner>.active.left,.carousel-inner>.active.right{left:100%}.carousel-control{position:absolute;top:40%;left:15px;width:40px;height:40px;margin-top:-20px;font-size:60px;font-weight:100;line-height:30px;color:#fff;text-align:center;background:#171d21;border:3px solid #fff;border-radius:23px;opacity:.5}.carousel-control.right{left:auto;right:15px}.carousel-control:focus,.carousel-control:hover{color:#fff;text-decoration:none;opacity:.9}.carousel-indicators{position:absolute;top:15px;right:15px;z-index:5;margin:0;list-style:none}.carousel-indicators li{display:block;float:left;width:10px;height:10px;margin-left:5px;text-indent:-999px;background-color:#c3cbd4;background-color:hsla(0,0%,100%,.25);border-radius:5px}.carousel-indicators .active{background-color:#fff}.carousel-caption{position:absolute;left:0;right:0;bottom:0;padding:15px;background:#3c444d;background:rgba(0,0,0,.75)}.carousel-caption h4,.carousel-caption p{color:#fff;line-height:20px}.carousel-caption h4{margin:0 0 5px}.carousel-caption p{margin-bottom:0}.pull-right{float:right}.pull-left{float:left}.hide{display:none}.show{display:block}.invisible{visibility:hidden}.affix{position:fixed}.clearfix:after,.clearfix:before{display:table;content:"";line-height:0}.clearfix:after{clear:both}.hide-text{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0;position:absolute;width:0}.input-block-level{display:block;width:100%;min-height:32px;-webkit-box-sizing:border-box;box-sizing:border-box}.visuallyhidden{clip:rect(0 0 0 0);position:absolute;width:1px;height:1px;margin:-1px;overflow:hidden;border:0}.ui-widget{font-family:inherit}.ui-widget-header{font-weight:400;background:transparent;border:0;color:#3c444d}.ui-widget-header a{color:#000}.ui-corner-all{border-radius:2px}.ui-icon{font-family:Splunk Icons;width:20px;height:20px}.ui-tabs .ui-widget-header{background:none;border-bottom:1px solid #c3cbd4;border-radius:0}.ui-tabs .ui-tabs-nav li{margin-bottom:-1px}.ui-tabs .ui-tabs-nav li,.ui-tabs .ui-tabs-nav li.ui-tabs-selected{border-bottom:1px solid #c3cbd4!important}.ui-accordion .ui-accordion-header .ui-icon{left:.5em;margin-top:-8px;position:absolute;top:50%}.ui-accordion-icons .ui-accordion-header a{padding-left:2.2em}#ui-datepicker-div{display:none;z-index:1070!important}.ui-datepicker{border:1px solid #c3cbd4;-webkit-box-shadow:1px 2px 5px rgba(0,0,0,.2);box-shadow:1px 2px 5px rgba(0,0,0,.2);border-radius:2px;top:100%;left:50%;display:none;position:absolute;z-index:1060;white-space:normal;background-color:#fff;width:17em;height:auto;position:relative;padding:5px;margin:0}.ui-datepicker .arrow{border-bottom:8px solid #c3cbd4;top:-8px;left:50%;margin-left:-4px}.ui-datepicker .arrow,.ui-datepicker .arrow:before{position:absolute;height:0;width:0;border-left:8px solid transparent;border-right:8px solid transparent;content:"";display:block;border-top:0}.ui-datepicker .arrow:before{border-bottom:8px solid #fff;top:1px;left:-8px}.ui-datepicker.up{margin-top:0}.ui-datepicker.up>.arrow{border-top:8px solid #c3cbd4;bottom:-8px}.ui-datepicker.up>.arrow,.ui-datepicker.up>.arrow:before{position:absolute;height:0;width:0;border-left:8px solid transparent;border-right:8px solid transparent;content:"";display:block;border-bottom:0;top:auto}.ui-datepicker.up>.arrow:before{border-top:8px solid #fff;bottom:1px}.ui-datepicker.right{margin-left:5px;margin-top:0}.ui-datepicker.right .arrow{border-right:8px solid #c3cbd4;left:-8px}.ui-datepicker.right .arrow,.ui-datepicker.right .arrow:before{position:absolute;height:0;width:0;border-bottom:8px solid transparent;border-top:8px solid transparent;content:"";display:block;border-left:0;top:50%;margin:-8px 0 0}.ui-datepicker.right .arrow:before{border-right:8px solid #fff;left:1px}.ui-datepicker.pull-right .arrow{left:auto;right:8px}.ui-datepicker.open{display:block}.ui-datepicker .ui-datepicker-header{position:relative;padding:.2em 0;background:transparent}.ui-datepicker .ui-datepicker-title{margin:0 2.3em;line-height:32px;text-align:center}.ui-datepicker .ui-datepicker-next,.ui-datepicker .ui-datepicker-prev{position:absolute;text-decoration:none}.ui-datepicker .ui-datepicker-next .ui-icon,.ui-datepicker .ui-datepicker-prev .ui-icon{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0;position:absolute;width:0;left:0}.ui-datepicker .ui-datepicker-next .ui-icon:after,.ui-datepicker .ui-datepicker-prev .ui-icon:after{display:block;position:absolute;top:0;left:0;text-align:center;width:32px;line-height:32px;color:#5c6773;text-indent:0;font-size:12px;font-family:Splunk Icons}.ui-datepicker .ui-datepicker-prev .ui-icon:after{content:"\25C0"}.ui-datepicker .ui-datepicker-next{top:0;right:0}.ui-datepicker .ui-datepicker-next .ui-icon:after{content:"\25B6"}.ui-datepicker table{width:100%;border-collapse:collapse;margin:0 0 .4em}.ui-datepicker .ui-datepicker-calendar{margin:0}.ui-datepicker .ui-datepicker-calendar th{line-height:10px;padding:20px .3em .7em;color:#6b7785;text-align:center;border:0;font-weight:400}.ui-datepicker .ui-datepicker-calendar td{padding:1px}.ui-datepicker .ui-datepicker-calendar td a{display:block;padding:.2em;text-align:right;color:#5c6773}.ui-datepicker .ui-datepicker-calendar a{border:1px solid #c3cbd4}.ui-datepicker .ui-datepicker-calendar a:hover{text-decoration:none}.ui-datepicker .ui-datepicker-calendar .ui-state-default{background:#fff;border:1px solid #c3cbd4;color:#5c6773}.ui-datepicker .ui-datepicker-calendar .ui-state-active{background-color:#f7f8fa;border-color:#007abd;color:#006eaa}.ui-datepicker .ui-datepicker-calendar .ui-state-hover{border-color:#00a4fd;background:#f7f8fa;color:#006eaa}.ui-datepicker a.ui-corner-all{display:inline-block;border-radius:3px;background-color:none;border-color:transparent;color:#5c6773;-webkit-box-shadow:none;box-shadow:none;text-decoration:none;text-shadow:none;-webkit-transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s;transition:background .2s,border .2s,box-shadow .2s,text-decoration .2s,-webkit-box-shadow .2s,-webkit-text-decoration .2s;-webkit-filter:none;filter:none;width:32px;height:32px;text-align:center;padding:0}.ui-datepicker a.ui-corner-all:hover{text-decoration:none}.ui-datepicker a.ui-corner-all:focus{color:#006eaa;text-decoration:underline;-webkit-box-shadow:0 0 1px 2px rgba(0,164,253,.6);box-shadow:0 0 1px 2px rgba(0,164,253,.6);border-collapse:separate;outline:0;text-decoration:none}.ui-datepicker a.ui-corner-all:focus:active:not([disabled]){-webkit-box-shadow:none;box-shadow:none}.ui-datepicker a.ui-corner-all.active,.ui-datepicker a.ui-corner-all:active{color:#006eaa;text-decoration:none}.ui-datepicker a.ui-corner-all.disabled,.ui-datepicker a.ui-corner-all.disabled:active,.ui-datepicker a.ui-corner-all.disabled:focus,.ui-datepicker a.ui-corner-all.disabled:hover,.ui-datepicker a.ui-corner-all[disabled],.ui-datepicker a.ui-corner-all[disabled]:active,.ui-datepicker a.ui-corner-all[disabled]:focus,.ui-datepicker a.ui-corner-all[disabled]:hover{color:#c3cbd4;text-decoration:none;cursor:not-allowed}.ui-datepicker a.ui-corner-all:hover{cursor:pointer;color:#006eaa;background:#f7f8fa;font-weight:400}.ui-datepicker a.ui-corner-all:hover .ui-icon:after{color:#006eaa}.ui-resizable{position:relative}.ui-resizable-handle{position:absolute;font-size:.1px;z-index:99999;display:block}.ui-resizable-autohide .ui-resizable-handle,.ui-resizable-disabled .ui-resizable-handle{display:none}.ui-resizable-n{cursor:n-resize;height:7px;width:100%;top:-5px;left:0}.ui-resizable-s{cursor:s-resize;height:7px;width:100%;bottom:-5px;left:0}.ui-resizable-e{cursor:e-resize;width:7px;right:-5px;top:0;height:100%}.ui-resizable-w{cursor:w-resize;width:7px;left:-5px;top:0;height:100%}.ui-resizable-se{cursor:se-resize;width:12px;height:12px;right:1px;bottom:1px}.ui-resizable-sw{cursor:sw-resize;width:9px;height:9px;left:-5px;bottom:-5px}.ui-resizable-nw{cursor:nw-resize;width:9px;height:9px;left:-5px;top:-5px}.ui-resizable-ne{cursor:ne-resize;width:9px;height:9px;right:-5px;top:-5px}.ui-resizable-handle{width:100%;height:9px;background-color:transparent;z-index:1000;cursor:ns-resize;cursor:row-resize;bottom:0}.ui-resizable-handle:before{content:"";position:absolute;top:50%;left:50%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%);margin-top:-1px;display:block;border-radius:3px;border:none;height:6px;width:6px;background-color:rgba(0,0,0,.25)}.ui-resizable-handle .ui-draggable-dragging{position:relative}.ui-resizable:hover .ui-resizable-handle{visibility:visible} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/appserver/static/cim_setup.css b/deps/apps/Splunk_SA_CIM/appserver/static/cim_setup.css new file mode 100644 index 000000000..05491e699 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/appserver/static/cim_setup.css @@ -0,0 +1,220 @@ +.section-header { + border-bottom: 1px solid #C3CBD4; +} +.section-header .title { + margin-top: 0px; + margin-bottom: 0px; + font-size: 24px; +} +.cimSetupWrapper { + border: 1px solid #ccc; + margin: 30px auto; + width: 70%; + min-width: 1000px; +} +#cim_setup_container .modal-footer { + border-top: 1px solid #C3CBD4; +} +#cim_setup_container .modal-header { + border-bottom: 1px solid #C3CBD4; +} +#cim_setup_container .modal-body { + padding: 20px; +} +#cim_setup_container .alert { + font-size: 12px; +} +#cim_setup_container .alert .icon-alert { + font-size: 150%; + position: absolute; + left: 10px; + top: 5px; +} +.selectModelColumns { + position: relative; +} +.tab { + display: inline-block; +} +.layoutBodyColumns { + top: 0; + border-top: 1px solid #ccc; + bottom: 0; + background-color: #fff; + overflow: auto; + position: relative; +} +.layoutColLeft { + width: 360px; + background-color: #eee; +} +.layoutCol { + overflow: hidden; + position: absolute; + top: 0; + bottom: 0; +} +.layoutColRight { + right: 0; + left: 360px; +} +.layoutColRight .tab-pane { + margin: 12px 0 12px 20px; +} +.tab-pane-main { + display: none; +} +.tab-pane-main.active { + display: block; +} +.layoutRow { + overflow: hidden; + left: 0; + right: 0; + min-height: 600px; +} +.scroll-y { + overflow-y: auto; +} +#initial_prompt { + left: 0; + right: 0; + top: 80px; + position: absolute; + font-size: 20px; + font-weight: 200; + text-align: center; + color: #999; +} +.inputForm { + margin: 20px; +} +.sideTabItem { + padding: 10px 30px 10px 20px; + position: relative; + font-size: 14px; + border-right: 1px solid #ccc; + margin-left: 40px; + cursor: pointer; + margin-right: -1px; +} +.sideTabItem:hover { + background: #DDD; +} +.sideTabList { + padding-top: 10px; + border-right: 1px solid #CCC; +} +.sideTabList .link-wrap { + display: block; + text-decoration: none !important; +} +.sideTabItem.selected { + color: #666; + background-color: #fff; + border: 1px solid #ccc; + border-right: 0px; +} +.sideTabName { + line-height: 20px; +} +.indexes_list { + color: #999; + font-size: 11px; +} +.more { + text-decoration: underline; + color: #1e93c6; + cursor: pointer; + padding-left: 0.5em; +} +.col-visibility label.checkbox { + padding: 2px 0px 2px 0px; +} +.btn.nopointer { + pointer-events: none; + cursor: default; +} +.filter-control { + margin: 20px 0 10px 0; +} +.filter-control a.control-clear { + position: relative; + left: -25px; + top: 3px; + line-height: 22px; + font-size: 18px; + color: #999999; +} + +.table-chrome.table-striped>tbody>tr:nth-child(odd)>td { + min-width: 20px; +} + +.nav.nav-tabs { + border-top-style: none; + border-bottom: none; +} + +.control.btn-group { + padding-top: 5px; +} + +a.dropdown-toggle.disabled { + color: #999; +} + +.timepicker-control-menu .btn { + border-top-right-radius: 4px; + border-bottom-right-radius: 4px; + border-bottom-left-radius: 0; + border-top-left-radius: 0; + border-left: none; +} + +.shared-controls-multiinputcontrol { + display: inline-block +} + +.number-text-container input, +.number-text-container span { + min-width: 200px; +} + +.indexes-whitelist-help.help-block { + margin-left: 0; +} + +.loading { + width: 100%; + text-align: center; + padding: 30px; +} + +/* Manage API Styles */ +.layoutColRight .tab-pane.manageAPIKeyForm { + margin: 12px 20px; +} + +.manageAPIKeyForm input{ + width: 100% +} + +.manageAPIKeyForm .actionButtons { + text-align: center; +} + +.manageAPIKeyForm .actionButtons a { + width: 30%; + margin: 2px; +} + +.manageAPIKeyForm .status { + padding: 20px 20px 0; + text-align: center; +} + +.manageAPIKeyForm .apiForm { + width: 350px; + margin-top: 20px; +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/appserver/static/cim_setup.js b/deps/apps/Splunk_SA_CIM/appserver/static/cim_setup.js new file mode 100644 index 000000000..695eb6f26 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/appserver/static/cim_setup.js @@ -0,0 +1,2032 @@ +/******/ (function(modules) { // webpackBootstrap +/******/ // The module cache +/******/ var installedModules = {}; +/******/ +/******/ // The require function +/******/ function __webpack_require__(moduleId) { +/******/ +/******/ // Check if module is in cache +/******/ if(installedModules[moduleId]) { +/******/ return installedModules[moduleId].exports; +/******/ } +/******/ // Create a new module (and put it into the cache) +/******/ var module = installedModules[moduleId] = { +/******/ i: moduleId, +/******/ l: false, +/******/ exports: {} +/******/ }; +/******/ +/******/ // Execute the module function +/******/ modules[moduleId].call(module.exports, module, module.exports, __webpack_require__); +/******/ +/******/ // Flag the module as loaded +/******/ module.l = true; +/******/ +/******/ // Return the exports of the module +/******/ return module.exports; +/******/ } +/******/ +/******/ +/******/ // expose the modules object (__webpack_modules__) +/******/ __webpack_require__.m = modules; +/******/ +/******/ // expose the module cache +/******/ __webpack_require__.c = installedModules; +/******/ +/******/ // define getter function for harmony exports +/******/ __webpack_require__.d = function(exports, name, getter) { +/******/ if(!__webpack_require__.o(exports, name)) { +/******/ Object.defineProperty(exports, name, { enumerable: true, get: getter }); +/******/ } +/******/ }; +/******/ +/******/ // define __esModule on exports +/******/ __webpack_require__.r = function(exports) { +/******/ if(typeof Symbol !== 'undefined' && Symbol.toStringTag) { +/******/ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); +/******/ } +/******/ Object.defineProperty(exports, '__esModule', { value: true }); +/******/ }; +/******/ +/******/ // create a fake namespace object +/******/ // mode & 1: value is a module id, require it +/******/ // mode & 2: merge all properties of value into the ns +/******/ // mode & 4: return value when already ns object +/******/ // mode & 8|1: behave like require +/******/ __webpack_require__.t = function(value, mode) { +/******/ if(mode & 1) value = __webpack_require__(value); +/******/ if(mode & 8) return value; +/******/ if((mode & 4) && typeof value === 'object' && value && value.__esModule) return value; +/******/ var ns = Object.create(null); +/******/ __webpack_require__.r(ns); +/******/ Object.defineProperty(ns, 'default', { enumerable: true, value: value }); +/******/ if(mode & 2 && typeof value != 'string') for(var key in value) __webpack_require__.d(ns, key, function(key) { return value[key]; }.bind(null, key)); +/******/ return ns; +/******/ }; +/******/ +/******/ // getDefaultExport function for compatibility with non-harmony modules +/******/ __webpack_require__.n = function(module) { +/******/ var getter = module && module.__esModule ? +/******/ function getDefault() { return module['default']; } : +/******/ function getModuleExports() { return module; }; +/******/ __webpack_require__.d(getter, 'a', getter); +/******/ return getter; +/******/ }; +/******/ +/******/ // Object.prototype.hasOwnProperty.call +/******/ __webpack_require__.o = function(object, property) { return Object.prototype.hasOwnProperty.call(object, property); }; +/******/ +/******/ // __webpack_public_path__ +/******/ __webpack_require__.p = ""; +/******/ +/******/ +/******/ // Load entry module and return exports +/******/ return __webpack_require__(__webpack_require__.s = "./src/main/webapp/index.jsx"); +/******/ }) +/************************************************************************/ +/******/ ({ + +/***/ "../../node_modules/@babel/runtime/helpers/assertThisInitialized.js": +/*!*****************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/assertThisInitialized.js ***! + \*****************************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports) { + +eval("function _assertThisInitialized(self) {\n if (self === void 0) {\n throw new ReferenceError(\"this hasn't been initialised - super() hasn't been called\");\n }\n\n return self;\n}\n\nmodule.exports = _assertThisInitialized;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/assertThisInitialized.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/classCallCheck.js": +/*!**********************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/classCallCheck.js ***! + \**********************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports) { + +eval("function _classCallCheck(instance, Constructor) {\n if (!(instance instanceof Constructor)) {\n throw new TypeError(\"Cannot call a class as a function\");\n }\n}\n\nmodule.exports = _classCallCheck;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/classCallCheck.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/createClass.js": +/*!*******************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/createClass.js ***! + \*******************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports) { + +eval("function _defineProperties(target, props) {\n for (var i = 0; i < props.length; i++) {\n var descriptor = props[i];\n descriptor.enumerable = descriptor.enumerable || false;\n descriptor.configurable = true;\n if (\"value\" in descriptor) descriptor.writable = true;\n Object.defineProperty(target, descriptor.key, descriptor);\n }\n}\n\nfunction _createClass(Constructor, protoProps, staticProps) {\n if (protoProps) _defineProperties(Constructor.prototype, protoProps);\n if (staticProps) _defineProperties(Constructor, staticProps);\n return Constructor;\n}\n\nmodule.exports = _createClass;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/createClass.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/extends.js": +/*!***************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/extends.js ***! + \***************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports) { + +eval("function _extends() {\n module.exports = _extends = Object.assign || function (target) {\n for (var i = 1; i < arguments.length; i++) {\n var source = arguments[i];\n\n for (var key in source) {\n if (Object.prototype.hasOwnProperty.call(source, key)) {\n target[key] = source[key];\n }\n }\n }\n\n return target;\n };\n\n module.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n return _extends.apply(this, arguments);\n}\n\nmodule.exports = _extends;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/extends.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/getPrototypeOf.js": +/*!**********************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/getPrototypeOf.js ***! + \**********************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports) { + +eval("function _getPrototypeOf(o) {\n module.exports = _getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf : function _getPrototypeOf(o) {\n return o.__proto__ || Object.getPrototypeOf(o);\n };\n module.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n return _getPrototypeOf(o);\n}\n\nmodule.exports = _getPrototypeOf;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/getPrototypeOf.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/inherits.js": +/*!****************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/inherits.js ***! + \****************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +eval("var setPrototypeOf = __webpack_require__(/*! ./setPrototypeOf.js */ \"../../node_modules/@babel/runtime/helpers/setPrototypeOf.js\");\n\nfunction _inherits(subClass, superClass) {\n if (typeof superClass !== \"function\" && superClass !== null) {\n throw new TypeError(\"Super expression must either be null or a function\");\n }\n\n subClass.prototype = Object.create(superClass && superClass.prototype, {\n constructor: {\n value: subClass,\n writable: true,\n configurable: true\n }\n });\n if (superClass) setPrototypeOf(subClass, superClass);\n}\n\nmodule.exports = _inherits;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/inherits.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/objectWithoutProperties.js": +/*!*******************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/objectWithoutProperties.js ***! + \*******************************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +eval("var objectWithoutPropertiesLoose = __webpack_require__(/*! ./objectWithoutPropertiesLoose.js */ \"../../node_modules/@babel/runtime/helpers/objectWithoutPropertiesLoose.js\");\n\nfunction _objectWithoutProperties(source, excluded) {\n if (source == null) return {};\n var target = objectWithoutPropertiesLoose(source, excluded);\n var key, i;\n\n if (Object.getOwnPropertySymbols) {\n var sourceSymbolKeys = Object.getOwnPropertySymbols(source);\n\n for (i = 0; i < sourceSymbolKeys.length; i++) {\n key = sourceSymbolKeys[i];\n if (excluded.indexOf(key) >= 0) continue;\n if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;\n target[key] = source[key];\n }\n }\n\n return target;\n}\n\nmodule.exports = _objectWithoutProperties;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/objectWithoutProperties.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/objectWithoutPropertiesLoose.js": +/*!************************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/objectWithoutPropertiesLoose.js ***! + \************************************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports) { + +eval("function _objectWithoutPropertiesLoose(source, excluded) {\n if (source == null) return {};\n var target = {};\n var sourceKeys = Object.keys(source);\n var key, i;\n\n for (i = 0; i < sourceKeys.length; i++) {\n key = sourceKeys[i];\n if (excluded.indexOf(key) >= 0) continue;\n target[key] = source[key];\n }\n\n return target;\n}\n\nmodule.exports = _objectWithoutPropertiesLoose;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/objectWithoutPropertiesLoose.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/possibleConstructorReturn.js": +/*!*********************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/possibleConstructorReturn.js ***! + \*********************************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +eval("var _typeof = __webpack_require__(/*! @babel/runtime/helpers/typeof */ \"../../node_modules/@babel/runtime/helpers/typeof.js\")[\"default\"];\n\nvar assertThisInitialized = __webpack_require__(/*! ./assertThisInitialized.js */ \"../../node_modules/@babel/runtime/helpers/assertThisInitialized.js\");\n\nfunction _possibleConstructorReturn(self, call) {\n if (call && (_typeof(call) === \"object\" || typeof call === \"function\")) {\n return call;\n }\n\n return assertThisInitialized(self);\n}\n\nmodule.exports = _possibleConstructorReturn;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/possibleConstructorReturn.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/setPrototypeOf.js": +/*!**********************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/setPrototypeOf.js ***! + \**********************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports) { + +eval("function _setPrototypeOf(o, p) {\n module.exports = _setPrototypeOf = Object.setPrototypeOf || function _setPrototypeOf(o, p) {\n o.__proto__ = p;\n return o;\n };\n\n module.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n return _setPrototypeOf(o, p);\n}\n\nmodule.exports = _setPrototypeOf;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/setPrototypeOf.js?"); + +/***/ }), + +/***/ "../../node_modules/@babel/runtime/helpers/typeof.js": +/*!**************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/typeof.js ***! + \**************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports) { + +eval("function _typeof(obj) {\n \"@babel/helpers - typeof\";\n\n if (typeof Symbol === \"function\" && typeof Symbol.iterator === \"symbol\") {\n module.exports = _typeof = function _typeof(obj) {\n return typeof obj;\n };\n\n module.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n } else {\n module.exports = _typeof = function _typeof(obj) {\n return obj && typeof Symbol === \"function\" && obj.constructor === Symbol && obj !== Symbol.prototype ? \"symbol\" : typeof obj;\n };\n\n module.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n }\n\n return _typeof(obj);\n}\n\nmodule.exports = _typeof;\nmodule.exports[\"default\"] = module.exports, module.exports.__esModule = true;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@babel/runtime/helpers/typeof.js?"); + +/***/ }), + +/***/ "../../node_modules/@emotion/is-prop-valid/dist/is-prop-valid.browser.esm.js": +/*!**************************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@emotion/is-prop-valid/dist/is-prop-valid.browser.esm.js ***! + \**************************************************************************************************************/ +/*! exports provided: default */ +/***/ (function(module, __webpack_exports__, __webpack_require__) { + +"use strict"; +eval("__webpack_require__.r(__webpack_exports__);\n/* harmony import */ var _emotion_memoize__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @emotion/memoize */ \"../../node_modules/@emotion/memoize/dist/memoize.browser.esm.js\");\n\n\nvar reactPropsRegex = /^((children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|cellPadding|cellSpacing|challenge|charSet|checked|cite|classID|className|cols|colSpan|content|contentEditable|contextMenu|controls|controlsList|coords|crossOrigin|data|dateTime|decoding|default|defer|dir|disabled|disablePictureInPicture|download|draggable|encType|form|formAction|formEncType|formMethod|formNoValidate|formTarget|frameBorder|headers|height|hidden|high|href|hrefLang|htmlFor|httpEquiv|id|inputMode|integrity|is|keyParams|keyType|kind|label|lang|list|loading|loop|low|marginHeight|marginWidth|max|maxLength|media|mediaGroup|method|min|minLength|multiple|muted|name|nonce|noValidate|open|optimum|pattern|placeholder|playsInline|poster|preload|profile|radioGroup|readOnly|referrerPolicy|rel|required|reversed|role|rows|rowSpan|sandbox|scope|scoped|scrolling|seamless|selected|shape|size|sizes|slot|span|spellCheck|src|srcDoc|srcLang|srcSet|start|step|style|summary|tabIndex|target|title|type|useMap|value|width|wmode|wrap|about|datatype|inlist|prefix|property|resource|typeof|vocab|autoCapitalize|autoCorrect|autoSave|color|inert|itemProp|itemScope|itemType|itemID|itemRef|on|results|security|unselectable|accentHeight|accumulate|additive|alignmentBaseline|allowReorder|alphabetic|amplitude|arabicForm|ascent|attributeName|attributeType|autoReverse|azimuth|baseFrequency|baselineShift|baseProfile|bbox|begin|bias|by|calcMode|capHeight|clip|clipPathUnits|clipPath|clipRule|colorInterpolation|colorInterpolationFilters|colorProfile|colorRendering|contentScriptType|contentStyleType|cursor|cx|cy|d|decelerate|descent|diffuseConstant|direction|display|divisor|dominantBaseline|dur|dx|dy|edgeMode|elevation|enableBackground|end|exponent|externalResourcesRequired|fill|fillOpacity|fillRule|filter|filterRes|filterUnits|floodColor|floodOpacity|focusable|fontFamily|fontSize|fontSizeAdjust|fontStretch|fontStyle|fontVariant|fontWeight|format|from|fr|fx|fy|g1|g2|glyphName|glyphOrientationHorizontal|glyphOrientationVertical|glyphRef|gradientTransform|gradientUnits|hanging|horizAdvX|horizOriginX|ideographic|imageRendering|in|in2|intercept|k|k1|k2|k3|k4|kernelMatrix|kernelUnitLength|kerning|keyPoints|keySplines|keyTimes|lengthAdjust|letterSpacing|lightingColor|limitingConeAngle|local|markerEnd|markerMid|markerStart|markerHeight|markerUnits|markerWidth|mask|maskContentUnits|maskUnits|mathematical|mode|numOctaves|offset|opacity|operator|order|orient|orientation|origin|overflow|overlinePosition|overlineThickness|panose1|paintOrder|pathLength|patternContentUnits|patternTransform|patternUnits|pointerEvents|points|pointsAtX|pointsAtY|pointsAtZ|preserveAlpha|preserveAspectRatio|primitiveUnits|r|radius|refX|refY|renderingIntent|repeatCount|repeatDur|requiredExtensions|requiredFeatures|restart|result|rotate|rx|ry|scale|seed|shapeRendering|slope|spacing|specularConstant|specularExponent|speed|spreadMethod|startOffset|stdDeviation|stemh|stemv|stitchTiles|stopColor|stopOpacity|strikethroughPosition|strikethroughThickness|string|stroke|strokeDasharray|strokeDashoffset|strokeLinecap|strokeLinejoin|strokeMiterlimit|strokeOpacity|strokeWidth|surfaceScale|systemLanguage|tableValues|targetX|targetY|textAnchor|textDecoration|textRendering|textLength|to|transform|u1|u2|underlinePosition|underlineThickness|unicode|unicodeBidi|unicodeRange|unitsPerEm|vAlphabetic|vHanging|vIdeographic|vMathematical|values|vectorEffect|version|vertAdvY|vertOriginX|vertOriginY|viewBox|viewTarget|visibility|widths|wordSpacing|writingMode|x|xHeight|x1|x2|xChannelSelector|xlinkActuate|xlinkArcrole|xlinkHref|xlinkRole|xlinkShow|xlinkTitle|xlinkType|xmlBase|xmlns|xmlnsXlink|xmlLang|xmlSpace|y|y1|y2|yChannelSelector|z|zoomAndPan|for|class|autofocus)|(([Dd][Aa][Tt][Aa]|[Aa][Rr][Ii][Aa]|x)-.*))$/; // https://esbench.com/bench/5bfee68a4cd7e6009ef61d23\n\nvar index = Object(_emotion_memoize__WEBPACK_IMPORTED_MODULE_0__[\"default\"])(function (prop) {\n return reactPropsRegex.test(prop) || prop.charCodeAt(0) === 111\n /* o */\n && prop.charCodeAt(1) === 110\n /* n */\n && prop.charCodeAt(2) < 91;\n}\n/* Z+1 */\n);\n\n/* harmony default export */ __webpack_exports__[\"default\"] = (index);\n\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@emotion/is-prop-valid/dist/is-prop-valid.browser.esm.js?"); + +/***/ }), + +/***/ "../../node_modules/@emotion/memoize/dist/memoize.browser.esm.js": +/*!**************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@emotion/memoize/dist/memoize.browser.esm.js ***! + \**************************************************************************************************/ +/*! exports provided: default */ +/***/ (function(module, __webpack_exports__, __webpack_require__) { + +"use strict"; +eval("__webpack_require__.r(__webpack_exports__);\nfunction memoize(fn) {\n var cache = {};\n return function (arg) {\n if (cache[arg] === undefined) cache[arg] = fn(arg);\n return cache[arg];\n };\n}\n\n/* harmony default export */ __webpack_exports__[\"default\"] = (memoize);\n\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@emotion/memoize/dist/memoize.browser.esm.js?"); + +/***/ }), + +/***/ "../../node_modules/@emotion/stylis/dist/stylis.browser.esm.js": +/*!************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@emotion/stylis/dist/stylis.browser.esm.js ***! + \************************************************************************************************/ +/*! exports provided: default */ +/***/ (function(module, __webpack_exports__, __webpack_require__) { + +"use strict"; +eval("__webpack_require__.r(__webpack_exports__);\nfunction stylis_min (W) {\n function M(d, c, e, h, a) {\n for (var m = 0, b = 0, v = 0, n = 0, q, g, x = 0, K = 0, k, u = k = q = 0, l = 0, r = 0, I = 0, t = 0, B = e.length, J = B - 1, y, f = '', p = '', F = '', G = '', C; l < B;) {\n g = e.charCodeAt(l);\n l === J && 0 !== b + n + v + m && (0 !== b && (g = 47 === b ? 10 : 47), n = v = m = 0, B++, J++);\n\n if (0 === b + n + v + m) {\n if (l === J && (0 < r && (f = f.replace(N, '')), 0 < f.trim().length)) {\n switch (g) {\n case 32:\n case 9:\n case 59:\n case 13:\n case 10:\n break;\n\n default:\n f += e.charAt(l);\n }\n\n g = 59;\n }\n\n switch (g) {\n case 123:\n f = f.trim();\n q = f.charCodeAt(0);\n k = 1;\n\n for (t = ++l; l < B;) {\n switch (g = e.charCodeAt(l)) {\n case 123:\n k++;\n break;\n\n case 125:\n k--;\n break;\n\n case 47:\n switch (g = e.charCodeAt(l + 1)) {\n case 42:\n case 47:\n a: {\n for (u = l + 1; u < J; ++u) {\n switch (e.charCodeAt(u)) {\n case 47:\n if (42 === g && 42 === e.charCodeAt(u - 1) && l + 2 !== u) {\n l = u + 1;\n break a;\n }\n\n break;\n\n case 10:\n if (47 === g) {\n l = u + 1;\n break a;\n }\n\n }\n }\n\n l = u;\n }\n\n }\n\n break;\n\n case 91:\n g++;\n\n case 40:\n g++;\n\n case 34:\n case 39:\n for (; l++ < J && e.charCodeAt(l) !== g;) {\n }\n\n }\n\n if (0 === k) break;\n l++;\n }\n\n k = e.substring(t, l);\n 0 === q && (q = (f = f.replace(ca, '').trim()).charCodeAt(0));\n\n switch (q) {\n case 64:\n 0 < r && (f = f.replace(N, ''));\n g = f.charCodeAt(1);\n\n switch (g) {\n case 100:\n case 109:\n case 115:\n case 45:\n r = c;\n break;\n\n default:\n r = O;\n }\n\n k = M(c, r, k, g, a + 1);\n t = k.length;\n 0 < A && (r = X(O, f, I), C = H(3, k, r, c, D, z, t, g, a, h), f = r.join(''), void 0 !== C && 0 === (t = (k = C.trim()).length) && (g = 0, k = ''));\n if (0 < t) switch (g) {\n case 115:\n f = f.replace(da, ea);\n\n case 100:\n case 109:\n case 45:\n k = f + '{' + k + '}';\n break;\n\n case 107:\n f = f.replace(fa, '$1 $2');\n k = f + '{' + k + '}';\n k = 1 === w || 2 === w && L('@' + k, 3) ? '@-webkit-' + k + '@' + k : '@' + k;\n break;\n\n default:\n k = f + k, 112 === h && (k = (p += k, ''));\n } else k = '';\n break;\n\n default:\n k = M(c, X(c, f, I), k, h, a + 1);\n }\n\n F += k;\n k = I = r = u = q = 0;\n f = '';\n g = e.charCodeAt(++l);\n break;\n\n case 125:\n case 59:\n f = (0 < r ? f.replace(N, '') : f).trim();\n if (1 < (t = f.length)) switch (0 === u && (q = f.charCodeAt(0), 45 === q || 96 < q && 123 > q) && (t = (f = f.replace(' ', ':')).length), 0 < A && void 0 !== (C = H(1, f, c, d, D, z, p.length, h, a, h)) && 0 === (t = (f = C.trim()).length) && (f = '\\x00\\x00'), q = f.charCodeAt(0), g = f.charCodeAt(1), q) {\n case 0:\n break;\n\n case 64:\n if (105 === g || 99 === g) {\n G += f + e.charAt(l);\n break;\n }\n\n default:\n 58 !== f.charCodeAt(t - 1) && (p += P(f, q, g, f.charCodeAt(2)));\n }\n I = r = u = q = 0;\n f = '';\n g = e.charCodeAt(++l);\n }\n }\n\n switch (g) {\n case 13:\n case 10:\n 47 === b ? b = 0 : 0 === 1 + q && 107 !== h && 0 < f.length && (r = 1, f += '\\x00');\n 0 < A * Y && H(0, f, c, d, D, z, p.length, h, a, h);\n z = 1;\n D++;\n break;\n\n case 59:\n case 125:\n if (0 === b + n + v + m) {\n z++;\n break;\n }\n\n default:\n z++;\n y = e.charAt(l);\n\n switch (g) {\n case 9:\n case 32:\n if (0 === n + m + b) switch (x) {\n case 44:\n case 58:\n case 9:\n case 32:\n y = '';\n break;\n\n default:\n 32 !== g && (y = ' ');\n }\n break;\n\n case 0:\n y = '\\\\0';\n break;\n\n case 12:\n y = '\\\\f';\n break;\n\n case 11:\n y = '\\\\v';\n break;\n\n case 38:\n 0 === n + b + m && (r = I = 1, y = '\\f' + y);\n break;\n\n case 108:\n if (0 === n + b + m + E && 0 < u) switch (l - u) {\n case 2:\n 112 === x && 58 === e.charCodeAt(l - 3) && (E = x);\n\n case 8:\n 111 === K && (E = K);\n }\n break;\n\n case 58:\n 0 === n + b + m && (u = l);\n break;\n\n case 44:\n 0 === b + v + n + m && (r = 1, y += '\\r');\n break;\n\n case 34:\n case 39:\n 0 === b && (n = n === g ? 0 : 0 === n ? g : n);\n break;\n\n case 91:\n 0 === n + b + v && m++;\n break;\n\n case 93:\n 0 === n + b + v && m--;\n break;\n\n case 41:\n 0 === n + b + m && v--;\n break;\n\n case 40:\n if (0 === n + b + m) {\n if (0 === q) switch (2 * x + 3 * K) {\n case 533:\n break;\n\n default:\n q = 1;\n }\n v++;\n }\n\n break;\n\n case 64:\n 0 === b + v + n + m + u + k && (k = 1);\n break;\n\n case 42:\n case 47:\n if (!(0 < n + m + v)) switch (b) {\n case 0:\n switch (2 * g + 3 * e.charCodeAt(l + 1)) {\n case 235:\n b = 47;\n break;\n\n case 220:\n t = l, b = 42;\n }\n\n break;\n\n case 42:\n 47 === g && 42 === x && t + 2 !== l && (33 === e.charCodeAt(t + 2) && (p += e.substring(t, l + 1)), y = '', b = 0);\n }\n }\n\n 0 === b && (f += y);\n }\n\n K = x;\n x = g;\n l++;\n }\n\n t = p.length;\n\n if (0 < t) {\n r = c;\n if (0 < A && (C = H(2, p, r, d, D, z, t, h, a, h), void 0 !== C && 0 === (p = C).length)) return G + p + F;\n p = r.join(',') + '{' + p + '}';\n\n if (0 !== w * E) {\n 2 !== w || L(p, 2) || (E = 0);\n\n switch (E) {\n case 111:\n p = p.replace(ha, ':-moz-$1') + p;\n break;\n\n case 112:\n p = p.replace(Q, '::-webkit-input-$1') + p.replace(Q, '::-moz-$1') + p.replace(Q, ':-ms-input-$1') + p;\n }\n\n E = 0;\n }\n }\n\n return G + p + F;\n }\n\n function X(d, c, e) {\n var h = c.trim().split(ia);\n c = h;\n var a = h.length,\n m = d.length;\n\n switch (m) {\n case 0:\n case 1:\n var b = 0;\n\n for (d = 0 === m ? '' : d[0] + ' '; b < a; ++b) {\n c[b] = Z(d, c[b], e).trim();\n }\n\n break;\n\n default:\n var v = b = 0;\n\n for (c = []; b < a; ++b) {\n for (var n = 0; n < m; ++n) {\n c[v++] = Z(d[n] + ' ', h[b], e).trim();\n }\n }\n\n }\n\n return c;\n }\n\n function Z(d, c, e) {\n var h = c.charCodeAt(0);\n 33 > h && (h = (c = c.trim()).charCodeAt(0));\n\n switch (h) {\n case 38:\n return c.replace(F, '$1' + d.trim());\n\n case 58:\n return d.trim() + c.replace(F, '$1' + d.trim());\n\n default:\n if (0 < 1 * e && 0 < c.indexOf('\\f')) return c.replace(F, (58 === d.charCodeAt(0) ? '' : '$1') + d.trim());\n }\n\n return d + c;\n }\n\n function P(d, c, e, h) {\n var a = d + ';',\n m = 2 * c + 3 * e + 4 * h;\n\n if (944 === m) {\n d = a.indexOf(':', 9) + 1;\n var b = a.substring(d, a.length - 1).trim();\n b = a.substring(0, d).trim() + b + ';';\n return 1 === w || 2 === w && L(b, 1) ? '-webkit-' + b + b : b;\n }\n\n if (0 === w || 2 === w && !L(a, 1)) return a;\n\n switch (m) {\n case 1015:\n return 97 === a.charCodeAt(10) ? '-webkit-' + a + a : a;\n\n case 951:\n return 116 === a.charCodeAt(3) ? '-webkit-' + a + a : a;\n\n case 963:\n return 110 === a.charCodeAt(5) ? '-webkit-' + a + a : a;\n\n case 1009:\n if (100 !== a.charCodeAt(4)) break;\n\n case 969:\n case 942:\n return '-webkit-' + a + a;\n\n case 978:\n return '-webkit-' + a + '-moz-' + a + a;\n\n case 1019:\n case 983:\n return '-webkit-' + a + '-moz-' + a + '-ms-' + a + a;\n\n case 883:\n if (45 === a.charCodeAt(8)) return '-webkit-' + a + a;\n if (0 < a.indexOf('image-set(', 11)) return a.replace(ja, '$1-webkit-$2') + a;\n break;\n\n case 932:\n if (45 === a.charCodeAt(4)) switch (a.charCodeAt(5)) {\n case 103:\n return '-webkit-box-' + a.replace('-grow', '') + '-webkit-' + a + '-ms-' + a.replace('grow', 'positive') + a;\n\n case 115:\n return '-webkit-' + a + '-ms-' + a.replace('shrink', 'negative') + a;\n\n case 98:\n return '-webkit-' + a + '-ms-' + a.replace('basis', 'preferred-size') + a;\n }\n return '-webkit-' + a + '-ms-' + a + a;\n\n case 964:\n return '-webkit-' + a + '-ms-flex-' + a + a;\n\n case 1023:\n if (99 !== a.charCodeAt(8)) break;\n b = a.substring(a.indexOf(':', 15)).replace('flex-', '').replace('space-between', 'justify');\n return '-webkit-box-pack' + b + '-webkit-' + a + '-ms-flex-pack' + b + a;\n\n case 1005:\n return ka.test(a) ? a.replace(aa, ':-webkit-') + a.replace(aa, ':-moz-') + a : a;\n\n case 1e3:\n b = a.substring(13).trim();\n c = b.indexOf('-') + 1;\n\n switch (b.charCodeAt(0) + b.charCodeAt(c)) {\n case 226:\n b = a.replace(G, 'tb');\n break;\n\n case 232:\n b = a.replace(G, 'tb-rl');\n break;\n\n case 220:\n b = a.replace(G, 'lr');\n break;\n\n default:\n return a;\n }\n\n return '-webkit-' + a + '-ms-' + b + a;\n\n case 1017:\n if (-1 === a.indexOf('sticky', 9)) break;\n\n case 975:\n c = (a = d).length - 10;\n b = (33 === a.charCodeAt(c) ? a.substring(0, c) : a).substring(d.indexOf(':', 7) + 1).trim();\n\n switch (m = b.charCodeAt(0) + (b.charCodeAt(7) | 0)) {\n case 203:\n if (111 > b.charCodeAt(8)) break;\n\n case 115:\n a = a.replace(b, '-webkit-' + b) + ';' + a;\n break;\n\n case 207:\n case 102:\n a = a.replace(b, '-webkit-' + (102 < m ? 'inline-' : '') + 'box') + ';' + a.replace(b, '-webkit-' + b) + ';' + a.replace(b, '-ms-' + b + 'box') + ';' + a;\n }\n\n return a + ';';\n\n case 938:\n if (45 === a.charCodeAt(5)) switch (a.charCodeAt(6)) {\n case 105:\n return b = a.replace('-items', ''), '-webkit-' + a + '-webkit-box-' + b + '-ms-flex-' + b + a;\n\n case 115:\n return '-webkit-' + a + '-ms-flex-item-' + a.replace(ba, '') + a;\n\n default:\n return '-webkit-' + a + '-ms-flex-line-pack' + a.replace('align-content', '').replace(ba, '') + a;\n }\n break;\n\n case 973:\n case 989:\n if (45 !== a.charCodeAt(3) || 122 === a.charCodeAt(4)) break;\n\n case 931:\n case 953:\n if (!0 === la.test(d)) return 115 === (b = d.substring(d.indexOf(':') + 1)).charCodeAt(0) ? P(d.replace('stretch', 'fill-available'), c, e, h).replace(':fill-available', ':stretch') : a.replace(b, '-webkit-' + b) + a.replace(b, '-moz-' + b.replace('fill-', '')) + a;\n break;\n\n case 962:\n if (a = '-webkit-' + a + (102 === a.charCodeAt(5) ? '-ms-' + a : '') + a, 211 === e + h && 105 === a.charCodeAt(13) && 0 < a.indexOf('transform', 10)) return a.substring(0, a.indexOf(';', 27) + 1).replace(ma, '$1-webkit-$2') + a;\n }\n\n return a;\n }\n\n function L(d, c) {\n var e = d.indexOf(1 === c ? ':' : '{'),\n h = d.substring(0, 3 !== c ? e : 10);\n e = d.substring(e + 1, d.length - 1);\n return R(2 !== c ? h : h.replace(na, '$1'), e, c);\n }\n\n function ea(d, c) {\n var e = P(c, c.charCodeAt(0), c.charCodeAt(1), c.charCodeAt(2));\n return e !== c + ';' ? e.replace(oa, ' or ($1)').substring(4) : '(' + c + ')';\n }\n\n function H(d, c, e, h, a, m, b, v, n, q) {\n for (var g = 0, x = c, w; g < A; ++g) {\n switch (w = S[g].call(B, d, x, e, h, a, m, b, v, n, q)) {\n case void 0:\n case !1:\n case !0:\n case null:\n break;\n\n default:\n x = w;\n }\n }\n\n if (x !== c) return x;\n }\n\n function T(d) {\n switch (d) {\n case void 0:\n case null:\n A = S.length = 0;\n break;\n\n default:\n if ('function' === typeof d) S[A++] = d;else if ('object' === typeof d) for (var c = 0, e = d.length; c < e; ++c) {\n T(d[c]);\n } else Y = !!d | 0;\n }\n\n return T;\n }\n\n function U(d) {\n d = d.prefix;\n void 0 !== d && (R = null, d ? 'function' !== typeof d ? w = 1 : (w = 2, R = d) : w = 0);\n return U;\n }\n\n function B(d, c) {\n var e = d;\n 33 > e.charCodeAt(0) && (e = e.trim());\n V = e;\n e = [V];\n\n if (0 < A) {\n var h = H(-1, c, e, e, D, z, 0, 0, 0, 0);\n void 0 !== h && 'string' === typeof h && (c = h);\n }\n\n var a = M(O, e, c, 0, 0);\n 0 < A && (h = H(-2, a, e, e, D, z, a.length, 0, 0, 0), void 0 !== h && (a = h));\n V = '';\n E = 0;\n z = D = 1;\n return a;\n }\n\n var ca = /^\\0+/g,\n N = /[\\0\\r\\f]/g,\n aa = /: */g,\n ka = /zoo|gra/,\n ma = /([,: ])(transform)/g,\n ia = /,\\r+?/g,\n F = /([\\t\\r\\n ])*\\f?&/g,\n fa = /@(k\\w+)\\s*(\\S*)\\s*/,\n Q = /::(place)/g,\n ha = /:(read-only)/g,\n G = /[svh]\\w+-[tblr]{2}/,\n da = /\\(\\s*(.*)\\s*\\)/g,\n oa = /([\\s\\S]*?);/g,\n ba = /-self|flex-/g,\n na = /[^]*?(:[rp][el]a[\\w-]+)[^]*/,\n la = /stretch|:\\s*\\w+\\-(?:conte|avail)/,\n ja = /([^-])(image-set\\()/,\n z = 1,\n D = 1,\n E = 0,\n w = 1,\n O = [],\n S = [],\n A = 0,\n R = null,\n Y = 0,\n V = '';\n B.use = T;\n B.set = U;\n void 0 !== W && U(W);\n return B;\n}\n\n/* harmony default export */ __webpack_exports__[\"default\"] = (stylis_min);\n\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@emotion/stylis/dist/stylis.browser.esm.js?"); + +/***/ }), + +/***/ "../../node_modules/@emotion/unitless/dist/unitless.browser.esm.js": +/*!****************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@emotion/unitless/dist/unitless.browser.esm.js ***! + \****************************************************************************************************/ +/*! exports provided: default */ +/***/ (function(module, __webpack_exports__, __webpack_require__) { + +"use strict"; +eval("__webpack_require__.r(__webpack_exports__);\nvar unitlessKeys = {\n animationIterationCount: 1,\n borderImageOutset: 1,\n borderImageSlice: 1,\n borderImageWidth: 1,\n boxFlex: 1,\n boxFlexGroup: 1,\n boxOrdinalGroup: 1,\n columnCount: 1,\n columns: 1,\n flex: 1,\n flexGrow: 1,\n flexPositive: 1,\n flexShrink: 1,\n flexNegative: 1,\n flexOrder: 1,\n gridRow: 1,\n gridRowEnd: 1,\n gridRowSpan: 1,\n gridRowStart: 1,\n gridColumn: 1,\n gridColumnEnd: 1,\n gridColumnSpan: 1,\n gridColumnStart: 1,\n msGridRow: 1,\n msGridRowSpan: 1,\n msGridColumn: 1,\n msGridColumnSpan: 1,\n fontWeight: 1,\n lineHeight: 1,\n opacity: 1,\n order: 1,\n orphans: 1,\n tabSize: 1,\n widows: 1,\n zIndex: 1,\n zoom: 1,\n WebkitLineClamp: 1,\n // SVG-related properties\n fillOpacity: 1,\n floodOpacity: 1,\n stopOpacity: 1,\n strokeDasharray: 1,\n strokeDashoffset: 1,\n strokeMiterlimit: 1,\n strokeOpacity: 1,\n strokeWidth: 1\n};\n\n/* harmony default export */ __webpack_exports__[\"default\"] = (unitlessKeys);\n\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@emotion/unitless/dist/unitless.browser.esm.js?"); + +/***/ }), + +/***/ "../../node_modules/@splunk/react-page/lib/index.js": +/*!*************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@splunk/react-page/lib/index.js ***! + \*************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +eval("module.exports =\n/******/ (function(modules) { // webpackBootstrap\n/******/ \t// The module cache\n/******/ \tvar installedModules = {};\n/******/\n/******/ \t// The require function\n/******/ \tfunction __webpack_require__(moduleId) {\n/******/\n/******/ \t\t// Check if module is in cache\n/******/ \t\tif(installedModules[moduleId]) {\n/******/ \t\t\treturn installedModules[moduleId].exports;\n/******/ \t\t}\n/******/ \t\t// Create a new module (and put it into the cache)\n/******/ \t\tvar module = installedModules[moduleId] = {\n/******/ \t\t\ti: moduleId,\n/******/ \t\t\tl: false,\n/******/ \t\t\texports: {}\n/******/ \t\t};\n/******/\n/******/ \t\t// Execute the module function\n/******/ \t\tmodules[moduleId].call(module.exports, module, module.exports, __webpack_require__);\n/******/\n/******/ \t\t// Flag the module as loaded\n/******/ \t\tmodule.l = true;\n/******/\n/******/ \t\t// Return the exports of the module\n/******/ \t\treturn module.exports;\n/******/ \t}\n/******/\n/******/\n/******/ \t// expose the modules object (__webpack_modules__)\n/******/ \t__webpack_require__.m = modules;\n/******/\n/******/ \t// expose the module cache\n/******/ \t__webpack_require__.c = installedModules;\n/******/\n/******/ \t// define getter function for harmony exports\n/******/ \t__webpack_require__.d = function(exports, name, getter) {\n/******/ \t\tif(!__webpack_require__.o(exports, name)) {\n/******/ \t\t\tObject.defineProperty(exports, name, { enumerable: true, get: getter });\n/******/ \t\t}\n/******/ \t};\n/******/\n/******/ \t// define __esModule on exports\n/******/ \t__webpack_require__.r = function(exports) {\n/******/ \t\tif(typeof Symbol !== 'undefined' && Symbol.toStringTag) {\n/******/ \t\t\tObject.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });\n/******/ \t\t}\n/******/ \t\tObject.defineProperty(exports, '__esModule', { value: true });\n/******/ \t};\n/******/\n/******/ \t// create a fake namespace object\n/******/ \t// mode & 1: value is a module id, require it\n/******/ \t// mode & 2: merge all properties of value into the ns\n/******/ \t// mode & 4: return value when already ns object\n/******/ \t// mode & 8|1: behave like require\n/******/ \t__webpack_require__.t = function(value, mode) {\n/******/ \t\tif(mode & 1) value = __webpack_require__(value);\n/******/ \t\tif(mode & 8) return value;\n/******/ \t\tif((mode & 4) && typeof value === 'object' && value && value.__esModule) return value;\n/******/ \t\tvar ns = Object.create(null);\n/******/ \t\t__webpack_require__.r(ns);\n/******/ \t\tObject.defineProperty(ns, 'default', { enumerable: true, value: value });\n/******/ \t\tif(mode & 2 && typeof value != 'string') for(var key in value) __webpack_require__.d(ns, key, function(key) { return value[key]; }.bind(null, key));\n/******/ \t\treturn ns;\n/******/ \t};\n/******/\n/******/ \t// getDefaultExport function for compatibility with non-harmony modules\n/******/ \t__webpack_require__.n = function(module) {\n/******/ \t\tvar getter = module && module.__esModule ?\n/******/ \t\t\tfunction getDefault() { return module['default']; } :\n/******/ \t\t\tfunction getModuleExports() { return module; };\n/******/ \t\t__webpack_require__.d(getter, 'a', getter);\n/******/ \t\treturn getter;\n/******/ \t};\n/******/\n/******/ \t// Object.prototype.hasOwnProperty.call\n/******/ \t__webpack_require__.o = function(object, property) { return Object.prototype.hasOwnProperty.call(object, property); };\n/******/\n/******/ \t// __webpack_public_path__\n/******/ \t__webpack_require__.p = \"\";\n/******/\n/******/\n/******/ \t// Load entry module and return exports\n/******/ \treturn __webpack_require__(__webpack_require__.s = 10);\n/******/ })\n/************************************************************************/\n/******/ ([\n/* 0 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! react */ \"../../node_modules/react/index.js\");\n\n/***/ }),\n/* 1 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! styled-components */ \"../../node_modules/styled-components/dist/styled-components.browser.esm.js\");\n\n/***/ }),\n/* 2 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/themes/enterprise */ \"../../node_modules/@splunk/themes/enterprise.js\");\n\n/***/ }),\n/* 3 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! react-dom */ \"../../node_modules/react-dom/index.js\");\n\n/***/ }),\n/* 4 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! prop-types */ \"../../node_modules/prop-types/index.js\");\n\n/***/ }),\n/* 5 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! scriptjs */ \"../../node_modules/scriptjs/dist/script.js\");\n\n/***/ }),\n/* 6 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/react-ui/Layer */ \"../../node_modules/@splunk/react-ui/Layer.js\");\n\n/***/ }),\n/* 7 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/splunk-utils/url */ \"../../node_modules/@splunk/react-page/node_modules/@splunk/splunk-utils/url.js\");\n\n/***/ }),\n/* 8 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/react-ui/ScreenReaderContent */ \"../../node_modules/@splunk/react-ui/ScreenReaderContent.js\");\n\n/***/ }),\n/* 9 */\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/ui-utils/i18n */ \"../../node_modules/@splunk/ui-utils/i18n.js\");\n\n/***/ }),\n/* 10 */\n/***/ (function(module, __webpack_exports__, __webpack_require__) {\n\n\"use strict\";\n// ESM COMPAT FLAG\n__webpack_require__.r(__webpack_exports__);\n\n// EXTERNAL MODULE: external \"react\"\nvar external_react_ = __webpack_require__(0);\nvar external_react_default = /*#__PURE__*/__webpack_require__.n(external_react_);\n\n// EXTERNAL MODULE: external \"react-dom\"\nvar external_react_dom_ = __webpack_require__(3);\n\n// EXTERNAL MODULE: external \"scriptjs\"\nvar external_scriptjs_ = __webpack_require__(5);\nvar external_scriptjs_default = /*#__PURE__*/__webpack_require__.n(external_scriptjs_);\n\n// EXTERNAL MODULE: external \"@splunk/react-ui/Layer\"\nvar Layer_ = __webpack_require__(6);\n\n// EXTERNAL MODULE: external \"@splunk/splunk-utils/url\"\nvar url_ = __webpack_require__(7);\n\n// EXTERNAL MODULE: external \"prop-types\"\nvar external_prop_types_ = __webpack_require__(4);\nvar external_prop_types_default = /*#__PURE__*/__webpack_require__.n(external_prop_types_);\n\n// EXTERNAL MODULE: external \"@splunk/react-ui/ScreenReaderContent\"\nvar ScreenReaderContent_ = __webpack_require__(8);\nvar ScreenReaderContent_default = /*#__PURE__*/__webpack_require__.n(ScreenReaderContent_);\n\n// EXTERNAL MODULE: external \"@splunk/ui-utils/i18n\"\nvar i18n_ = __webpack_require__(9);\n\n// EXTERNAL MODULE: external \"styled-components\"\nvar external_styled_components_ = __webpack_require__(1);\nvar external_styled_components_default = /*#__PURE__*/__webpack_require__.n(external_styled_components_);\n\n// EXTERNAL MODULE: external \"@splunk/themes/enterprise\"\nvar enterprise_ = __webpack_require__(2);\nvar enterprise_default = /*#__PURE__*/__webpack_require__.n(enterprise_);\n\n// CONCATENATED MODULE: ./src/LoadingStyles.js\nfunction _templateObject6() {\n var data = _taggedTemplateLiteral([\"\\n animation-name: \", \";\\n animation-duration: 1.4s;\\n animation-iteration-count: infinite;\\n animation-fill-mode: both;\\n background-color: \", \";\\n width: 10px;\\n height: 10px;\\n border-radius: 5px;\\n display: inline-block;\\n margin-right: \", \";\\n\\n &:nth-child(2) {\\n animation-delay: 0.2s;\\n }\\n\\n &:nth-child(3) {\\n animation-delay: 0.4s;\\n }\\n\"]);\n\n _templateObject6 = function _templateObject6() {\n return data;\n };\n\n return data;\n}\n\nfunction _templateObject5() {\n var data = _taggedTemplateLiteral([\"\\n color: \", \";\\n padding-top: 30vh;\\n text-align: center;\\n min-height: 400px;\\n\"]);\n\n _templateObject5 = function _templateObject5() {\n return data;\n };\n\n return data;\n}\n\nfunction _templateObject4() {\n var data = _taggedTemplateLiteral([\"\\n background-color: \", \";\\n min-height: 44px;\\n\"]);\n\n _templateObject4 = function _templateObject4() {\n return data;\n };\n\n return data;\n}\n\nfunction _templateObject3() {\n var data = _taggedTemplateLiteral([\"\\n padding: 0;\\n background-color: \", \";\\n height: 34px;\\n\"]);\n\n _templateObject3 = function _templateObject3() {\n return data;\n };\n\n return data;\n}\n\nfunction _templateObject2() {\n var data = _taggedTemplateLiteral([\"\\n background-color: \", \";\\n position: fixed;\\n opacity: 1;\\n z-index: 10000;\\n top: 0;\\n bottom: 0;\\n left: 0;\\n right: 0;\\n\"]);\n\n _templateObject2 = function _templateObject2() {\n return data;\n };\n\n return data;\n}\n\nfunction _templateObject() {\n var data = _taggedTemplateLiteral([\"\\n 0% {\\n opacity: 0.2;\\n }\\n\\n 20% {\\n opacity: 1;\\n }\\n\\n 100% {\\n opacity: 0.2;\\n }\\n\"]);\n\n _templateObject = function _templateObject() {\n return data;\n };\n\n return data;\n}\n\nfunction _taggedTemplateLiteral(strings, raw) { if (!raw) { raw = strings.slice(0); } return Object.freeze(Object.defineProperties(strings, { raw: { value: Object.freeze(raw) } })); }\n\n\n\nvar blink = Object(external_styled_components_[\"keyframes\"])(_templateObject());\nvar Main = external_styled_components_default.a.div(_templateObject2(), enterprise_default.a.gray96);\nvar SplunkBar = external_styled_components_default.a.div(_templateObject3(), enterprise_default.a.gray20);\nvar AppBar = external_styled_components_default.a.div(_templateObject4(), enterprise_default.a.gray30);\nvar AppBody = external_styled_components_default.a.div(_templateObject5(), enterprise_default.a.gray20);\nvar Dot = external_styled_components_default.a.div(_templateObject6(), blink, enterprise_default.a.gray60, enterprise_default.a.spacingHalf);\n\n// CONCATENATED MODULE: ./src/Loading.jsx\n\n\n\n\n\nvar propTypes = {\n hideAppBar: external_prop_types_default.a.bool,\n hideChrome: external_prop_types_default.a.bool,\n hideSplunkBar: external_prop_types_default.a.bool\n};\nvar defaultProps = {\n hideAppBar: false,\n hideChrome: false,\n hideSplunkBar: false\n};\n\nfunction Loading(_ref) {\n var hideAppBar = _ref.hideAppBar,\n hideChrome = _ref.hideChrome,\n hideSplunkBar = _ref.hideSplunkBar;\n return /*#__PURE__*/external_react_default.a.createElement(Main, null, !hideChrome && !hideSplunkBar && /*#__PURE__*/external_react_default.a.createElement(SplunkBar, null), !hideChrome && !hideAppBar && /*#__PURE__*/external_react_default.a.createElement(AppBar, null), /*#__PURE__*/external_react_default.a.createElement(AppBody, null, /*#__PURE__*/external_react_default.a.createElement(Dot, null), /*#__PURE__*/external_react_default.a.createElement(Dot, null), /*#__PURE__*/external_react_default.a.createElement(Dot, null), /*#__PURE__*/external_react_default.a.createElement(ScreenReaderContent_default.a, null, Object(i18n_[\"_\"])('Loading'))));\n}\n\nLoading.propTypes = propTypes;\nLoading.defaultProps = defaultProps;\n/* harmony default export */ var src_Loading = (Loading);\n// CONCATENATED MODULE: ./src/index.jsx\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n\n\n\n\n\n\n/**\n * Loads the layout from the server, using requirejs if available on the window and scriptjs if not.\n *\n * @param {Function} callback - A callback invoked with the layout module once resolved.\n * @private\n */\n\nfunction getLayoutApi(callback) {\n var url = Object(url_[\"createStaticURL\"])('build/api/layout.js');\n\n if (window.requirejs) {\n window.requirejs([url], callback);\n } else {\n external_scriptjs_default()(url, function () {\n // eslint-disable-next-line no-underscore-dangle\n callback(window.__splunk_layout__);\n });\n }\n}\n/**\n * Renders a React element into the Layout API.\n * @public\n * @param {element} element - A React element.\n * @param {object} [options]\n * @param {string} [options.pageTitle] - Changes the page title.\n * @param {Boolean} [options.hideAppBar = false] - Hides the app bar.\n * @param {Boolean} [options.hideAppsList = false] - Hides the app list in\n * the Splunk bar.\n * @param {Boolean} [options.hideChrome = false] - Renders only the main content, hiding\n * the Splunk bar, app bar, and footer.\n * @param {Boolean} [options.hideFooter = false] - Hides the footer.\n * @param {Boolean} [options.hideSplunkBar = false] - Hides the Splunk bar.\n * @param {string} [options.layout = 'scrolling'] - Set to `fixed` to fix all navigation bars\n * to the edge of the page.\n * @param {Boolean} [options.useGlobalLayerStack = true] - Wraps elements in @splunk/react-ui's LayerStackGlobalProvider.\n */\n\n\nfunction layout(element) {\n var _ref = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};\n\n var _ref$useGlobalLayerSt = _ref.useGlobalLayerStack,\n useGlobalLayerStack = _ref$useGlobalLayerSt === void 0 ? true : _ref$useGlobalLayerSt,\n pageTitle = _ref.pageTitle,\n layoutAPIOptions = _objectWithoutProperties(_ref, [\"useGlobalLayerStack\", \"pageTitle\"]);\n\n var loadingContainer = document.createElement('div');\n\n if (pageTitle) {\n document.title = pageTitle;\n }\n\n document.body.appendChild(loadingContainer);\n Object(external_react_dom_[\"render\"])( /*#__PURE__*/external_react_default.a.createElement(src_Loading, layoutAPIOptions), loadingContainer);\n getLayoutApi(function (layoutApi) {\n var containerEl;\n\n if (layoutApi) {\n containerEl = layoutApi.create(layoutAPIOptions).getContainerElement();\n\n if (layoutAPIOptions.layout === 'fixed') {\n // the above create method adds flex: 1 0 0\n // IE 11 disregards 0px shorthand for flex-basis component.\n // flex-basis 0% is better than 0px because css minification can remove px\n if (!containerEl.style.flex || containerEl.style.flex === '1 0 0px') {\n containerEl.style.flex = '1 0 0%';\n } // all elements in the hierarchy must have 'overflow: hidden' for children\n // to support scrolling correctly.\n\n\n if (!containerEl.style.overflow) {\n containerEl.style.overflow = 'hidden';\n } // splunk hijacks the width of the body when printing, so we have to force width to the size\n // of the viewport so that things print at the correct width\n\n\n if (!containerEl.style.width) {\n containerEl.style.width = '100vw';\n }\n }\n } else {\n // eslint-disable-next-line no-console\n console.error('Unable to load layout.');\n containerEl = document.createElement('div');\n document.body.appendChild(containerEl);\n }\n\n setTimeout(function () {\n Object(external_react_dom_[\"unmountComponentAtNode\"])(loadingContainer);\n loadingContainer.parentNode.removeChild(loadingContainer);\n var wrappedElement = useGlobalLayerStack ? /*#__PURE__*/external_react_default.a.createElement(Layer_[\"LayerStackGlobalProvider\"], null, element) : element;\n Object(external_react_dom_[\"render\"])(wrappedElement, containerEl);\n }, 30);\n });\n}\n\n/* harmony default export */ var src = __webpack_exports__[\"default\"] = (layout);\n\n/***/ })\n/******/ ]);\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@splunk/react-page/lib/index.js?"); + +/***/ }), + +/***/ "../../node_modules/@splunk/react-page/node_modules/@splunk/splunk-utils/config.js": +/*!********************************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@splunk/react-page/node_modules/@splunk/splunk-utils/config.js ***! + \********************************************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +"use strict"; +eval("/* WEBPACK VAR INJECTION */(function(global) {\n\nObject.defineProperty(exports, \"__esModule\", {\n value: true\n});\nexports.extractAppName = extractAppName;\nexports.versionLabel = exports.username = exports.splunkdPath = exports.serverTimezoneInfo = exports.rootPath = exports.portNumber = exports.locale = exports.config = exports.buildPushNumber = exports.buildNumber = exports.appBuild = exports.app = exports.isAvailable = exports.CSRFToken = void 0;\n\nvar _lodash = __webpack_require__(/*! lodash */ \"../../node_modules/lodash/lodash.js\");\n\nvar _cookie = __webpack_require__(/*! @splunk/ui-utils/cookie */ \"../../node_modules/@splunk/ui-utils/cookie.js\");\n\n/**\n * A set of constants describing the server environment. If window.$C isn't defined, most of the\n * values on this page are also undefined.\n *\n * The constants may be imported independently, such as:\n * ```\n * import { buildNumber, locale, rootPath } from '@splunk/splunk-utils/config';\n * @file\n */\n\n/* global global */\n// If this is running in Node, the root is the `global` object. If it's running in the browser,\n// root is the `window` object.\nvar root = typeof window === 'undefined' ? global : window;\n/**\n * A function to get a $C prop. Returns undefined if $C isn't available.\n * @private\n */\n\nfunction get$CEntry(prop) {\n return (0, _lodash.get)(root, ['$C', prop]);\n}\n/**\n * The CSRF token. This may be `null` if the token isn't found in the cookie.\n *\n * @constant\n *\n * @public\n */\n\n\nvar CSRFToken = (0, _cookie.getEntry)(\"splunkweb_csrf_token_\".concat(get$CEntry('MRSPARKLE_PORT_NUMBER')));\n/**\n * If `window.$C` is undefined or invalid, isAvailable is `false`.\n * @constant\n * @public\n */\n\nexports.CSRFToken = CSRFToken;\nvar isAvailable = !!get$CEntry('SPLUNKD_PATH');\n/**\n * Extracts app name from the URL. To enable testing, this function is exported and pathname\n * can be overridden.\n * @private\n */\n\nexports.isAvailable = isAvailable;\n\nfunction extractAppName() {\n var pathname = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : (0, _lodash.get)(root, ['document', 'location', 'pathname'], '');\n var pathMatch = pathname.match(/\\w\\w.\\w\\w\\/(app|manager)\\/([^/]+)/);\n return pathMatch ? pathMatch[2] : undefined;\n}\n/**\n * The name of the current app as shown in the URL (not the display name).\n * @constant\n * @public\n */\n\n\nvar app = extractAppName();\n/**\n * The build number of the current app.\n * @constant\n * @public\n */\n\nexports.app = app;\nvar appBuild = get$CEntry('APP_BUILD');\n/**\n * A hash string of the current build.\n * @constant\n * @type {string}\n * @public\n */\n\nexports.appBuild = appBuild;\nvar buildNumber = get$CEntry('BUILD_NUMBER');\n/**\n * A incremented number configured per instance. Defaults to 0.\n * @constant\n * @public\n */\n\nexports.buildNumber = buildNumber;\nvar buildPushNumber = get$CEntry('BUILD_PUSH_NUMBER');\n/**\n * The full object of window.$C.\n * @constant\n * @public\n */\n\nexports.buildPushNumber = buildPushNumber;\nvar config = (0, _lodash.get)(root, '$C');\n/**\n * The current locale, such as \"en-US\".\n * @constant\n * @public\n */\n\nexports.config = config;\nvar locale = get$CEntry('LOCALE');\n/**\n * The port that Splunk Web is using. Defaults to 8000.\n * @constant\n * @public\n */\n\nexports.locale = locale;\nvar portNumber = get$CEntry('MRSPARKLE_PORT_NUMBER');\n/**\n * Splunk may not be running in the root directory, so the locale may not be the first element\n * in the pathname. If it is running in the root directory, ```rootPath``` is an empty\n * string. Otherwise it returns the root. For example, in the page\n * ```\n * http://splunk.domain.com/my-root-dir/en-US/app/search/search\n * ```\n * ```rootPath``` is set to ```'my-root-dir'```.\n * @constant\n * @public\n */\n\nexports.portNumber = portNumber;\nvar rootPath = get$CEntry('MRSPARKLE_ROOT_PATH');\n/**\n * The serialized Splunk Enterprise time zone data. This can be parsed for use in formatting Epoch times\n * on the client.\n * @constant\n * @public\n */\n\nexports.rootPath = rootPath;\nvar serverTimezoneInfo = get$CEntry('SERVER_ZONEINFO');\n/**\n * The Splunk Web proxing to splunkd, such as ```/en-US/splunkd/__raw```.\n * @constant\n * @public\n */\n\nexports.serverTimezoneInfo = serverTimezoneInfo;\nvar splunkdPath = get$CEntry('SPLUNKD_PATH');\n/**\n * The username of the current user.\n * @constant\n * @public\n */\n\nexports.splunkdPath = splunkdPath;\nvar username = get$CEntry('USERNAME');\n/**\n * The version label of splunkd.\n * @constant\n * @public\n */\n\nexports.username = username;\nvar versionLabel = get$CEntry('VERSION_LABEL');\nexports.versionLabel = versionLabel;\n/* WEBPACK VAR INJECTION */}.call(this, __webpack_require__(/*! ./../../../../../webpack/buildin/global.js */ \"../../node_modules/webpack/buildin/global.js\")))\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@splunk/react-page/node_modules/@splunk/splunk-utils/config.js?"); + +/***/ }), + +/***/ "../../node_modules/@splunk/react-page/node_modules/@splunk/splunk-utils/url.js": +/*!*****************************************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@splunk/react-page/node_modules/@splunk/splunk-utils/url.js ***! + \*****************************************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +"use strict"; +eval("\n\nfunction _typeof(obj) { \"@babel/helpers - typeof\"; if (typeof Symbol === \"function\" && typeof Symbol.iterator === \"symbol\") { _typeof = function _typeof(obj) { return typeof obj; }; } else { _typeof = function _typeof(obj) { return obj && typeof Symbol === \"function\" && obj.constructor === Symbol && obj !== Symbol.prototype ? \"symbol\" : typeof obj; }; } return _typeof(obj); }\n\nObject.defineProperty(exports, \"__esModule\", {\n value: true\n});\nexports.withConfig = withConfig;\nexports.insertCacheBuster = exports.createURL = exports.createStaticURL = exports.createRESTURL = exports.createDocsURL = exports.createAppDocsURL = void 0;\n\nvar _querystring = __webpack_require__(/*! querystring */ \"../../node_modules/querystring-es3/index.js\");\n\nvar config = _interopRequireWildcard(__webpack_require__(/*! ./config */ \"../../node_modules/@splunk/react-page/node_modules/@splunk/splunk-utils/config.js\"));\n\nfunction _getRequireWildcardCache() { if (typeof WeakMap !== \"function\") return null; var cache = new WeakMap(); _getRequireWildcardCache = function _getRequireWildcardCache() { return cache; }; return cache; }\n\nfunction _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } if (obj === null || _typeof(obj) !== \"object\" && typeof obj !== \"function\") { return { \"default\": obj }; } var cache = _getRequireWildcardCache(); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj[\"default\"] = obj; if (cache) { cache.set(obj, newObj); } return newObj; }\n\nfunction ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); keys.push.apply(keys, symbols); } return keys; }\n\nfunction _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { ownKeys(Object(source), true).forEach(function (key) { _defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }\n\nfunction _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }\n\n/**\n * A set of functions for generating Splunk Web URLs. They may be imported independently, such as:\n * ```\n * import { createURL, createStaticURL } from '@splunk/splunk-utils/url';\n * ```\n * @file\n */\nfunction withConfig(_ref) {\n var appBuild = _ref.appBuild,\n buildNumber = _ref.buildNumber,\n buildPushNumber = _ref.buildPushNumber,\n locale = _ref.locale,\n rootPath = _ref.rootPath,\n splunkdPath = _ref.splunkdPath;\n\n /**\n * Inserts a cache buster into the given path.\n *\n * @param path {String} - The path to inject the cache buster into.\n * @param configOptions {Object} - Config options including `appBuild`, `buildPushNumber`, and\n * `buildNumber`. Defaults to the values provided by `@splunk/splunk-utils/config`.\n * @return {String} Returns the path with the cache buster `/@9850fc87a5ee`.\n * @private\n */\n function insertCacheBuster(path) {\n var configOptions = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};\n\n var options = _objectSpread({\n appBuild: appBuild,\n buildPushNumber: buildPushNumber,\n buildNumber: buildNumber\n }, configOptions);\n\n var match = path.match(/(^|\\w\\w-\\w\\w\\/)static\\//);\n\n if (!match) {\n return path;\n }\n\n var insertPosition = match.index + match[0].length - 1;\n var isApp = path.match(/(^|\\w\\w-\\w\\w|)static\\/app/);\n var appBuildString = isApp ? \":\".concat(options.appBuild || 0) : '';\n var buildPushString = options.buildPushNumber ? \".\".concat(options.buildPushNumber) : '';\n var cacheBusterString = \"/@\".concat(options.buildNumber).concat(buildPushString).concat(appBuildString);\n var before = path.substr(0, insertPosition);\n var after = path.substr(insertPosition);\n return \"\".concat(before).concat(cacheBusterString).concat(after);\n }\n /**\n * Returns a full path for the current appserver location.\n * This is required for proxy compatiblity, localization, and cache busting.\n *\n * For example:\n * ```js\n * createURL('app/search/job'); // \"/splunk/en-US/app/search/job\"\n * createURL('/app/search/job'); // \"/splunk/en-US/app/search/job\"\n * createURL('app/search/job', {id:3, user:'me' }); // \"/splunk/en-US/app/search/job?id=3&user=me\"\n * ```\n *\n * Static paths are augmented with a cache buster:\n * ```js\n * createURL('/static/js/foo.js'); // \"/splunk/en-US/static/@12345/js/foo.js\"\n * createURL('/static/js/foo.js'); // \"/splunk/en-US/static/@12345.1/js/foo.js\"\n * createURL('/static/app/search/js/foo.js'); // \"/splunk/en-US/static/@12345.1:0/app/search/js/foo.js\"\n * ```\n *\n * @public\n * @param path {String}\n * @param [queryParams] {Object} An object of the query parameters.\n * @param configOptions {Object} - Config options including `appBuild`, `buildPushNumber`,\n * `buildNumber`, `rootPath`, and `locale`. Defaults to the values provided by\n * `@splunk/splunk-utils/config`.\n * @return {String} Returns a valid URL with correct root path, locale, and cache buster.\n * @alias createURL\n */\n\n\n function createURL(pathInput, queryParams) {\n var configOptions = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};\n\n var options = _objectSpread({\n appBuild: appBuild,\n buildPushNumber: buildPushNumber,\n buildNumber: buildNumber,\n rootPath: rootPath,\n locale: locale\n }, configOptions);\n\n var path = pathInput || '/';\n var query = queryParams ? \"?\".concat((0, _querystring.stringify)(queryParams)) : '';\n\n if (path.charAt(0) !== '/') {\n path = \"/\".concat(path);\n }\n\n path = \"\".concat(options.rootPath || '', \"/\").concat(options.locale).concat(path).concat(query);\n return insertCacheBuster(path, options);\n }\n /**\n * Prepends Splunk Web path information necessary to access a static asset. For example:\n * ```\n * createURL('fonts/roboto-regular-webfont.woff'); // \"/splunk/en-US/static/@12345/fonts/roboto-regular-webfont.woff\"\n * createURL('app/search/fonts/roboto-regular-webfont.woff'); // \"/splunk/en-US/static/@12345.1:0/app/search/fonts/roboto-regular-webfont.woff\"\n * ```\n * @public\n * @param {String} path - A path to a static resource.\n * @param [queryParams] {Object} An object of the query parameters.\n * @param configOptions {Object} - Config options including `appBuild`, `buildPushNumber`,\n * `buildNumber`, `rootPath`, and `locale`. Defaults to the values provided by\n * `@splunk/splunk-utils/config`.\n * @return {String} Returns a valid URL with correct root path, locale, and cache buster.\n * @alias createStaticURL\n */\n\n\n function createStaticURL(path) {\n for (var _len = arguments.length, rest = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {\n rest[_key - 1] = arguments[_key];\n }\n\n return createURL.apply(void 0, [\"static/\".concat(path)].concat(rest));\n }\n /**\n * Creates a fully qualified URL for the specified endpoint.\n * For example:\n * ```\n * createRESTURL('server/info'); // \"/en-US/splunkd/__raw/services/server/info\"\n * createRESTURL('saved/searches', {app: 'search'}); // \"/en-US/splunkd/__raw/servicesNS/-/search/saved/searches\"\n * ```\n * @public\n * @param {String} endpoint - An endpoint to a REST API.\n * @param {Object} options\n * @param {String} [options.app] - App namespace to use.\n * @param {String} [options.owner] - User namespace to use.\n * @param {Sting} [options.sharing] - Must be one of [ '' | 'app' | 'global' | 'system' ].\n * @param {Object} [configOptions] - Config options including `splunkdPath`. Defaults to the value\n * provided by `@splunk/splunk-utils/config`.\n * @return {String} The URL of the REST API endpoint.\n * @alias createRESTURL\n */\n\n\n function createRESTURL(endpoint) {\n var namespaceOptions = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};\n var configOptions = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};\n\n // Return the endpoint if it's a full path.\n if (/^http[s]?:\\/\\//.test(endpoint)) {\n return endpoint;\n }\n\n var basePath = configOptions.splunkdPath || splunkdPath || ''; // If it's an absolute path,\n\n if (/^\\/.*/.test(endpoint)) {\n // Append the splunkdPath if the endpoint includes services. Otherwise, return the endpoint.\n return /^\\/services/.test(endpoint) ? \"\".concat(basePath).concat(endpoint) : endpoint;\n } // If neither an app nor owner is provided, use /services/ endpoint.\n\n\n if (!namespaceOptions.app && !namespaceOptions.owner) {\n return \"\".concat(basePath, \"/services/\").concat(endpoint);\n } // Build a namespaced path.\n\n\n var owner;\n\n if (namespaceOptions.sharing) {\n owner = 'nobody';\n } else if (namespaceOptions.owner) {\n owner = encodeURIComponent(namespaceOptions.owner);\n } else {\n owner = '-';\n }\n\n var app;\n\n if (namespaceOptions.sharing === 'system') {\n app = 'system';\n } else if (namespaceOptions.app) {\n app = encodeURIComponent(namespaceOptions.app);\n } else {\n app = '-';\n }\n\n return \"\".concat(basePath, \"/servicesNS/\").concat(owner, \"/\").concat(app, \"/\").concat(endpoint);\n }\n /** Create docs URL private method.\n * @param {Object} [params]\n * @private\n */\n\n\n function createDocsURLFromParams(params, configOptions) {\n return createURL('/help', params, configOptions);\n }\n /** Create docs URL using location string.\n * For example:\n * ```\n * createDocsURL('learnmore.timerange.picker'); // \"/en-US/help?location=learnmore.timerange.picker\"\n * ```\n * @public\n * @param {String} location - Required.\n * @return {String} The URL of the Splunk help document.\n * @alias createDocsURL\n */\n\n\n function createDocsURL(location, configOptions) {\n return createDocsURLFromParams({\n location: location\n }, configOptions);\n }\n /** Create app docs URL using location string, which needs to add [appName:appVersion] prefix before the location string.\n * For example:\n * ```\n * createAppDocsURL('learnmore.timerange.picker', { appName: 'splunk_app_aws', appVersion: '5.0.3'}); // \"/en-US/help?location=learnmore.timerange.picker\"\n * ```\n * @public\n * @param {String} location - Required.\n * @param {Object} options - Required.\n * @param {String} options.appName - App name.\n * @param {String} options.appVersion - App version.\n * @return {String} The URL of the Splunk app help document.\n * @alias createAppDocsURL\n */\n\n\n function createAppDocsURL(location, _ref2, configOptions) {\n var appName = _ref2.appName,\n appVersion = _ref2.appVersion;\n return createDocsURLFromParams({\n location: \"[\".concat(appName, \":\").concat(appVersion, \"]\").concat(location)\n }, configOptions);\n }\n\n return {\n createAppDocsURL: createAppDocsURL,\n createDocsURL: createDocsURL,\n createRESTURL: createRESTURL,\n createStaticURL: createStaticURL,\n createURL: createURL,\n insertCacheBuster: insertCacheBuster\n };\n}\n\nvar _withConfig = withConfig(config),\n createAppDocsURL = _withConfig.createAppDocsURL,\n createDocsURL = _withConfig.createDocsURL,\n createRESTURL = _withConfig.createRESTURL,\n createStaticURL = _withConfig.createStaticURL,\n createURL = _withConfig.createURL,\n insertCacheBuster = _withConfig.insertCacheBuster;\n\nexports.insertCacheBuster = insertCacheBuster;\nexports.createURL = createURL;\nexports.createStaticURL = createStaticURL;\nexports.createRESTURL = createRESTURL;\nexports.createDocsURL = createDocsURL;\nexports.createAppDocsURL = createAppDocsURL;\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@splunk/react-page/node_modules/@splunk/splunk-utils/url.js?"); + +/***/ }), + +/***/ "../../node_modules/@splunk/react-ui/Layer.js": +/*!*******************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@splunk/react-ui/Layer.js ***! + \*******************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +eval("module.exports =\n/******/ (function(modules) { // webpackBootstrap\n/******/ \t// The module cache\n/******/ \tvar installedModules = {};\n/******/\n/******/ \t// The require function\n/******/ \tfunction __webpack_require__(moduleId) {\n/******/\n/******/ \t\t// Check if module is in cache\n/******/ \t\tif(installedModules[moduleId]) {\n/******/ \t\t\treturn installedModules[moduleId].exports;\n/******/ \t\t}\n/******/ \t\t// Create a new module (and put it into the cache)\n/******/ \t\tvar module = installedModules[moduleId] = {\n/******/ \t\t\ti: moduleId,\n/******/ \t\t\tl: false,\n/******/ \t\t\texports: {}\n/******/ \t\t};\n/******/\n/******/ \t\t// Execute the module function\n/******/ \t\tmodules[moduleId].call(module.exports, module, module.exports, __webpack_require__);\n/******/\n/******/ \t\t// Flag the module as loaded\n/******/ \t\tmodule.l = true;\n/******/\n/******/ \t\t// Return the exports of the module\n/******/ \t\treturn module.exports;\n/******/ \t}\n/******/\n/******/\n/******/ \t// expose the modules object (__webpack_modules__)\n/******/ \t__webpack_require__.m = modules;\n/******/\n/******/ \t// expose the module cache\n/******/ \t__webpack_require__.c = installedModules;\n/******/\n/******/ \t// define getter function for harmony exports\n/******/ \t__webpack_require__.d = function(exports, name, getter) {\n/******/ \t\tif(!__webpack_require__.o(exports, name)) {\n/******/ \t\t\tObject.defineProperty(exports, name, { enumerable: true, get: getter });\n/******/ \t\t}\n/******/ \t};\n/******/\n/******/ \t// define __esModule on exports\n/******/ \t__webpack_require__.r = function(exports) {\n/******/ \t\tif(typeof Symbol !== 'undefined' && Symbol.toStringTag) {\n/******/ \t\t\tObject.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });\n/******/ \t\t}\n/******/ \t\tObject.defineProperty(exports, '__esModule', { value: true });\n/******/ \t};\n/******/\n/******/ \t// create a fake namespace object\n/******/ \t// mode & 1: value is a module id, require it\n/******/ \t// mode & 2: merge all properties of value into the ns\n/******/ \t// mode & 4: return value when already ns object\n/******/ \t// mode & 8|1: behave like require\n/******/ \t__webpack_require__.t = function(value, mode) {\n/******/ \t\tif(mode & 1) value = __webpack_require__(value);\n/******/ \t\tif(mode & 8) return value;\n/******/ \t\tif((mode & 4) && typeof value === 'object' && value && value.__esModule) return value;\n/******/ \t\tvar ns = Object.create(null);\n/******/ \t\t__webpack_require__.r(ns);\n/******/ \t\tObject.defineProperty(ns, 'default', { enumerable: true, value: value });\n/******/ \t\tif(mode & 2 && typeof value != 'string') for(var key in value) __webpack_require__.d(ns, key, function(key) { return value[key]; }.bind(null, key));\n/******/ \t\treturn ns;\n/******/ \t};\n/******/\n/******/ \t// getDefaultExport function for compatibility with non-harmony modules\n/******/ \t__webpack_require__.n = function(module) {\n/******/ \t\tvar getter = module && module.__esModule ?\n/******/ \t\t\tfunction getDefault() { return module['default']; } :\n/******/ \t\t\tfunction getModuleExports() { return module; };\n/******/ \t\t__webpack_require__.d(getter, 'a', getter);\n/******/ \t\treturn getter;\n/******/ \t};\n/******/\n/******/ \t// Object.prototype.hasOwnProperty.call\n/******/ \t__webpack_require__.o = function(object, property) { return Object.prototype.hasOwnProperty.call(object, property); };\n/******/\n/******/ \t// __webpack_public_path__\n/******/ \t__webpack_require__.p = \"\";\n/******/\n/******/\n/******/ \t// Load entry module and return exports\n/******/ \treturn __webpack_require__(__webpack_require__.s = 161);\n/******/ })\n/************************************************************************/\n/******/ ({\n\n/***/ 0:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! prop-types */ \"../../node_modules/prop-types/index.js\");\n\n/***/ }),\n\n/***/ 14:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! react-event-listener */ \"../../node_modules/react-event-listener/dist/react-event-listener.cjs.js\");\n\n/***/ }),\n\n/***/ 161:\n/***/ (function(module, __webpack_exports__, __webpack_require__) {\n\n\"use strict\";\n// ESM COMPAT FLAG\n__webpack_require__.r(__webpack_exports__);\n\n// EXPORTS\n__webpack_require__.d(__webpack_exports__, \"default\", function() { return /* reexport */ src_Layer_Layer; });\n__webpack_require__.d(__webpack_exports__, \"LayerStackContext\", function() { return /* reexport */ LayerStack[\"a\" /* LayerStackContext */]; });\n__webpack_require__.d(__webpack_exports__, \"LayerStackGlobalProvider\", function() { return /* reexport */ LayerStack[\"b\" /* LayerStackGlobalProvider */]; });\n\n// EXTERNAL MODULE: external \"react\"\nvar external_react_ = __webpack_require__(2);\nvar external_react_default = /*#__PURE__*/__webpack_require__.n(external_react_);\n\n// EXTERNAL MODULE: external \"react-dom\"\nvar external_react_dom_ = __webpack_require__(47);\n\n// EXTERNAL MODULE: external \"prop-types\"\nvar external_prop_types_ = __webpack_require__(0);\nvar external_prop_types_default = /*#__PURE__*/__webpack_require__.n(external_prop_types_);\n\n// EXTERNAL MODULE: external \"react-event-listener\"\nvar external_react_event_listener_ = __webpack_require__(14);\nvar external_react_event_listener_default = /*#__PURE__*/__webpack_require__.n(external_react_event_listener_);\n\n// EXTERNAL MODULE: external \"lodash\"\nvar external_lodash_ = __webpack_require__(4);\n\n// EXTERNAL MODULE: external \"@splunk/ui-utils/keyboard\"\nvar keyboard_ = __webpack_require__(8);\n\n// EXTERNAL MODULE: ./src/Layer/LayerStack.tsx\nvar LayerStack = __webpack_require__(52);\n\n// CONCATENATED MODULE: ./src/Layer/Layer.tsx\nfunction _typeof(obj) { \"@babel/helpers - typeof\"; if (typeof Symbol === \"function\" && typeof Symbol.iterator === \"symbol\") { _typeof = function _typeof(obj) { return typeof obj; }; } else { _typeof = function _typeof(obj) { return obj && typeof Symbol === \"function\" && obj.constructor === Symbol && obj !== Symbol.prototype ? \"symbol\" : typeof obj; }; } return _typeof(obj); }\n\nfunction _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError(\"Cannot call a class as a function\"); } }\n\nfunction _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if (\"value\" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } }\n\nfunction _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); return Constructor; }\n\nfunction _inherits(subClass, superClass) { if (typeof superClass !== \"function\" && superClass !== null) { throw new TypeError(\"Super expression must either be null or a function\"); } subClass.prototype = Object.create(superClass && superClass.prototype, { constructor: { value: subClass, writable: true, configurable: true } }); if (superClass) _setPrototypeOf(subClass, superClass); }\n\nfunction _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf || function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }\n\nfunction _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = Reflect.construct(Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }\n\nfunction _possibleConstructorReturn(self, call) { if (call && (_typeof(call) === \"object\" || typeof call === \"function\")) { return call; } return _assertThisInitialized(self); }\n\nfunction _assertThisInitialized(self) { if (self === void 0) { throw new ReferenceError(\"this hasn't been initialised - super() hasn't been called\"); } return self; }\n\nfunction _isNativeReflectConstruct() { if (typeof Reflect === \"undefined\" || !Reflect.construct) return false; if (Reflect.construct.sham) return false; if (typeof Proxy === \"function\") return true; try { Date.prototype.toString.call(Reflect.construct(Date, [], function () {})); return true; } catch (e) { return false; } }\n\nfunction _getPrototypeOf(o) { _getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf : function _getPrototypeOf(o) { return o.__proto__ || Object.getPrototypeOf(o); }; return _getPrototypeOf(o); }\n\nfunction _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }\n\n\n\n\n\n\n\n\n/** @public */\n\nvar possibleCloseReasons = ['clickAway', 'escapeKey'];\nvar propTypes = {\n children: external_prop_types_default.a.node,\n closeReasons: external_prop_types_default.a.arrayOf(external_prop_types_default.a.oneOf(possibleCloseReasons)),\n onRequestClose: external_prop_types_default.a.func,\n open: external_prop_types_default.a.bool\n};\nvar defaultProps = {\n closeReasons: possibleCloseReasons,\n open: false\n};\n\nvar Layer_Layer = /*#__PURE__*/function (_Component) {\n _inherits(Layer, _Component);\n\n var _super = _createSuper(Layer);\n\n // @docs-props-type LayerPropsBase\n // eslint-disable-next-line react/sort-comp\n // LayerStackContext (an array) keeps track of the current instances of Layer. This is\n // used by Layer#handleKeyDown to determine if the escapeKey event should be handled by\n // the current instance. Only the topmost Layer instance should honor the escapeKey.\n // TODO: enable once this is sorted out within the babel/ts ecosystem\n // declare context: React.ContextType;\n function Layer(props) {\n var _this;\n\n _classCallCheck(this, Layer);\n\n _this = _super.call(this, props);\n\n _defineProperty(_assertThisInitialized(_this), \"layerClickEvent\", null);\n\n _defineProperty(_assertThisInitialized(_this), \"handleClickOnLayer\", function (_ref) {\n var nativeEvent = _ref.nativeEvent;\n _this.layerClickEvent = nativeEvent;\n });\n\n _defineProperty(_assertThisInitialized(_this), \"handleClickOnWindow\", function (event) {\n var _this$props$onRequest, _this$props;\n\n // clicks inside the layer should not be considered clickAways\n if (!_this.props.open || !Object(external_lodash_[\"includes\"])(_this.props.closeReasons, 'clickAway') || _this.layerClickEvent === event) {\n return;\n }\n\n (_this$props$onRequest = (_this$props = _this.props).onRequestClose) === null || _this$props$onRequest === void 0 ? void 0 : _this$props$onRequest.call(_this$props, {\n event: event,\n reason: 'clickAway'\n });\n });\n\n _defineProperty(_assertThisInitialized(_this), \"handleKeyDownOnWindow\", function (event) {\n if (_this.props.open && Object(keyboard_[\"keycode\"])(event) === 'esc' && Object(external_lodash_[\"last\"])(_this.getLayerStack()) === _assertThisInitialized(_this) && Object(external_lodash_[\"includes\"])(_this.props.closeReasons, 'escapeKey')) {\n var _this$props$onRequest2, _this$props2;\n\n (_this$props$onRequest2 = (_this$props2 = _this.props).onRequestClose) === null || _this$props$onRequest2 === void 0 ? void 0 : _this$props$onRequest2.call(_this$props2, {\n event: event,\n reason: 'escapeKey'\n });\n }\n });\n\n if (!Layer.layerContainer) {\n Layer.layerContainer = document.createElement('div');\n Layer.layerContainer.setAttribute('data-test', 'layer-container');\n document.body.appendChild(Layer.layerContainer);\n }\n\n return _this;\n }\n\n _createClass(Layer, [{\n key: \"componentDidMount\",\n value: function componentDidMount() {\n if (this.props.open) {\n this.getLayerStack().push(this);\n }\n }\n }, {\n key: \"componentDidUpdate\",\n value: function componentDidUpdate(prevProps) {\n if (!prevProps.open && this.props.open) {\n this.getLayerStack().push(this);\n } else if (prevProps.open && !this.props.open) {\n Object(external_lodash_[\"pull\"])(this.getLayerStack(), this);\n }\n }\n }, {\n key: \"componentWillUnmount\",\n value: function componentWillUnmount() {\n Object(external_lodash_[\"pull\"])(this.getLayerStack(), this);\n }\n }, {\n key: \"getLayerStack\",\n value: function getLayerStack() {\n return this.context;\n }\n }, {\n key: \"render\",\n value: function render() {\n var _this$props3 = this.props,\n children = _this$props3.children,\n open = _this$props3.open;\n\n if (open) {\n var layerPortal = /*#__PURE__*/Object(external_react_dom_[\"createPortal\"])( /*#__PURE__*/external_react_default.a.createElement(\"div\", {\n // eslint-disable-line jsx-a11y/no-static-element-interactions\n \"data-test\": \"layer\",\n onMouseDown: this.handleClickOnLayer,\n onTouchStart: this.handleClickOnLayer\n }, children), Layer.layerContainer // eslint-disable-line @typescript-eslint/no-non-null-assertion\n );\n return /*#__PURE__*/external_react_default.a.createElement(external_react_default.a.Fragment, null, /*#__PURE__*/external_react_default.a.createElement(external_react_event_listener_default.a, {\n key: \"eventListener\",\n target: \"window\",\n onKeyDown: this.handleKeyDownOnWindow,\n onMouseDown: this.handleClickOnWindow,\n onTouchStart: this.handleClickOnWindow\n }), layerPortal);\n }\n\n return null;\n }\n }]);\n\n return Layer;\n}(external_react_[\"Component\"]);\n\n_defineProperty(Layer_Layer, \"layerContainer\", null);\n\n_defineProperty(Layer_Layer, \"possibleCloseReasons\", possibleCloseReasons);\n\n_defineProperty(Layer_Layer, \"propTypes\", propTypes);\n\n_defineProperty(Layer_Layer, \"defaultProps\", defaultProps);\n\n_defineProperty(Layer_Layer, \"contextType\", LayerStack[\"a\" /* LayerStackContext */]);\n\n/* harmony default export */ var src_Layer_Layer = (Layer_Layer);\n// CONCATENATED MODULE: ./src/Layer/index.ts\n\n\n\n/***/ }),\n\n/***/ 2:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! react */ \"../../node_modules/react/index.js\");\n\n/***/ }),\n\n/***/ 4:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! lodash */ \"../../node_modules/lodash/lodash.js\");\n\n/***/ }),\n\n/***/ 47:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! react-dom */ \"../../node_modules/react-dom/index.js\");\n\n/***/ }),\n\n/***/ 52:\n/***/ (function(module, __webpack_exports__, __webpack_require__) {\n\n\"use strict\";\n/* WEBPACK VAR INJECTION */(function(global) {/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, \"a\", function() { return LayerStackContext; });\n/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, \"b\", function() { return LayerStackGlobalProvider; });\n/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2);\n/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(react__WEBPACK_IMPORTED_MODULE_0__);\n/* harmony import */ var prop_types__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(0);\n/* harmony import */ var prop_types__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(prop_types__WEBPACK_IMPORTED_MODULE_1__);\n\n\n\n/**\n * `LayerStackContext` is used to manage the array that `Layer` (and components that\n * depend on it, such as `Modal`) uses to determine the order of open layers.\n * @public\n */\nvar LayerStackContext = react__WEBPACK_IMPORTED_MODULE_0___default.a.createContext([]);\nvar propTypes = {\n children: prop_types__WEBPACK_IMPORTED_MODULE_1___default.a.node,\n name: prop_types__WEBPACK_IMPORTED_MODULE_1___default.a.string,\n scope: prop_types__WEBPACK_IMPORTED_MODULE_1___default.a.object\n};\n/* global global */\n\n/**\n * A `LayerStackContext` provider that stores a shared layer stack using a global variable.\n * Applications should only use this provider if there's a known need to support multiple\n * instances of this library on the same page.\n */\n\nfunction LayerStackGlobalProvider(_ref) {\n var children = _ref.children,\n _ref$name = _ref.name,\n name = _ref$name === void 0 ? '__splunkui_layer_instances__' : _ref$name,\n _ref$scope = _ref.scope,\n scope = _ref$scope === void 0 ? typeof window !== 'undefined' ? window : global : _ref$scope;\n\n if (!scope[name]) {\n scope[name] = []; // eslint-disable-line no-param-reassign\n }\n\n return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0___default.a.createElement(LayerStackContext.Provider, {\n value: scope[name]\n }, children);\n}\n\nLayerStackGlobalProvider.propTypes = propTypes;\n\n/* WEBPACK VAR INJECTION */}.call(this, __webpack_require__(95)))\n\n/***/ }),\n\n/***/ 8:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/ui-utils/keyboard */ \"../../node_modules/@splunk/ui-utils/keyboard.js\");\n\n/***/ }),\n\n/***/ 95:\n/***/ (function(module, exports) {\n\nvar g;\n\n// This works in non-strict mode\ng = (function() {\n\treturn this;\n})();\n\ntry {\n\t// This works if eval is allowed (see CSP)\n\tg = g || new Function(\"return this\")();\n} catch (e) {\n\t// This works if the window reference is available\n\tif (typeof window === \"object\") g = window;\n}\n\n// g can still be undefined, but nothing to do about it...\n// We return undefined, instead of nothing here, so it's\n// easier to handle this case. if(!global) { ...}\n\nmodule.exports = g;\n\n\n/***/ })\n\n/******/ });\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@splunk/react-ui/Layer.js?"); + +/***/ }), + +/***/ "../../node_modules/@splunk/react-ui/ScreenReaderContent.js": +/*!*********************************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@splunk/react-ui/ScreenReaderContent.js ***! + \*********************************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +eval("module.exports =\n/******/ (function(modules) { // webpackBootstrap\n/******/ \t// The module cache\n/******/ \tvar installedModules = {};\n/******/\n/******/ \t// The require function\n/******/ \tfunction __webpack_require__(moduleId) {\n/******/\n/******/ \t\t// Check if module is in cache\n/******/ \t\tif(installedModules[moduleId]) {\n/******/ \t\t\treturn installedModules[moduleId].exports;\n/******/ \t\t}\n/******/ \t\t// Create a new module (and put it into the cache)\n/******/ \t\tvar module = installedModules[moduleId] = {\n/******/ \t\t\ti: moduleId,\n/******/ \t\t\tl: false,\n/******/ \t\t\texports: {}\n/******/ \t\t};\n/******/\n/******/ \t\t// Execute the module function\n/******/ \t\tmodules[moduleId].call(module.exports, module, module.exports, __webpack_require__);\n/******/\n/******/ \t\t// Flag the module as loaded\n/******/ \t\tmodule.l = true;\n/******/\n/******/ \t\t// Return the exports of the module\n/******/ \t\treturn module.exports;\n/******/ \t}\n/******/\n/******/\n/******/ \t// expose the modules object (__webpack_modules__)\n/******/ \t__webpack_require__.m = modules;\n/******/\n/******/ \t// expose the module cache\n/******/ \t__webpack_require__.c = installedModules;\n/******/\n/******/ \t// define getter function for harmony exports\n/******/ \t__webpack_require__.d = function(exports, name, getter) {\n/******/ \t\tif(!__webpack_require__.o(exports, name)) {\n/******/ \t\t\tObject.defineProperty(exports, name, { enumerable: true, get: getter });\n/******/ \t\t}\n/******/ \t};\n/******/\n/******/ \t// define __esModule on exports\n/******/ \t__webpack_require__.r = function(exports) {\n/******/ \t\tif(typeof Symbol !== 'undefined' && Symbol.toStringTag) {\n/******/ \t\t\tObject.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });\n/******/ \t\t}\n/******/ \t\tObject.defineProperty(exports, '__esModule', { value: true });\n/******/ \t};\n/******/\n/******/ \t// create a fake namespace object\n/******/ \t// mode & 1: value is a module id, require it\n/******/ \t// mode & 2: merge all properties of value into the ns\n/******/ \t// mode & 4: return value when already ns object\n/******/ \t// mode & 8|1: behave like require\n/******/ \t__webpack_require__.t = function(value, mode) {\n/******/ \t\tif(mode & 1) value = __webpack_require__(value);\n/******/ \t\tif(mode & 8) return value;\n/******/ \t\tif((mode & 4) && typeof value === 'object' && value && value.__esModule) return value;\n/******/ \t\tvar ns = Object.create(null);\n/******/ \t\t__webpack_require__.r(ns);\n/******/ \t\tObject.defineProperty(ns, 'default', { enumerable: true, value: value });\n/******/ \t\tif(mode & 2 && typeof value != 'string') for(var key in value) __webpack_require__.d(ns, key, function(key) { return value[key]; }.bind(null, key));\n/******/ \t\treturn ns;\n/******/ \t};\n/******/\n/******/ \t// getDefaultExport function for compatibility with non-harmony modules\n/******/ \t__webpack_require__.n = function(module) {\n/******/ \t\tvar getter = module && module.__esModule ?\n/******/ \t\t\tfunction getDefault() { return module['default']; } :\n/******/ \t\t\tfunction getModuleExports() { return module; };\n/******/ \t\t__webpack_require__.d(getter, 'a', getter);\n/******/ \t\treturn getter;\n/******/ \t};\n/******/\n/******/ \t// Object.prototype.hasOwnProperty.call\n/******/ \t__webpack_require__.o = function(object, property) { return Object.prototype.hasOwnProperty.call(object, property); };\n/******/\n/******/ \t// __webpack_public_path__\n/******/ \t__webpack_require__.p = \"\";\n/******/\n/******/\n/******/ \t// Load entry module and return exports\n/******/ \treturn __webpack_require__(__webpack_require__.s = 136);\n/******/ })\n/************************************************************************/\n/******/ ({\n\n/***/ 0:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! prop-types */ \"../../node_modules/prop-types/index.js\");\n\n/***/ }),\n\n/***/ 1:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/react-ui/themes */ \"../../node_modules/@splunk/react-ui/themes.js\");\n\n/***/ }),\n\n/***/ 136:\n/***/ (function(module, __webpack_exports__, __webpack_require__) {\n\n\"use strict\";\n// ESM COMPAT FLAG\n__webpack_require__.r(__webpack_exports__);\n\n// EXPORTS\n__webpack_require__.d(__webpack_exports__, \"default\", function() { return /* reexport */ ScreenReaderContent_ScreenReaderContent; });\n\n// EXTERNAL MODULE: external \"react\"\nvar external_react_ = __webpack_require__(2);\nvar external_react_default = /*#__PURE__*/__webpack_require__.n(external_react_);\n\n// EXTERNAL MODULE: external \"prop-types\"\nvar external_prop_types_ = __webpack_require__(0);\nvar external_prop_types_default = /*#__PURE__*/__webpack_require__.n(external_prop_types_);\n\n// EXTERNAL MODULE: external \"styled-components\"\nvar external_styled_components_ = __webpack_require__(3);\nvar external_styled_components_default = /*#__PURE__*/__webpack_require__.n(external_styled_components_);\n\n// EXTERNAL MODULE: external \"@splunk/react-ui/themes\"\nvar themes_ = __webpack_require__(1);\n\n// CONCATENATED MODULE: ./src/ScreenReaderContent/ScreenReaderContentStyles.ts\n\n\nvar Styled = external_styled_components_default.a.span.withConfig({\n displayName: \"ScreenReaderContentStyles__Styled\",\n componentId: \"sc-1lnohwp-0\"\n})([\"\", \";\"], Object(themes_[\"mixin\"])('screenReaderContent'));\n\n// CONCATENATED MODULE: ./src/ScreenReaderContent/ScreenReaderContent.tsx\nfunction _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n\n\n\nvar propTypes = {\n children: external_prop_types_default.a.node.isRequired,\n elementRef: external_prop_types_default.a.oneOfType([external_prop_types_default.a.func, external_prop_types_default.a.object])\n};\n\n/**\n * The screen reader text is used to wrap content that\n * is only accessible through screen readers.\n */\nfunction ScreenReaderContent(_ref) {\n var children = _ref.children,\n elementRef = _ref.elementRef,\n otherProps = _objectWithoutProperties(_ref, [\"children\", \"elementRef\"]);\n\n // @docs-props-type ScreenReaderContentPropsBase\n return /*#__PURE__*/external_react_default.a.createElement(Styled, _extends({\n \"data-test\": \"screen-reader-content\",\n ref: elementRef\n }, otherProps), children);\n}\n\nScreenReaderContent.propTypes = propTypes;\n/* harmony default export */ var ScreenReaderContent_ScreenReaderContent = (ScreenReaderContent);\n// CONCATENATED MODULE: ./src/ScreenReaderContent/index.ts\n\n\n/***/ }),\n\n/***/ 2:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! react */ \"../../node_modules/react/index.js\");\n\n/***/ }),\n\n/***/ 3:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! styled-components */ \"../../node_modules/styled-components/dist/styled-components.browser.esm.js\");\n\n/***/ })\n\n/******/ });\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@splunk/react-ui/ScreenReaderContent.js?"); + +/***/ }), + +/***/ "../../node_modules/@splunk/react-ui/themes.js": +/*!********************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@splunk/react-ui/themes.js ***! + \********************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +eval("module.exports =\n/******/ (function(modules) { // webpackBootstrap\n/******/ \t// The module cache\n/******/ \tvar installedModules = {};\n/******/\n/******/ \t// The require function\n/******/ \tfunction __webpack_require__(moduleId) {\n/******/\n/******/ \t\t// Check if module is in cache\n/******/ \t\tif(installedModules[moduleId]) {\n/******/ \t\t\treturn installedModules[moduleId].exports;\n/******/ \t\t}\n/******/ \t\t// Create a new module (and put it into the cache)\n/******/ \t\tvar module = installedModules[moduleId] = {\n/******/ \t\t\ti: moduleId,\n/******/ \t\t\tl: false,\n/******/ \t\t\texports: {}\n/******/ \t\t};\n/******/\n/******/ \t\t// Execute the module function\n/******/ \t\tmodules[moduleId].call(module.exports, module, module.exports, __webpack_require__);\n/******/\n/******/ \t\t// Flag the module as loaded\n/******/ \t\tmodule.l = true;\n/******/\n/******/ \t\t// Return the exports of the module\n/******/ \t\treturn module.exports;\n/******/ \t}\n/******/\n/******/\n/******/ \t// expose the modules object (__webpack_modules__)\n/******/ \t__webpack_require__.m = modules;\n/******/\n/******/ \t// expose the module cache\n/******/ \t__webpack_require__.c = installedModules;\n/******/\n/******/ \t// define getter function for harmony exports\n/******/ \t__webpack_require__.d = function(exports, name, getter) {\n/******/ \t\tif(!__webpack_require__.o(exports, name)) {\n/******/ \t\t\tObject.defineProperty(exports, name, { enumerable: true, get: getter });\n/******/ \t\t}\n/******/ \t};\n/******/\n/******/ \t// define __esModule on exports\n/******/ \t__webpack_require__.r = function(exports) {\n/******/ \t\tif(typeof Symbol !== 'undefined' && Symbol.toStringTag) {\n/******/ \t\t\tObject.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });\n/******/ \t\t}\n/******/ \t\tObject.defineProperty(exports, '__esModule', { value: true });\n/******/ \t};\n/******/\n/******/ \t// create a fake namespace object\n/******/ \t// mode & 1: value is a module id, require it\n/******/ \t// mode & 2: merge all properties of value into the ns\n/******/ \t// mode & 4: return value when already ns object\n/******/ \t// mode & 8|1: behave like require\n/******/ \t__webpack_require__.t = function(value, mode) {\n/******/ \t\tif(mode & 1) value = __webpack_require__(value);\n/******/ \t\tif(mode & 8) return value;\n/******/ \t\tif((mode & 4) && typeof value === 'object' && value && value.__esModule) return value;\n/******/ \t\tvar ns = Object.create(null);\n/******/ \t\t__webpack_require__.r(ns);\n/******/ \t\tObject.defineProperty(ns, 'default', { enumerable: true, value: value });\n/******/ \t\tif(mode & 2 && typeof value != 'string') for(var key in value) __webpack_require__.d(ns, key, function(key) { return value[key]; }.bind(null, key));\n/******/ \t\treturn ns;\n/******/ \t};\n/******/\n/******/ \t// getDefaultExport function for compatibility with non-harmony modules\n/******/ \t__webpack_require__.n = function(module) {\n/******/ \t\tvar getter = module && module.__esModule ?\n/******/ \t\t\tfunction getDefault() { return module['default']; } :\n/******/ \t\t\tfunction getModuleExports() { return module; };\n/******/ \t\t__webpack_require__.d(getter, 'a', getter);\n/******/ \t\treturn getter;\n/******/ \t};\n/******/\n/******/ \t// Object.prototype.hasOwnProperty.call\n/******/ \t__webpack_require__.o = function(object, property) { return Object.prototype.hasOwnProperty.call(object, property); };\n/******/\n/******/ \t// __webpack_public_path__\n/******/ \t__webpack_require__.p = \"\";\n/******/\n/******/\n/******/ \t// Load entry module and return exports\n/******/ \treturn __webpack_require__(__webpack_require__.s = 98);\n/******/ })\n/************************************************************************/\n/******/ ({\n\n/***/ 12:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! tinycolor2 */ \"../../node_modules/tinycolor2/tinycolor.js\");\n\n/***/ }),\n\n/***/ 5:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/themes/enterpriseDark */ \"../../node_modules/@splunk/themes/enterpriseDark.js\");\n\n/***/ }),\n\n/***/ 89:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/themes/enterprise */ \"../../node_modules/@splunk/themes/enterprise.js\");\n\n/***/ }),\n\n/***/ 90:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! lodash/merge */ \"../../node_modules/lodash/merge.js\");\n\n/***/ }),\n\n/***/ 91:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/themes/lite */ \"../../node_modules/@splunk/themes/lite.js\");\n\n/***/ }),\n\n/***/ 92:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/themes/scp */ \"../../node_modules/@splunk/themes/scp.js\");\n\n/***/ }),\n\n/***/ 93:\n/***/ (function(module, exports) {\n\nmodule.exports = __webpack_require__(/*! @splunk/themes/scpLight */ \"../../node_modules/@splunk/themes/scpLight.js\");\n\n/***/ }),\n\n/***/ 98:\n/***/ (function(module, __webpack_exports__, __webpack_require__) {\n\n\"use strict\";\n// ESM COMPAT FLAG\n__webpack_require__.r(__webpack_exports__);\n\n// EXPORTS\n__webpack_require__.d(__webpack_exports__, \"variable\", function() { return /* reexport */ variable; });\n__webpack_require__.d(__webpack_exports__, \"mixin\", function() { return /* reexport */ mixin; });\n__webpack_require__.d(__webpack_exports__, \"enterprise\", function() { return /* reexport */ themes_enterprise; });\n__webpack_require__.d(__webpack_exports__, \"enterpriseDark\", function() { return /* reexport */ themes_enterpriseDark; });\n__webpack_require__.d(__webpack_exports__, \"lite\", function() { return /* reexport */ themes_lite; });\n__webpack_require__.d(__webpack_exports__, \"scp\", function() { return /* reexport */ themes_scp; });\n__webpack_require__.d(__webpack_exports__, \"scpLight\", function() { return /* reexport */ themes_scpLight; });\n__webpack_require__.d(__webpack_exports__, \"themes\", function() { return /* reexport */ themes; });\n\n// EXTERNAL MODULE: external \"@splunk/themes/enterprise\"\nvar enterprise_ = __webpack_require__(89);\nvar enterprise_default = /*#__PURE__*/__webpack_require__.n(enterprise_);\n\n// EXTERNAL MODULE: external \"tinycolor2\"\nvar external_tinycolor2_ = __webpack_require__(12);\nvar external_tinycolor2_default = /*#__PURE__*/__webpack_require__.n(external_tinycolor2_);\n\n// CONCATENATED MODULE: ./src/themes/enterpriseBase.ts\n// eslint-disable-next-line @typescript-eslint/ban-ts-comment\n// @ts-nocheck\n\n/* harmony default export */ var enterpriseBase = (function (base) {\n return {\n 'react-ui': {\n base: base,\n Accordion: {\n backgroundColor: base.backgroundColor\n },\n Button: {\n iconPaddingRight: '3px',\n iconOnlyPadding: \"0 \".concat(base.spacingQuarter),\n iconOnlyPaddingSmall: '0 2px',\n iconOnlyPaddingLarge: '0 8px',\n paddingSmall: base.spacingQuarter,\n paddingLarge: base.fontSize,\n primaryContentExtraPadding: '1px'\n },\n ButtonSimple: {\n Primary: {\n shadow: \"inset 0 -2px 0 \".concat(external_tinycolor2_default()('black').setAlpha(0.1).toRgbString()),\n selectedShadow: \"inset 0 2px 0 \".concat(external_tinycolor2_default()('black').setAlpha(0.1).toRgbString()),\n focusShadow: \"inset 0 -2px 0 \".concat(external_tinycolor2_default()('black').setAlpha(0.1).toRgbString(), \", \").concat(base.focusShadow),\n selectedFocusShadow: \"inset 0 2px 0 \".concat(external_tinycolor2_default()('black').setAlpha(0.1).toRgbString(), \", \").concat(base.focusShadow),\n color: base.white,\n fontWeight: base.fontWeightSemiBold,\n backgroundColor: base.brandColor,\n hoverBackgroundColor: base.brandColorD20,\n activeBackgroundColor: base.brandColorD30,\n selectedBackgroundColor: base.brandColorD20,\n disabledBackgroundColor: base.brandColorL10,\n disabledTextColor: base.brandColorL30,\n disabledSelectedBackgroundColor: base.brandColorD20,\n prependBorderLeftColor: base.brandColorD20\n },\n Error: {\n shadow: \"inset 0 -2px 0 \".concat(external_tinycolor2_default()('black').setAlpha(0.1).toRgbString()),\n selectedShadow: \"inset 0 2px 0 \".concat(external_tinycolor2_default()('black').setAlpha(0.1).toRgbString()),\n focusShadow: \"inset 0 -2px 0 \".concat(external_tinycolor2_default()('black').setAlpha(0.1).toRgbString(), \", \").concat(base.focusShadow),\n selectedFocusShadow: \"inset 0 2px 0 \".concat(external_tinycolor2_default()('black').setAlpha(0.1).toRgbString(), \", \").concat(base.focusShadow),\n color: base.white,\n fontWeight: base.fontWeightSemiBold,\n backgroundColor: base.errorColor,\n hoverBackgroundColor: base.errorColorD20,\n activeBackgroundColor: base.errorColorD30,\n selectedBackgroundColor: base.errorColorD20,\n disabledBackgroundColor: base.errorColorL10,\n disabledTextColor: base.errorColorL30,\n disabledSelectedBackgroundColor: base.errorColorD20,\n prependBorderLeftColor: base.errorColorD20\n },\n Default: {\n shadow: 'inset 0 -1px 0 rgba(0,0,0,0.1)',\n hoverShadow: 'inset 0 -1px 0 rgba(0,0,0,0.1)',\n activeShadow: 'inset 0 -1px 0 rgba(0,0,0,0.1)',\n selectedShadow: 'inset 0 1px 0 rgba(0,0,0,0.1)',\n focusShadow: \"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow),\n focusHoverShadow: \"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow),\n focusActiveShadow: \"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow),\n focusSelectedShadow: \"inset 0 1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow),\n focusAppendShadow: \"inset 0 -1px 0 rgba(0,0,0,0.1), inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow, \", inset -1px 0 0 \").concat(base.borderColor),\n focusAppendSelectedShadow: \"inset 0 1px 0 rgba(0,0,0,0.1), inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow, \", inset -1px 0 0 \").concat(base.borderColor),\n color: base.gray45,\n fontWeight: 'normal',\n border: base.border,\n borderColorHover: base.borderColor,\n backgroundColor: base.gray98,\n selectedBackgroundColor: base.gray92,\n hoverBackgroundColor: external_tinycolor2_default()(base.gray96).darken(2.5).toHexString(),\n activeBackgroundColor: base.gray92,\n disabledBackgroundColor: base.gray96,\n disabledBorderColor: base.borderLightColor,\n disabledSelectedBackgroundColor: base.gray92,\n disabledSelectedBorderColor: base.borderColor,\n disabledTextColor: base.textDisabledColor,\n activePrependLeftBorderColor: base.borderColor\n },\n Secondary: {\n shadow: 'inset 0 -1px 0 rgba(0,0,0,0.1)',\n hoverShadow: 'inset 0 -1px 0 rgba(0,0,0,0.1)',\n activeShadow: 'inset 0 -1px 0 rgba(0,0,0,0.1)',\n selectedShadow: 'inset 0 1px 0 rgba(0,0,0,0.1)',\n focusShadow: \"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow),\n focusHoverShadow: \"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow),\n focusActiveShadow: \"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow),\n focusSelectedShadow: \"inset 0 1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow),\n focusAppendShadow: \"inset 0 -1px 0 rgba(0,0,0,0.1), inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow, \", inset -1px 0 0 \").concat(base.borderColor),\n focusAppendSelectedShadow: \"inset 0 1px 0 rgba(0,0,0,0.1), inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(base.focusShadow, \", inset -1px 0 0 \").concat(base.borderColor),\n color: base.gray45,\n fontWeight: base.fontWeightSemiBold,\n border: base.border,\n borderColorHover: base.borderColor,\n backgroundColor: base.gray98,\n selectedBackgroundColor: base.gray92,\n hoverBackgroundColor: external_tinycolor2_default()(base.gray96).darken(2.5).toHexString(),\n activeBackgroundColor: base.gray92,\n disabledBackgroundColor: base.gray96,\n disabledBorderColor: base.borderLightColor,\n disabledSelectedBackgroundColor: base.gray92,\n disabledSelectedBorderColor: base.borderColor,\n disabledTextColor: base.textDisabledColor,\n activePrependLeftBorderColor: base.borderColor\n },\n Pill: {\n color: base.gray45,\n fontWeight: 'normal',\n hoverBackgroundColor: base.backgroundColorHover,\n hoverBorderColor: base.borderColor,\n hoverColor: base.linkColor,\n focusColor: base.linkColor,\n expandedBackgroundColor: base.gray92,\n invalidColor: base.errorColor,\n selectedBorderColor: base.accentColor,\n selectedDisabledBorderColor: base.borderLightColor,\n disabledTextColor: base.textDisabledColor\n }\n },\n Calendar: {\n width: '220px',\n padding: '8px',\n DateTable: {\n tableHeaderColor: base.textGray,\n paddingBottom: '2px',\n fontSize: base.fontSizeSmall\n },\n Day: {\n buttonColor: base.gray45,\n buttonHoverColor: base.linkColor,\n buttonHoverBackgroundColor: base.backgroundColorHover,\n buttonSelectedBorderColor: base.accentColor,\n buttonSelectedBorderHoverColor: base.linkColor,\n buttonSelectedBackgroundColor: 'transparent',\n width: '2em',\n lineHeight: '2em',\n border: '1px solid transparent',\n borderRadius: base.borderRadius,\n focusShadow: base.focusShadow,\n todayBackgroundColor: base.gray92\n },\n MonthHeader: {\n textTransform: 'capitalize'\n }\n },\n Card: {\n backgroundColor: base.backgroundColor,\n clickableSelectedBorderColor: base.focusColor,\n borderColor: base.borderLightColor,\n shadow: 'none',\n hoverShadow: base.overlayShadow,\n focusShadow: base.focusShadow,\n Header: {\n subtitleColor: base.textGray,\n padding: base.spacing\n },\n Body: {\n padding: base.spacing,\n firstChildPaddingTop: '0'\n },\n Footer: {\n boxColor: base.textGray,\n padding: base.spacing,\n borderTop: \"1px solid \".concat(base.gray92)\n }\n },\n Chip: {\n backgroundColor: base.gray92,\n borderRadius: '2px',\n clickableColor: base.textGray,\n clickableHoverBackgroundColor: base.gray96,\n decreaseChipHeightBy: '6px',\n disabledBackgroundColor: 'rgba(0, 0, 0, 0.05)',\n errorBackgroundColor: base.errorColorL10,\n focusShadow: base.focusShadow,\n iconColor: base.textColor,\n iconMarginRight: '3px',\n infoBackgroundColor: base.infoColorL10,\n labelColor: base.textColor,\n lineHeight: base.lineHeight,\n linkColor: base.linkColor,\n margin: '0 2px 2px 0',\n mediumSizePadding: \"\".concat(base.spacingQuarter, \" 8px\"),\n removeIconFocusShadow: 'none',\n removeIconFontSize: '0.75em',\n removeIconPaddingLeft: \"\".concat(base.spacingQuarter),\n successBackgroundColor: base.successColorL10,\n warningBackgroundColor: base.warningColorL10\n },\n Clickable: {\n disabledColor: base.textDisabledColor\n },\n Code: {\n commentToken: base.syntaxGray,\n prologToken: base.syntaxGray,\n doctypeToken: base.syntaxGray,\n cdataToken: base.syntaxGray,\n punctuationToken: base.syntaxGray,\n propertyToken: base.syntaxPurple,\n tagToken: base.syntaxPurple,\n booleanToken: base.syntaxPurple,\n numberToken: base.syntaxPurple,\n constantToken: base.syntaxPurple,\n symbolToken: base.syntaxPurple,\n deletedToken: base.syntaxPurple,\n selectorToken: base.syntaxGreen,\n 'attr-nameToken': base.syntaxGreen,\n stringToken: base.syntaxGreen,\n charToken: base.syntaxGreen,\n builtinToken: base.syntaxGreen,\n insertedToken: base.syntaxGreen,\n operatorToken: base.syntaxBrown,\n entityToken: base.syntaxBrown,\n urlToken: base.syntaxBrown,\n atruleToken: base.syntaxBlue,\n 'attr-valueToken': base.syntaxBlue,\n keywordToken: base.syntaxBlue,\n functionToken: base.syntaxRed,\n regexToken: base.syntaxOrange,\n importantToken: base.syntaxOrange,\n variableToken: base.syntaxOrange,\n keyToken: base.syntaxPurple\n },\n CollapsiblePanel: {\n minHeight: \"calc(\".concat(base.lineHeight, \" + 12px)\"),\n marginTop: '2px',\n iconTransition: 'transform 300ms',\n iconPosition: '12px',\n iconTransfromClose: 'rotate(90deg)',\n titleLineHeight: base.lineHeight,\n titlePadding: \"6px calc(\".concat(base.spacing, \" + \").concat(base.spacingHalf, \")\"),\n titleClickableColor: base.textColor,\n titleClickableCollapsedBackgroundColor: base.gray96,\n titleClickableHoverBackgroundColor: base.gray92,\n titleFocusShadow: base.focusShadowInset\n },\n Color: {\n width: '180px',\n clickableInvalidBorderColor: base.errorColor,\n swatchesListMarginRight: '-6px',\n swatchesListMarginBottom: '6px',\n Swatch: {\n marginRight: base.spacingQuarter,\n marginBottom: base.spacingQuarter,\n nullLineColor: '#ed1e24',\n transparentPatternEvenColor: 'transparent',\n transparentPatternOddColor: base.gray80,\n border: base.border,\n focusBorderColor: base.focusColor,\n boxShadow: base.focusShadow,\n smallSize: base.inputHeightSmall\n },\n Input: {\n width: '100%'\n }\n },\n Concertina: {\n panelBodyErrorBackgroundColor: base.errorColorL50,\n panelBodyWarningBackgroundColor: base.warningColorL50,\n Heading: {\n clickableColor: base.textColor,\n clickableBackgroundColor: base.gray96,\n clickableHoverBackgroundColor: base.gray92,\n clickableDisabledBackgroundColor: base.gray96\n }\n },\n ControlGroup: {\n labelColor: base.textColor,\n boxInvalidColor: base.errorColor,\n helpColor: base.textGray,\n labelPadding: '6px 0',\n labelWithTooltipPadding: '6px 0'\n },\n Date: {\n width: '105px',\n widthLarge: '130px',\n widthSmall: '80px'\n },\n File: {\n mediumDropTargetBoxBorderColor: base.borderColor,\n mediumDropTargetBoxDisabledColor: base.textGray,\n mediumDropTargetBoxDisabledFileCount0BackgroundColor: base.gray96,\n largeDropTargetBoxDisabledColor: base.textGray,\n linkColor: base.linkColor,\n linkFocusShadow: base.focusShadowInset,\n iconFill: base.gray60,\n padding: base.spacingQuarter,\n borderDragOver: \"1px solid \".concat(base.accentColorL10),\n errorBorder: \"1px solid \".concat(base.errorColor),\n disabledBorder: 'none',\n windowDropBorder: \"5px solid \".concat(base.accentColorL10),\n Item: {\n backgroundColor: 'transparent',\n boxBackgroundColor: base.gray92,\n boxColor: base.textGray,\n labelColor: base.textColor,\n labelErrorTextColor: base.errorColor,\n labelDisabledBackgroundColor: base.gray96,\n labelDisabledTextColor: base.textGray,\n removeClickableFocusColor: base.linkColor,\n removeClickableHoverBackgroundColor: base.gray96,\n removeClickableHoverColor: base.linkColor,\n borderRadius: '2px',\n padding: \"3px 0 3px \".concat(base.spacingHalf),\n flex: \"0 0 \".concat(base.inputHeight),\n removeClickableBorderRadius: '0 2px 2px 0',\n removeClickablePadding: '3px 0',\n removeClickableErrorBorder: \"1px solid \".concat(base.errorColor),\n removeClickableFocusShadow: base.focusShadow,\n removeClickableSmallFlexBasis: base.inputHeightSmall\n }\n },\n Heading: {\n sectionColor: base.gray45,\n fontWeight: base.fontWeightSemiBold,\n fontSize: base.fontSize,\n h1FontSize: base.fontSizeXXLarge,\n h2FontSize: base.fontSizeXLarge,\n h3FontSize: base.fontSizeLarge,\n h4FontSize: base.fontSize,\n h5FontSize: '12px'\n },\n Image: {\n boxBackgroundColor: base.gray92,\n boxColor: base.textGray,\n labelColor: base.textColor,\n labelDisabledBackgroundColor: base.gray96,\n removeClickableFocusColor: base.linkColor,\n removeClickableHoverBackgroundColor: base.gray96,\n removeClickableHoverColor: base.linkColor,\n padding: \"3px 0 3px \".concat(base.spacingHalf),\n removeClickableColor: 'inherit',\n removeClickableFlex: \"0 0 \".concat(base.inputHeight),\n removeClickableFocusShadow: base.focusShadow\n },\n JSONTree: {\n TreeNode: {\n expandLinkClickableColor: base.linkColor,\n propertyColor: base.syntaxRed,\n typeColorString: base.syntaxTeal,\n typeColorNumber: base.syntaxBlue,\n typeColorBoolean: base.syntaxPurple,\n typeColorNull: base.syntaxBrown,\n typeColorObject: base.textColor\n }\n },\n Link: {\n clickableColor: base.linkColor,\n focusShadow: base.focusShadow,\n disabledColor: base.textDisabledColor,\n focusTextDecoration: 'none',\n externalMargin: '0 0 0 3px',\n borderRadius: 0\n },\n Markdown: {\n codeBlockBackgroundColor: base.gray96,\n codeInlineBackgroundColor: base.gray92\n },\n Menu: {\n backgroundColor: base.backgroundColor,\n Item: {\n backgroundColorHover: base.backgroundColorHover,\n checkboxPaddingLeft: '32px',\n clickableColor: base.gray45,\n descriptionColor: base.textGray,\n disabledSelectedIconColor: base.gray80,\n focusShadowInset: base.focusShadowInset,\n itemSelectedIconColor: base.accentColorL10,\n itemSelectedIconLeft: '8px',\n itemSelectedIconTop: '5px',\n itemIconPaddingRight: '3px',\n itemIconVertical: 'middle',\n matchColor: base.accentColor,\n padding: \"6px \".concat(base.spacingHalf),\n lineHeight: base.lineHeight,\n submenuColor: base.textGray,\n selectablePaddingLeft: '28px',\n selectablePaddingRight: base.spacingHalf,\n selectablePosition: 'left',\n switchLeft: '8px',\n switchTop: '0px'\n },\n Heading: {\n borderTop: base.border,\n padding: \"\".concat(base.spacingQuarter, \" \").concat(base.spacingHalf, \" 6px\")\n }\n },\n Message: {\n iconTop: '7px',\n iconWidth: '25px',\n iconColor: base.white,\n iconInfoColor: base.infoColor,\n iconSuccessColor: base.successColor,\n iconWarningColor: base.warningColor,\n iconErrorColor: base.errorColor,\n boxBorderRadius: base.spacingQuarter,\n boxPadding: \"\".concat(base.spacingHalf, \" 0 \").concat(base.spacingHalf, \" 40px\"),\n boxPaddingWithRemoveIcon: \"\".concat(base.spacingHalf, \" 40px \").concat(base.spacingHalf, \" 40px\"),\n boxInfoBackgroundColor: base.infoColorL50,\n boxSuccessBackgroundColor: base.successColorL50,\n boxWarningBackgroundColor: base.warningColorL50,\n boxErrorBackgroundColor: base.errorColorL50,\n boxInfoBorderColor: base.infoColor,\n boxSuccessBorderColor: base.successColor,\n boxWarningBorderColor: base.warningColor,\n boxErrorBorderColor: base.errorColor,\n removeIconColor: base.gray45,\n removeIconTop: '6px',\n removeIconRight: '8px',\n removeIconPadding: '8px',\n removeIconBorderRadius: base.borderRadius,\n removeIconHoverBorder: \"1px solid \".concat(base.gray80),\n removeIconHoverColor: base.linkColor,\n removeIconHoverBackground: base.gray92,\n removeIconFocusShadow: 'none',\n bannerInfoBackgroundColor: base.infoColorL50,\n bannerSuccessBackgroundColor: base.successColorL50,\n bannerWarningBackgroundColor: base.warningColorL50,\n bannerErrorBackgroundColor: base.errorColorL50,\n removeIconActiveBoxshadow: base.focusShadow\n },\n Modal: {\n boxShadow: \"0 1px 5px \".concat(base.black),\n Body: {\n boxBackgroundColor: base.backgroundColor\n },\n Footer: {\n boxBackgroundColor: base.backgroundColor,\n boxBorderTopColor: base.borderColor\n },\n Header: {\n boxBackgroundColor: base.backgroundColor,\n boxBorderBottomColor: base.borderColor,\n boxPadding: '25px 28px',\n closeAndPeekPaddingRight: '94px',\n closeOrPeekPaddingRight: '54px',\n titleFontWeightSemiBold: base.fontWeightSemiBold,\n titleLineHeight: '22px',\n subTitleLineHeight: base.lineHeight\n }\n },\n ModalLayer: {\n backgroundColor: external_tinycolor2_default()(base.gray30).setAlpha(0.8).toRgbString()\n },\n Monogram: {\n sizeSmall: '32px',\n backgroundColor: base.gray92,\n clickableHoverBoxShadow: base.focusShadowInset,\n clickableFocusBoxShadow: base.focusShadowInset,\n clickableActiveOpacity: 0.85,\n backgroundColors: ['#006d9c', '#ec9960', '#af575a', '#62b3b2', '#4fa484', '#f8be34', '#5a4575', '#708794', '#294e70', '#b6c75a', '#5cc05c', '#007abd', '#dc4e41', '#f1813f', '#f8be34', '#53a051', '#006d9c', '#77d6d8', '#f589ad', '#6a2c5d']\n },\n Multiselect: {\n Normal: {\n border: base.border,\n borderColorHover: base.borderColor,\n boxBackgroundColor: base.white,\n boxFocusShadow: base.focusShadow,\n boxDisabledBackgroundColor: base.gray96,\n boxInvalidBorderColor: base.errorColor,\n boxInvalidColor: base.errorColor,\n boxPadding: '2px 0 0 2px',\n inputPadding: base.spacingQuarter\n },\n Compact: {\n filterBorderBottom: base.border,\n filterBorderTop: base.border,\n filterPadding: '8px',\n toggleAllControlsBorderBottom: base.border,\n toggleAllControlsBorderTop: base.border,\n toggleAllControlsPadding: \"\".concat(base.spacingQuarter, \" 8px\")\n }\n },\n Number: {\n incrementorWidth: '20px',\n mediumWidth: '100px'\n },\n Paginator: {\n chevronLeftMargin: '-1px 3px 0 0',\n chevronRightMargin: '-1px 0 0 3px',\n Button: {\n buttonSimplePadding: base.spacingQuarter\n }\n },\n Paragraph: {\n marginBottom: \"calc(\".concat(base.lineHeight, \" / 2)\")\n },\n Popover: {\n align: 'center',\n lightBackgroundColor: base.backgroundColor,\n lightBorder: base.border,\n lightBorderRadius: base.borderRadius,\n lightBoxShadow: \"0 2px 2px \".concat(external_tinycolor2_default()(base.gray20).setAlpha(0.1).toRgbString()),\n lightColor: base.textColor,\n arrowBorderBottomColor: base.borderColor,\n darkBackgroundColor: base.gray20,\n darkColor: base.white,\n darkArrowBorderBottomColor: base.gray20,\n arrowHeightPixel: 8,\n paddingPixel: 8 // must be same as arrowHeight if arrowHeight is > 0\n\n },\n Progress: {\n backgroundColor: base.transparent,\n tooltipBackgroundColor: base.accentColorD10,\n puckWidth: '300px',\n puckBackground: \"linear-gradient(\\n 90deg,\\n \".concat(base.accentColorD10, \",\\n \").concat(base.accentColorL10, \",\\n 40%,\\n \").concat(base.accentColorL40, \",\\n 80%,\\n \").concat(base.accentColorL40, \"\\n )\")\n },\n Resize: {\n resizeColor: base.borderColor,\n borderColor: base.white\n },\n ResultsMenu: {\n footerBorderBottom: base.border,\n footerBorderTop: base.border,\n footerColor: base.textGray,\n footerPadding: \"6px \".concat(base.spacingHalf),\n loadingMessageColor: base.textGray,\n loadingPadding: \"6px \".concat(base.spacingHalf)\n },\n Select: {\n filterBorderBottom: base.border,\n filterBorderTop: base.border\n },\n SidePanel: {\n panelBackgroundColor: base.backgroundColor,\n panelBoxShadow: '0 0 12px rgba(0, 0, 0, 0.3)'\n },\n Slider: {\n sliderBarHeight: '5px',\n sliderBarTop: '12px',\n sliderBarDisabledBackgroundColor: base.gray92,\n sliderBarLeftSideColor: base.gray45,\n sliderBarRightSideColor: base.gray80,\n sliderBarStepMarksColor: base.gray96,\n sliderThumbBackgroundColor: base.gray45,\n sliderThumbDisabledBackgroundColor: base.gray92,\n sliderThumbHoverShadow: base.focusShadow,\n sliderThumbFocusShadow: base.focusShadow,\n sliderThumbWidth: 18,\n sliderThumBorderRadius: '9px',\n sliderTooltipTop: '6px',\n labelDisabledColor: base.textDisabledColor\n },\n StepBar: {\n Step: {\n color: base.textDisabledColor,\n grayFill: base.gray80,\n nextStroke: base.gray80,\n prevOrActiveFillColor: base.brandColor\n }\n },\n Switch: {\n wrapperErrorColor: base.errorColor,\n labelPaddingLeft: base.spacingQuarter,\n Checkbox: {\n color: base.gray45,\n focusShadow: base.focusShadow,\n selectedBorderColor: base.gray45,\n disabledBorderColor: base.gray80,\n disabledColor: base.gray80,\n errorColor: base.errorColor,\n errorBorderColor: base.errorColorL30,\n selectedErrorBorderColor: base.errorColor\n },\n Radio: {\n color: base.gray45,\n focusShadow: base.focusShadow,\n selectedBorderColor: base.gray45,\n disabledBorderColor: base.gray80,\n disabledColor: base.gray80,\n errorColor: base.errorColor,\n errorBorderColor: base.errorColorL30,\n selectedErrorBorderColor: base.errorColor\n },\n Toggle: {\n shadow: 'inset 0 2px 0 rgba(0, 0, 0, 0.1)',\n toggleFocusShadow: \"\".concat(base.focusShadow, \", inset 0 2px 0 rgba(0, 0, 0, 0.1)\"),\n backgroundColor: base.gray98,\n borderColor: base.borderColor,\n indicatorBackgroundColor: base.gray98,\n indicatorBorderColor: base.borderColor,\n indicatorHoverBackgroundColor: base.gray96,\n toggleIndicatorBorderStyle: 'solid',\n selectedBackgroundColor: base.accentColorL10,\n selectedBorderColor: base.accentColorL10,\n disabledShadow: 'inset 0 2px 0 rgba(0, 0, 0, 0.06)',\n disabledBorderColor: base.borderLightColor,\n disabledBackgroundColor: base.gray96,\n disabledIndBorderColor: external_tinycolor2_default()(base.borderLightColor).setAlpha(0.8).toRgbString(),\n selectedDisabledBackgroundColor: base.accentColorL40,\n errorToggleOutlineBorderColor: base.errorColor\n }\n },\n TabBar: {\n borderColor: base.borderLightColor,\n Tab: {\n clickableColor: base.textColor,\n focusShadowInset: base.focusShadowInset,\n tabUnderlineSize: '3px',\n fontWeight: 'normal',\n underlineBackgroundColor: base.borderLightColor,\n underlineHorizontalBottom: '-1px',\n underlineSelectedBackgroundColor: base.accentColor,\n borderRadius: 0\n }\n },\n Table: {\n focusShadowInset: base.focusShadowInset,\n Cell: {\n linkColor: base.linkColor,\n clickableHoverBackgroundColor: base.accentColorL50,\n padding: '6px 12px',\n expandPadding: '6px 0 0 0',\n verticalAlign: 'top'\n },\n Head: {\n toggleAllWidth: '42px',\n infoWidth: '32px'\n },\n HeadCell: {\n backgroundColor: base.gray92,\n borderLeftColor: base.backgroundColor,\n draggingBackgroundColor: base.gray80,\n guideLineBackgroundColor: base.linkColor,\n focusShadow: base.focusShadowInset,\n moreInfoHeadCellPadding: '5px 0 0 0'\n },\n HeadInner: {\n hoverColor: base.linkColorHover,\n helperBackgroundColor: base.accentColorL50,\n sortIconColor: base.textGray,\n sortIconPosition: 'absolute',\n sortedIconColor: base.accentColor,\n menuIconColor: base.textGray,\n menuIconPadding: '1px 0 0 4px',\n padding: '6px 12px',\n dragContainerTop: '0px',\n dragContainerLeft: '0px',\n menuIconRight: '0',\n dragContainerPadding: '9px 12px',\n dragShadow: base.overlayShadow\n },\n HeadTable: {\n dockedShadow: base.overlayShadow\n },\n Row: {\n stripeNoneClickableHoverBackgroundColor: base.accentColorL50,\n stripeEvenBackgroundColor: base.gray96\n },\n RowDragCell: {\n draggablePadding: '9px 0',\n draggingBackgroundColor: base.gray80,\n guideLineBackgroundColor: base.linkColor,\n helperBackgroundColor: base.accentColorL50,\n width: '32px',\n shadow: base.overlayShadow\n },\n Toggle: {\n inHeadMargin: '-6px 0',\n margin: '-6px 0'\n }\n },\n Text: {\n clearIconRight: '1px',\n clearIconTop: '2px',\n clearIconPadding: '8px',\n inputFocusShadow: base.focusShadow,\n inputColor: base.textColor,\n inputBackgroundColor: base.white,\n inputFocusColor: base.textColor,\n inputBorder: base.border,\n inputHoverBorderColor: base.borderColor,\n inputErrorBorderColor: base.errorColor,\n inputErrorColor: base.errorColor,\n inputDisabledBackgroundColor: base.gray96,\n inputDisabledBorderColor: base.gray92,\n inputDisabledColor: base.textDisabledColor,\n inputClearOrSearchPaddingRight: '28px',\n placeholderMediumSize: '11px',\n placeholderWithSearchLeft: '11px',\n spacingHalf: base.spacingHalf,\n spacingQuarter: base.spacingQuarter,\n searchIconWrapperColor: base.gray60,\n searchIconWrapperRight: '8px',\n searchIconWrapperTop: '8px',\n clearColor: base.gray60,\n placeholderColor: base.textGray,\n searchIconPosition: 'right'\n },\n Tooltip: {\n defaultQuestionMark: true,\n compactFontSize: base.fontSizeSmall,\n compactLineHeight: '18px',\n compactPadding: base.spacingHalf,\n contentFontSize: base.fontSizeSmall,\n contentLineHeight: '18px',\n contentPadding: base.spacingHalf,\n linkColor: base.linkColor,\n openDelaySecondary: 300,\n placement: 'above'\n },\n WaitSpinner: {\n circleStroke: base.gray60\n }\n }\n };\n});\n// CONCATENATED MODULE: ./src/themes/enterprise.ts\n// eslint-disable-next-line @typescript-eslint/ban-ts-comment\n// @ts-nocheck\n\n\n/* harmony default export */ var enterprise = (enterpriseBase(enterprise_default.a));\n// EXTERNAL MODULE: external \"lodash/merge\"\nvar merge_ = __webpack_require__(90);\nvar merge_default = /*#__PURE__*/__webpack_require__.n(merge_);\n\n// EXTERNAL MODULE: external \"@splunk/themes/enterpriseDark\"\nvar enterpriseDark_ = __webpack_require__(5);\nvar enterpriseDark_default = /*#__PURE__*/__webpack_require__.n(enterpriseDark_);\n\n// CONCATENATED MODULE: ./src/themes/enterpriseDark.ts\n// eslint-disable-next-line @typescript-eslint/ban-ts-comment\n// @ts-nocheck\n\n\n\n\n/* harmony default export */ var enterpriseDark = (merge_default()({}, enterpriseBase(enterpriseDark_default.a), {\n 'react-ui': {\n ButtonSimple: {\n Default: {\n shadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray30),\n hoverShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray25),\n activeShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray22),\n selectedShadow: \"inset 0 1px 0 \".concat(enterpriseDark_default.a.black),\n focusShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray30, \", \").concat(enterpriseDark_default.a.focusShadow),\n focusHoverShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray25, \", \").concat(enterpriseDark_default.a.focusShadow),\n focusActiveShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray22, \", \").concat(enterpriseDark_default.a.focusShadow),\n focusSelectedShadow: \"inset 0 1px 0 \".concat(enterpriseDark_default.a.black, \", \").concat(enterpriseDark_default.a.focusShadow),\n focusAppendShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray30, \", \").concat(enterpriseDark_default.a.focusShadow, \", inset -1px 0 0 \").concat(enterpriseDark_default.a.borderColor),\n focusAppendSelectedShadow: \"inset 0 1px 0 \".concat(enterpriseDark_default.a.black, \", \").concat(enterpriseDark_default.a.focusShadow, \", inset -1px 0 0 \").concat(enterpriseDark_default.a.borderColor),\n backgroundColor: enterpriseDark_default.a.gray45,\n color: enterpriseDark_default.a.white,\n selectedBackgroundColor: enterpriseDark_default.a.gray22,\n hoverBackgroundColor: enterpriseDark_default.a.gray30,\n selectedBorderColor: enterpriseDark_default.a.gray20,\n activeBorderColor: enterpriseDark_default.a.gray20,\n activeBackgroundColor: enterpriseDark_default.a.gray22,\n disabledBackgroundColor: enterpriseDark_default.a.gray30,\n disabledBorderColor: enterpriseDark_default.a.gray30,\n disabledSelectedBackgroundColor: enterpriseDark_default.a.gray22,\n disabledSelectedBorderColor: enterpriseDark_default.a.gray20\n },\n Secondary: {\n shadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray30),\n hoverShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray25),\n activeShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray22),\n selectedShadow: \"inset 0 1px 0 \".concat(enterpriseDark_default.a.black),\n focusShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray30, \", \").concat(enterpriseDark_default.a.focusShadow),\n focusHoverShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray25, \", \").concat(enterpriseDark_default.a.focusShadow),\n focusActiveShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray22, \", \").concat(enterpriseDark_default.a.focusShadow),\n focusSelectedShadow: \"inset 0 1px 0 \".concat(enterpriseDark_default.a.black, \", \").concat(enterpriseDark_default.a.focusShadow),\n focusAppendShadow: \"inset 0 -1px 0 \".concat(enterpriseDark_default.a.gray30, \", \").concat(enterpriseDark_default.a.focusShadow, \", inset -1px 0 0 \").concat(enterpriseDark_default.a.borderColor),\n focusAppendSelectedShadow: \"inset 0 1px 0 \".concat(enterpriseDark_default.a.black, \", \").concat(enterpriseDark_default.a.focusShadow, \", inset -1px 0 0 \").concat(enterpriseDark_default.a.borderColor),\n backgroundColor: enterpriseDark_default.a.gray45,\n color: enterpriseDark_default.a.white,\n selectedBackgroundColor: enterpriseDark_default.a.gray22,\n hoverBackgroundColor: enterpriseDark_default.a.gray30,\n selectedBorderColor: enterpriseDark_default.a.gray20,\n activeBorderColor: enterpriseDark_default.a.gray20,\n activeBackgroundColor: enterpriseDark_default.a.gray22,\n disabledBackgroundColor: enterpriseDark_default.a.gray30,\n disabledBorderColor: enterpriseDark_default.a.gray30,\n disabledSelectedBackgroundColor: enterpriseDark_default.a.gray22,\n disabledSelectedBorderColor: enterpriseDark_default.a.gray20\n },\n Pill: {\n color: enterpriseDark_default.a.white,\n hoverColor: enterpriseDark_default.a.white,\n focusColor: enterpriseDark_default.a.white,\n expandedBackgroundColor: enterpriseDark_default.a.gray22\n }\n },\n Calendar: {\n Day: {\n buttonColor: enterpriseDark_default.a.gray98,\n todayBackgroundColor: enterpriseDark_default.a.gray45\n }\n },\n Chip: {\n backgroundColor: enterpriseDark_default.a.gray45,\n clickableHoverBackgroundColor: enterpriseDark_default.a.gray30,\n disabledBackgroundColor: 'rgba(0, 0, 0, 0.15)'\n },\n Code: {\n color: enterpriseDark_default.a.gray92,\n commentToken: enterpriseDark_default.a.gray60,\n prologToken: enterpriseDark_default.a.gray60,\n doctypeToken: enterpriseDark_default.a.gray60,\n cdataToken: enterpriseDark_default.a.gray60,\n punctuationToken: enterpriseDark_default.a.gray60,\n propertyToken: enterpriseDark_default.a.syntaxPurpleLight,\n tagToken: enterpriseDark_default.a.syntaxPurpleLight,\n booleanToken: enterpriseDark_default.a.syntaxPurpleLight,\n numberToken: enterpriseDark_default.a.syntaxPurpleLight,\n constantToken: enterpriseDark_default.a.syntaxPurpleLight,\n symbolToken: enterpriseDark_default.a.syntaxPurpleLight,\n deletedToken: enterpriseDark_default.a.syntaxPurpleLight,\n selectorToken: enterpriseDark_default.a.syntaxGreenLight,\n 'attr-nameToken': enterpriseDark_default.a.syntaxGreenLight,\n stringToken: enterpriseDark_default.a.syntaxGreenLight,\n charToken: enterpriseDark_default.a.syntaxGreenLight,\n builtinToken: enterpriseDark_default.a.syntaxGreenLight,\n insertedToken: enterpriseDark_default.a.syntaxGreenLight,\n operatorToken: enterpriseDark_default.a.syntaxBrown,\n entityToken: enterpriseDark_default.a.syntaxBrown,\n urlToken: enterpriseDark_default.a.syntaxBrown,\n atruleToken: enterpriseDark_default.a.syntaxBlueLight,\n 'attr-valueToken': enterpriseDark_default.a.syntaxBlueLight,\n keywordToken: enterpriseDark_default.a.syntaxBlueLight,\n functionToken: enterpriseDark_default.a.syntaxRedLight,\n regexToken: enterpriseDark_default.a.syntaxOrange,\n importantToken: enterpriseDark_default.a.syntaxOrange,\n variableToken: enterpriseDark_default.a.syntaxOrange\n },\n CollapsiblePanel: {\n titleClickableCollapsedBackgroundColor: enterpriseDark_default.a.gray45,\n titleClickableHoverBackgroundColor: enterpriseDark_default.a.gray30\n },\n Concertina: {\n panelBodyErrorBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.errorColor).setAlpha(0.5).toRgbString(),\n panelBodyWarningBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.warningColor).setAlpha(0.5).toRgbString(),\n Heading: {\n clickableBackgroundColor: enterpriseDark_default.a.gray45,\n clickableHoverBackgroundColor: enterpriseDark_default.a.gray30,\n clickableDisabledBackgroundColor: enterpriseDark_default.a.gray80\n }\n },\n File: {\n mediumDropTargetBoxBorderColor: enterpriseDark_default.a.textGray,\n mediumDropTargetBoxDisabledFileCount0BackgroundColor: enterpriseDark_default.a.gray60,\n iconFill: enterpriseDark_default.a.gray80,\n Item: {\n boxBackgroundColor: enterpriseDark_default.a.gray45,\n removeClickableHoverBackgroundColor: enterpriseDark_default.a.gray30,\n labelDisabledBackgroundColor: enterpriseDark_default.a.gray60\n }\n },\n Image: {\n boxBackgroundColor: enterpriseDark_default.a.gray30,\n removeClickableHoverBackgroundColor: enterpriseDark_default.a.gray45\n },\n Heading: {\n sectionColor: enterpriseDark_default.a.gray80\n },\n JSONTree: {\n TreeNode: {\n propertyColor: enterpriseDark_default.a.syntaxRedLight,\n expandLinkClickableColor: enterpriseDark_default.a.accentColorL40,\n typeColorNumber: enterpriseDark_default.a.syntaxBlueLight,\n typeColorBoolean: enterpriseDark_default.a.syntaxPurpleLight\n }\n },\n Markdown: {\n codeBlockBackgroundColor: enterpriseDark_default.a.gray22,\n codeInlineBackgroundColor: enterpriseDark_default.a.gray22\n },\n Menu: {\n Item: {\n clickableColor: enterpriseDark_default.a.gray96\n }\n },\n Message: {\n boxInfoBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.infoColor).setAlpha(0.5).toRgbString(),\n boxSuccessBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.successColor).setAlpha(0.5).toRgbString(),\n boxWarningBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.warningColor).setAlpha(0.5).toRgbString(),\n boxErrorBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.errorColor).setAlpha(0.5).toRgbString(),\n bannerInfoBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.infoColor).setAlpha(0.5).toRgbString(),\n bannerSuccessBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.successColor).setAlpha(0.5).toRgbString(),\n bannerWarningBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.warningColor).setAlpha(0.5).toRgbString(),\n bannerErrorBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.errorColor).setAlpha(0.5).toRgbString(),\n removeIconColor: enterpriseDark_default.a.gray96,\n removeIconHoverColor: enterpriseDark_default.a.gray96,\n removeIconHoverBackground: enterpriseDark_default.a.gray30,\n removeIconHoverBorder: \"1px solid \".concat(enterpriseDark_default.a.gray22)\n },\n Modal: {\n Footer: {\n boxBorderTopColor: enterpriseDark_default.a.gray20\n },\n Header: {\n boxBorderBottomColor: enterpriseDark_default.a.gray20\n }\n },\n Monogram: {\n backgroundColor: enterpriseDark_default.a.gray45\n },\n Multiselect: {\n Normal: {\n boxBackgroundColor: enterpriseDark_default.a.gray22,\n boxBorderColor: enterpriseDark_default.a.gray20,\n boxDisabledBackgroundColor: enterpriseDark_default.a.gray22,\n boxDisabledBorderColor: enterpriseDark_default.a.gray30\n }\n },\n Number: {\n incrementorBorderColor: enterpriseDark_default.a.gray20\n },\n Popover: {\n lightBorder: enterpriseDark_default.a.borderDark,\n lightBoxShadow: '0 1px 2px #000',\n arrowBorderBottomColor: enterpriseDark_default.a.borderDarkColor,\n darkBackgroundColor: enterpriseDark_default.a.white,\n darkColor: enterpriseDark_default.a.gray20,\n darkArrowBorderBottomColor: enterpriseDark_default.a.white\n },\n Resize: {\n resizeColor: enterpriseDark_default.a.gray92,\n borderColor: enterpriseDark_default.a.gray22\n },\n Slider: {\n sliderBarStepMarksColor: enterpriseDark_default.a.gray20\n },\n Switch: {\n Checkbox: {\n color: enterpriseDark_default.a.gray80,\n borderColor: enterpriseDark_default.a.gray80,\n selectedBorderColor: enterpriseDark_default.a.gray80,\n disabledBorderColor: enterpriseDark_default.a.gray45,\n disabledColor: enterpriseDark_default.a.gray45,\n errorBorderColor: enterpriseDark_default.a.errorColor\n },\n Radio: {\n color: enterpriseDark_default.a.gray80,\n borderColor: enterpriseDark_default.a.gray80,\n selectedBorderColor: enterpriseDark_default.a.gray80,\n disabledBorderColor: enterpriseDark_default.a.gray45,\n disabledColor: enterpriseDark_default.a.gray45,\n errorBorderColor: enterpriseDark_default.a.errorColor\n },\n Toggle: {\n backgroundColor: enterpriseDark_default.a.gray45,\n indicatorBackgroundColor: enterpriseDark_default.a.gray80,\n indicatorHoverBackgroundColor: external_tinycolor2_default()(enterpriseDark_default.a.gray80).darken(6).toRgbString(),\n disabledBorderColor: enterpriseDark_default.a.borderColor,\n disabledBackgroundColor: enterpriseDark_default.a.gray30,\n disabledIndBackgroundColor: enterpriseDark_default.a.gray45,\n disabledIndBorderColor: enterpriseDark_default.a.gray22,\n selectedDisabledBackgroundColor: enterpriseDark_default.a.accentColorD20\n }\n },\n Table: {\n Cell: {\n clickableBackgroundColor: enterpriseDark_default.a.accentColorD50\n },\n HeadCell: {\n backgroundColor: '#212527',\n draggingBackgroundColor: enterpriseDark_default.a.gray20\n },\n HeadInner: {\n helperBackgroundColor: enterpriseDark_default.a.accentColorD50\n },\n Row: {\n stripeNoneClickableHoverBackgroundColor: enterpriseDark_default.a.accentColorD50,\n stripeEvenBackgroundColor: enterpriseDark_default.a.gray25,\n stripeOddBackgroundColor: enterpriseDark_default.a.gray22\n },\n RowDragCell: {\n draggingBackgroundColor: enterpriseDark_default.a.gray20,\n helperBackgroundColor: enterpriseDark_default.a.accentColorD50\n }\n },\n Text: {\n inputBackgroundColor: enterpriseDark_default.a.gray22,\n inputBorder: \"1px solid \".concat(enterpriseDark_default.a.gray20),\n inputHoverBorderColor: enterpriseDark_default.a.gray20,\n inputDisabledBackgroundColor: enterpriseDark_default.a.gray22,\n inputDisabledBorderColor: enterpriseDark_default.a.gray30,\n searchIconWrapperColor: enterpriseDark_default.a.white,\n clearColor: enterpriseDark_default.a.white\n },\n WaitSpinner: {\n circleStroke: enterpriseDark_default.a.white\n }\n }\n}));\n// EXTERNAL MODULE: external \"@splunk/themes/lite\"\nvar lite_ = __webpack_require__(91);\nvar lite_default = /*#__PURE__*/__webpack_require__.n(lite_);\n\n// CONCATENATED MODULE: ./src/themes/lite.ts\n// eslint-disable-next-line @typescript-eslint/ban-ts-comment\n// @ts-nocheck\n\n\n/* harmony default export */ var lite = (enterpriseBase(lite_default.a));\n// EXTERNAL MODULE: external \"@splunk/themes/scp\"\nvar scp_ = __webpack_require__(92);\nvar scp_default = /*#__PURE__*/__webpack_require__.n(scp_);\n\n// CONCATENATED MODULE: ./src/themes/scpBase.ts\nfunction ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); keys.push.apply(keys, symbols); } return keys; }\n\nfunction _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { ownKeys(Object(source), true).forEach(function (key) { _defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }\n\nfunction _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }\n\n// eslint-disable-next-line @typescript-eslint/ban-ts-comment\n// @ts-nocheck\n\n/* harmony default export */ var scpBase = (function (base) {\n var blend = base.mixins.overlayColors;\n return {\n 'react-ui': {\n base: _objectSpread(_objectSpread({}, base), {}, {\n errorColor: base.accentColorNegative\n }),\n Accordion: {\n backgroundColor: base.transparent\n },\n Button: {\n color: 'inherit',\n disabledIconColor: 'inherit',\n iconColor: 'inherit',\n iconOnlyColor: 'inherit',\n iconOnlyDisabledColor: 'inherit',\n iconPaddingRight: '8px',\n\n /* The padding is used to maintain the min-width of icon-oly Button in the scp theme. Whether or not the min-width is overwritten,\n * it gaurantees that the width is always greater than or equal to the inputHeight. */\n iconOnlyPadding: \"0px calc(\".concat(base.inputHeight, \" / 2 - 1px)\"),\n iconOnlyPaddingSmall: \"0px calc(\".concat(base.inputHeightSmall, \" / 2 - 1px)\"),\n iconOnlyPaddingLarge: \"0px calc(\".concat(base.inputHeightLarge, \" / 2 - 1px)\"),\n paddingSmall: '6px',\n paddingLarge: '16px',\n primaryIconColor: 'inherit',\n primaryContentExtraPadding: '1px 0',\n iconOnlyIEFixPosition: 'relative',\n iconOnlyIEFixTransform: 'translateX(-50%)'\n },\n ButtonSimple: {\n Primary: {\n shadow: 'none',\n selectedShadow: 'none',\n focusShadow: base.focusShadow,\n selectedFocusShadow: base.focusShadow,\n borderRadius: '24px',\n color: base.contentColorInverted,\n fontWeight: base.fontWeightSemiBold,\n backgroundColor: base.interactiveColorPrimary,\n activeBackgroundColor: blend(base.interactiveColorPrimary, base.interactiveColorOverlayActive),\n focusBackgroundColor: blend(base.interactiveColorPrimary, base.interactiveColorOverlayHover),\n hoverBackgroundColor: blend(base.interactiveColorPrimary, base.interactiveColorOverlayHover),\n selectedBackgroundColor: blend(base.interactiveColorPrimary, base.interactiveColorOverlaySelected),\n disabledBackgroundColor: base.interactiveColorBackgroundDisabled,\n disabledSelectedBackgroundColor: base.interactiveColorOverlaySelected,\n disabledTextColor: base.contentColorDisabled,\n prependBorderLeftColor: base.interactiveColorPrimary\n },\n Error: {\n color: base.white,\n fontWeight: base.fontWeightSemiBold,\n shadow: 'none',\n selectedShadow: 'none',\n focusShadow: base.focusShadow,\n selectedFocusShadow: base.focusShadow,\n backgroundColor: base.accentColorNegative,\n activeBackgroundColor: blend(base.accentColorNegative, base.interactiveColorOverlayActive),\n focusBackgroundColor: blend(base.accentColorNegative, base.interactiveColorOverlayHover),\n hoverBackgroundColor: blend(base.accentColorNegative, base.interactiveColorOverlayHover),\n selectedBackgroundColor: blend(base.accentColorNegative, base.interactiveColorOverlaySelected),\n disabledBackgroundColor: base.interactiveColorBackgroundDisabled,\n disabledTextColor: base.contentColorDisabled,\n disabledSelectedBackgroundColor: base.interactiveColorOverlaySelected,\n prependBorderLeftColor: base.transparent\n },\n Default: {\n shadow: 'none',\n hoverShadow: 'none',\n activeShadow: 'none',\n selectedShadow: 'none',\n focusShadow: base.focusShadow,\n focusHoverShadow: base.focusShadow,\n focusActiveShadow: base.focusShadow,\n focusSelectedShadow: base.focusShadow,\n focusAppendShadow: base.focusShadow,\n focusAppendSelectedShadow: base.focusShadow,\n color: base.contentColorActive,\n fontWeight: base.fontWeightSemiBold,\n border: \"1px solid \".concat(base.interactiveColorBorder),\n borderColorHover: base.interactiveColorBorderHover,\n borderRadius: '24px',\n backgroundColor: base.transparent,\n activeBackgroundColor: base.interactiveColorOverlayActive,\n focusBackgroundColor: base.interactiveColorOverlayHover,\n hoverBackgroundColor: base.interactiveColorOverlayHover,\n selectedBackgroundColor: base.interactiveColorOverlaySelected,\n disabledBackgroundColor: base.transparent,\n disabledBorderColor: base.interactiveColorBorderDisabled,\n disabledSelectedBorderColor: base.interactiveColorBorderDisabled,\n disabledSelectedBackgroundColor: blend(base.interactiveColorBackgroundDisabled, base.interactiveColorOverlaySelected),\n disabledTextColor: base.contentColorDisabled,\n activePrependLeftBorderColor: base.interactiveColorBorder\n },\n Secondary: {\n shadow: 'none',\n hoverShadow: 'none',\n activeShadow: 'none',\n selectedShadow: 'none',\n focusShadow: base.focusShadow,\n focusHoverShadow: base.focusShadow,\n focusActiveShadow: base.focusShadow,\n focusSelectedShadow: base.focusShadow,\n focusAppendShadow: base.focusShadow,\n focusAppendSelectedShadow: base.focusShadow,\n color: base.contentColorActive,\n fontWeight: base.fontWeightSemiBold,\n border: \"1px solid \".concat(base.transparent),\n borderColorHover: base.transparent,\n borderRadius: '24px',\n backgroundColor: base.transparent,\n activeBackgroundColor: base.interactiveColorOverlayActive,\n focusBackgroundColor: base.interactiveColorOverlayHover,\n hoverBackgroundColor: base.interactiveColorOverlayHover,\n selectedBackgroundColor: base.interactiveColorOverlaySelected,\n disabledBackgroundColor: base.transparent,\n disabledBorderColor: base.transparent,\n disabledSelectedBorderColor: base.transparent,\n disabledTextColor: base.contentColorDisabled,\n disabledSelectedBackgroundColor: base.interactiveColorOverlaySelected,\n selectedPrependLeftBorderColor: base.transparent,\n activePrependLeftBorderColor: base.transparent\n },\n Toggle: {\n border: \"1px solid \".concat(base.interactiveColorBorder),\n borderColorHover: base.interactiveColorBorderHover,\n color: base.contentColorActive,\n fontWeight: 'normal',\n focusShadow: base.focusShadow,\n activeBorderColor: base.interactiveColorBorderHover,\n activeBackgroundColor: base.interactiveColorOverlayActive,\n focusBackgroundColor: base.interactiveColorOverlayHover,\n hoverBackgroundColor: base.interactiveColorOverlayHover,\n selectedBackgroundColor: base.interactiveColorOverlaySelected,\n disabledBorderColor: base.interactiveColorBorderDisabled,\n disabledTextColor: base.contentColorDisabled,\n disabledSelectedBackgroundColor: base.interactiveColorOverlaySelected,\n selectedPrependLeftBorderColor: base.interactiveColorBorder\n },\n Flat: {\n border: \"1px solid \".concat(base.transparent),\n color: base.contentColorActive,\n fontWeight: base.fontWeightSemiBold,\n focusShadow: base.focusShadow,\n backgroundColor: base.interactiveColorBackground,\n activeBackgroundColor: blend(base.interactiveColorBackground, base.interactiveColorOverlayActive),\n focusBackgroundColor: blend(base.interactiveColorBackground, base.interactiveColorOverlayHover),\n hoverBackgroundColor: blend(base.interactiveColorBackground, base.interactiveColorOverlayHover),\n selectedBackgroundColor: blend(base.interactiveColorBackground, base.interactiveColorOverlayActive),\n disabledBackgroundColor: base.interactiveColorBackgroundDisabled,\n disabledTextColor: base.contentColorDisabled,\n disabledSelectedBackgroundColor: base.interactiveColorOverlaySelected\n }\n },\n Calendar: {\n width: '332px',\n padding: '16px',\n DateTable: {\n paddingBottom: '4px',\n fontSize: base.fontSize,\n tableHeaderColor: base.contentColorMuted\n },\n Day: {\n buttonColor: base.contentColorActive,\n buttonHoverColor: base.contentColorActive,\n buttonHoverBackgroundColor: base.interactiveColorOverlayHover,\n buttonFocusBackgroundColor: base.interactiveColorOverlayHover,\n buttonSelectedBorderColor: 'none',\n buttonSelectedBorderHoverColor: 'none',\n buttonSelectedColor: base.contentColorActive,\n buttonSelectedBackgroundColor: base.interactiveColorOverlaySelected,\n buttonSelectedFontSize: base.fontSizeLarge,\n buttonSelectedFontWeight: base.fontWeightBold,\n width: '36px',\n lineHeight: '36px',\n border: 'none',\n borderRadius: '50%',\n focusShadow: base.focusShadow,\n position: 'relative',\n showTodayCircle: true,\n todayCircleColor: base.interactiveColorBorder,\n todayBackgroundColor: base.transparent\n },\n MonthHeader: {\n fontSize: '20px',\n fontWeight: base.fontWeightBold,\n textTransform: 'uppercase',\n wordSpacing: '32px',\n textColor: base.contentColorActive,\n shortForm: true\n }\n },\n Card: {\n backgroundColor: base.backgroundColorSection,\n clickableSelectedBorderColor: base.transparent,\n borderColor: base.transparent,\n borderRadius: base.borderRadius,\n shadow: base.embossShadow,\n hoverShadow: base.embossShadow,\n focusShadow: \"\".concat(base.embossShadow, \", \").concat(base.focusShadowInset),\n hoverBackgroundColor: blend(base.backgroundColorSection, base.interactiveColorOverlayHover),\n focusBackgroundColor: blend(base.backgroundColorSection, base.interactiveColorOverlayHover),\n selectedBackgroundColor: blend(base.backgroundColorSection, base.interactiveColorOverlaySelected),\n Header: {\n subtitleColor: base.contentColorMuted,\n padding: '12px 8px 12px 16px'\n },\n Body: {\n padding: '16px',\n firstChildPaddingTop: '16px'\n },\n Footer: {\n boxColor: base.contentColorMuted,\n padding: '8px 16px 16px',\n borderTop: 'none'\n }\n },\n Chip: {\n backgroundColor: base.neutral100,\n borderRadius: '4px',\n clickableColor: base.contentColorDefault,\n decreaseChipHeightBy: '4px',\n disabledBackgroundColor: base.interactiveColorBackgroundDisabled,\n errorBackgroundColor: '#fe3a3a',\n removeIconFocusHoverBackgroundColor: base.interactiveColorOverlayHover,\n focusShadow: 'none',\n iconColor: base.contentColorActive,\n iconMarginRight: '8px',\n infoBackgroundColor: '#4ba8ff',\n labelColor: base.contentColorActive,\n lineHeight: '16px',\n linkColor: base.contentColorActive,\n margin: '1px',\n mediumFontSize: base.fontSizeSmall,\n mediumSizePadding: '7px 8px 8px',\n outlineBorderColor: base.interactiveColorBorder,\n outlineBackgroundColor: base.transparent,\n removeIconBackgroundColorBool: true,\n removeIconFocusShadow: base.focusShadow,\n removeIconFontSize: '0.77em',\n removeIconPaddingLeft: 'none',\n successBackgroundColor: '#08e045',\n warningBackgroundColor: '#ffc500'\n },\n Clickable: {\n disabledColor: base.contentColorDisabled\n },\n Code: {\n commentToken: base.syntaxGray,\n prologToken: base.syntaxGray,\n doctypeToken: base.syntaxGray,\n cdataToken: base.syntaxGray,\n punctuationToken: base.syntaxGray,\n propertyToken: base.syntaxPurple,\n tagToken: base.syntaxPurple,\n booleanToken: base.syntaxPurple,\n numberToken: base.syntaxPurple,\n constantToken: base.syntaxPurple,\n symbolToken: base.syntaxPurple,\n deletedToken: base.syntaxPurple,\n selectorToken: base.syntaxGreen,\n 'attr-nameToken': base.syntaxGreen,\n stringToken: base.syntaxGreen,\n charToken: base.syntaxGreen,\n builtinToken: base.syntaxGreen,\n insertedToken: base.syntaxGreen,\n operatorToken: base.syntaxBrown,\n entityToken: base.syntaxBrown,\n urlToken: base.syntaxBrown,\n atruleToken: base.syntaxBlue,\n 'attr-valueToken': base.syntaxBlue,\n keywordToken: base.syntaxBlue,\n functionToken: base.syntaxRed,\n regexToken: base.syntaxOrange,\n importantToken: base.syntaxOrange,\n variableToken: base.syntaxOrange,\n keyToken: base.syntaxPurple\n },\n CollapsiblePanel: {\n minHeight: '40px',\n backgroundColor: base.backgroundColorSection,\n marginTop: '1px',\n iconPosition: '12px',\n iconTransition: 'transform 200ms',\n iconTransfromOpen: 'translateY(-2px) rotate(0deg)',\n iconTransfromClose: 'rotate(90deg)',\n iconTransfromOrigin: 'center',\n paddingBottom: '2px',\n titleLineHeight: '24px',\n titlePadding: \"8px 30px\",\n titleBackgroundColor: base.interactiveColorBackground,\n titleClickableCollapsedBackgroundColor: base.interactiveColorBackground,\n titleClickableHoverBackgroundColor: blend(base.interactiveColorBackground, base.interactiveColorOverlayHover),\n titleClickableColor: base.contentColorActive,\n titleClickableCollapsedColor: base.contentColorActive,\n titleBorder: 'none',\n titleFocusBorder: \"none solid \".concat(base.focusColor),\n titleShadow: 'none',\n titleFocusShadow: base.focusShadowInset,\n descriptionPosition: 'relative',\n descriptionPositionRight: '20px'\n },\n Color: {\n inputTopLayout: true,\n width: '214px',\n display: 'flex',\n flexDirection: 'column-reverse',\n borderRadius: '4px',\n swatchesListMarginRight: '-8px',\n swatchesListMarginBottom: '-8px',\n clickableInvalidBorderColor: base.accentColorNegative,\n Swatch: {\n marginRight: '8px',\n marginBottom: '8px',\n borderRadius: '2px',\n border: \"1px solid \".concat(base.interactiveColorBorder),\n transparentPatternEvenColor: base.transparent,\n transparentPatternOddColor: 'rgba(0, 0, 0, 0.2)',\n transparentBackgroundColor: base.white,\n textBoxSwatch: true,\n focusBorderColor: base.focusColor,\n nullLineColor: base.accentColorNegative,\n boxShadow: base.focusShadow,\n smallSize: '22px'\n },\n Input: {\n width: 'calc(100% - 2px)',\n marginBottom: '8px',\n position: 'relative'\n }\n },\n ControlGroup: {\n labelColor: base.contentColorMuted,\n labelPadding: '8px 0',\n labelWithTooltipPadding: '0',\n helpColor: base.contentColorMuted,\n boxInvalidColor: base.accentColorNegative\n },\n Date: {\n position: 'relative',\n letterSpacing: '2px',\n spacedFormat: true,\n width: '152px',\n widthLarge: '160px',\n widthSmall: '128px',\n shouldRenderIcon: true,\n iconColor: base.contentColorDefault,\n iconDisabledColor: base.contentColorDisabled\n },\n File: {\n cloudIcon: true,\n cloudColor: base.contentColorDefault,\n linkColor: base.linkColor,\n mediumDropTargetBoxBorderColor: base.contentColorMuted,\n mediumDropTargetBoxDisabledFileCount0BackgroundColor: base.transparent,\n mediumDropTargetBoxDisabledColor: base.contentColorDisabled,\n largeDropTargetBoxDisabledColor: base.contentColorDisabled,\n borderDragOver: \"1px dashed \".concat(base.interactiveColorBorderHover),\n iconFill: base.contentColorMuted,\n iconErrorFill: base.accentColorNegative,\n iconDisabledFill: base.contentColorDisabled,\n padding: '8px',\n backgroundColorDragOver: base.interactiveColorOverlayActive,\n errorTextColor: base.accentColorNegative,\n errorBorder: \"1px dashed \".concat(base.accentColorNegative),\n disabledBorder: \"1px solid \".concat(base.contentColorDisabled),\n linkFocusShadow: base.focusShadow,\n windowDropBorder: \"5px solid \".concat(base.interactiveColorPrimary),\n Item: {\n itemRemovable: true,\n boxColor: base.contentColorDefault,\n labelColor: base.contentColorActive,\n backgroundColor: base.transparent,\n boxBackgroundColor: base.interactiveColorBackground,\n labelDisabledBackgroundColor: base.interactiveColorBackgroundDisabled,\n labelDisabledTextColor: base.contentColorDisabled,\n labelErrorTextColor: base.accentColorNegative,\n borderRadius: base.borderRadius,\n fontSize: '12px',\n padding: \"4px 0 3px 8px\",\n flex: 'none',\n removeClickableBorderRadius: '50%',\n labelErrorBackgroundColor: base.interactiveColorBackground,\n removeClickableColor: base.contentColorDefault,\n removeClickableBackgroundColor: base.transparent,\n removeClickableErrorBorder: 'none',\n removeClickableErrorBackgroundColor: base.transparent,\n removeClickableErrorHoverBackgroundColor: base.accentColorNegative,\n removeClickableErrorFocusBackgroundColor: base.accentColorNegative,\n removeClickableFocusShadow: 'none',\n removeClickableFocusBackgroundColor: base.interactiveColorOverlayHover,\n removeClickableFocusColor: base.contentColorMuted,\n removeClickableHoverBackgroundColor: base.interactiveColorOverlayHover,\n removeClickableHoverColor: base.contentColorActive,\n removeClickableSmallFlexBasis: 'auto',\n removeClickableSmallTop: '6px',\n removeClickablePadding: '3px 0'\n }\n },\n Heading: {\n fontSize: base.fontSize,\n fontWeight: base.fontWeightBold,\n h1FontSize: '36px',\n h2FontSize: '24px',\n h3FontSize: '20px',\n h4FontSize: '16px',\n h5FontSize: '13px',\n h1LineHeight: '48px',\n h2LineHeight: '24px',\n h3LineHeight: '24px',\n h4LineHeight: '24px',\n h5LineHeight: '16px',\n headingColor: base.contentColorActive,\n sectionColor: base.contentColorDefault\n },\n Image: {\n cloudIcon: true,\n overflow: 'hidden',\n borderRadius: base.borderRadius,\n boxBackgroundColor: base.interactiveColorBackground,\n boxColor: base.contentColorMuted,\n labelColor: base.contentColorDefault,\n labelDisabledBackgroundColor: base.interactiveColorBackgroundDisabled,\n padding: '8px 10px',\n fontSize: '12px',\n lineHeight: '16px',\n removeClickableColor: base.contentColorDefault,\n removeClickableFlex: 'none',\n removeClickableBorderRadius: '50%',\n removeClickableBackgroundColor: base.interactiveColor,\n removeClickableHoverBackgroundColor: base.interactiveColorOverlayHover,\n removeClickableHoverColor: base.contentColorActive,\n removeClickableFocusColor: base.contentColorActive,\n removeClickableFocusShadow: 'none',\n removeClickableFocusBackgroundColor: base.interactiveColorOverlayHover\n },\n JSONTree: {\n TreeNode: {\n propertyColor: base.syntaxRed,\n expandLinkClickableColor: base.interactiveColorPrimary,\n typeColorNumber: base.syntaxBlue,\n typeColorBoolean: base.syntaxPurple,\n typeColorString: base.syntaxTeal,\n typeColorNull: base.syntaxBrown,\n typeColorObject: base.contentColorDefault\n }\n },\n Link: {\n clickableColor: base.linkColor,\n focusShadow: base.focusShadow,\n disabledColor: base.contentColorDisabled,\n focusTextDecoration: 'underline',\n externalMargin: '0 0 0 4px',\n borderRadius: '1px'\n },\n Markdown: {\n codeBlockBackgroundColor: base.backgroundColorSection,\n codeInlineBackgroundColor: base.neutral200\n },\n Menu: {\n backgroundColor: base.backgroundColorPopup,\n Divider: {\n borderColor: base.neutral200\n },\n Heading: {\n borderTop: \"1px solid \".concat(base.neutral200),\n padding: '13px 16px 10px 16px'\n },\n Item: {\n backgroundColorHover: base.interactiveColorOverlayHover,\n backgroundColorFocus: base.interactiveColorOverlayHover,\n backgroundColorActive: base.interactiveColorOverlayHover,\n checkboxPaddingLeft: '42px',\n clickableColor: base.contentColorActive,\n disabledSelectedIconColor: base.contentColorDisabled,\n descriptionLineHeight: '16px',\n descriptionColor: base.contentColorDefault,\n focusShadowInset: base.focusShadowInset,\n itemIconPaddingRight: '8px',\n itemIconVertical: 'initial',\n itemSelectedIconColor: base.contentColorActive,\n itemSelectedIconLeft: null,\n itemSelectedIconTop: null,\n itemSelectedIconRight: '16px',\n lineHeight: '24px',\n matchColorBackground: base.interactiveColorPrimary,\n matchColor: base.contentColorInverted,\n padding: '12px 16px',\n spacingHalf: '16px',\n selectablePaddingLeft: '16px',\n selectablePaddingRight: '44px',\n selectablePosition: 'right',\n submenuColor: base.contentColorMuted,\n switchLeft: '16px',\n switchTop: '6px'\n }\n },\n Message: {\n smallIcon: true,\n iconTop: '0px',\n iconPaddingTop: '8px',\n iconWidth: '24px',\n iconColor: base.white,\n iconInfoColor: base.contentColorActive,\n iconSuccessColor: base.accentColorPositive,\n iconWarningColor: base.accentColorWarning,\n iconErrorColor: base.accentColorNegative,\n iconFillColor: base.backgroundColorPopup,\n iconInfoBackgroundColor: base.contentColorActive,\n iconSuccessBackgroundColor: base.accentColorPositive,\n iconWarningBackgroundColor: base.accentColorWarning,\n iconErrorBackgroundColor: base.accentColorNegative,\n contentColor: base.contentColorActive,\n contentFillColor: base.contentColorActive,\n boxInfoBackgroundColor: base.backgroundColorPopup,\n boxSuccessBackgroundColor: base.backgroundColorPopup,\n boxWarningBackgroundColor: base.backgroundColorPopup,\n boxErrorBackgroundColor: base.backgroundColorPopup,\n boxPadding: \"10px 0px 10px 32px\",\n boxPaddingWithRemoveIcon: '10px 40px 10px 32px',\n boxBorderRadius: base.borderRadius,\n boxInfoBorderColor: base.transparent,\n boxSuccessBorderColor: base.transparent,\n boxWarningBorderColor: base.transparent,\n boxErrorBorderColor: base.transparent,\n removeIconColor: base.contentColorDefault,\n removeIconTop: '2px',\n removeIconRight: '2px',\n removeIconPadding: '10px',\n removeIconBorderRadius: '50%',\n removeIconHoverColor: 'inherit',\n removeIconHoverBorder: 'inhert',\n removeIconActiveBoxshadow: 'none',\n removeIconFocusShadow: base.focusShadow,\n removeIconHoverBackground: base.interactiveColorOverlayHover,\n removeIconActiveBackground: base.interactiveColorOverlayActive,\n bannerTextColorLight: base.contentColorInverted,\n bannerTextColorDark: base.contentColorActive,\n bannerInfoBackgroundColor: base.contentColorMuted,\n bannerSuccessBackgroundColor: base.accentColorPositive,\n bannerWarningBackgroundColor: base.accentColorWarning,\n bannerErrorBackgroundColor: base.accentColorNegative,\n Link: {\n focusShadow: base.focusShadow\n }\n },\n Modal: {\n boxShadow: base.modalShadow,\n Body: {\n boxBackgroundColor: base.backgroundColorModal\n },\n Footer: {\n boxBackgroundColor: base.backgroundColorModal,\n boxBorderTopColor: base.interactiveColorBorder\n },\n Header: {\n boxBackgroundColor: base.backgroundColorModal,\n boxBorderBottomColor: base.interactiveColorBorder,\n titleColor: base.contentColorActive,\n boxPadding: '24px',\n closeAndPeekPaddingRight: '88px',\n closeOrPeekPaddingRight: '52px',\n titleFontWeightSemiBold: '500',\n titleLineHeight: '24px',\n subTitleLineHeight: '24px',\n iconBackgroundColor: base.transparent\n }\n },\n ModalLayer: {\n backgroundColor: base.backgroundColorScrim\n },\n Monogram: {\n sizeSmall: '36px',\n color: base.contentColorActive,\n backgroundColor: base.neutral100,\n clickableHoverBoxShadow: 'none',\n clickableFocusBoxShadow: base.focusShadow,\n clickableFocusHoverBorder: \"1px solid \".concat(base.transparent),\n clickableActiveBorder: \"1px solid \".concat(base.transparent),\n clickableActiveBackgroundColor: base.neutral,\n clickableActiveOpacity: 1,\n clickableFocusHoverBackgroundColor: base.neutral200,\n backgroundColors: ['#006d9c', '#ec9960', '#af575a', '#62b3b2', '#4fa484', '#f8be34', '#5a4575', '#708794', '#294e70', '#b6c75a', '#5cc05c', '#007abd', '#dc4e41', '#f1813f', '#f8be34', '#53a051', '#006d9c', '#77d6d8', '#f589ad', '#6a2c5d']\n },\n Multiselect: {\n Normal: {\n border: \"1px solid \".concat(base.interactiveColorBorder),\n borderColorHover: base.interactiveColorBorderHover,\n boxBackgroundColor: base.transparent,\n boxDisabledBackgroundColor: base.transparent,\n boxDisabledBorderColor: base.interactiveColorBorderDisabled,\n boxFocusBorderColor: base.focusColor,\n boxFocusShadow: 'none',\n boxInvalidBorderColor: base.accentColorNegative,\n boxInvalidColor: base.accentColorNegative,\n boxPadding: '0',\n inputPadding: '7px 10px'\n },\n Compact: {\n filterBorderBottom: \"1px solid \".concat(base.neutral200),\n filterBorderTop: \"1px solid \".concat(base.neutral200),\n filterPadding: '10px 16px',\n toggleAllControlsBorderBottom: \"1px solid \".concat(base.neutral200),\n toggleAllControlsBorderTop: \"1px solid \".concat(base.neutral200),\n toggleAllControlsPadding: '10px 16px'\n }\n },\n Number: {\n incrementorWidth: '22px',\n mediumWidth: '116px',\n appearance: 'scp'\n },\n Paginator: {\n chevronLeftMargin: '-3px 6px 0 0',\n chevronRightMargin: '-3px 0 0 6px',\n Button: {\n buttonSimpleMarginLeft: '8px',\n buttonSimplePadding: base.spacingQuarter,\n buttonSimpleFontWeight: 'normal',\n buttonSimpleSelectedFontWeight: base.fontWeightBold\n }\n },\n Paragraph: {\n marginBottom: '14px'\n },\n Popover: {\n align: 'edge',\n lightBorder: base.transparent,\n lightBoxShadow: base.overlayShadow,\n lightBackgroundColor: base.backgroundColorPopup,\n lightBorderRadius: base.borderRadius,\n lightColor: base.contentColorDefault,\n darkBackgroundColor: base.backgroundColorFloating,\n darkColor: base.contentColorInverted,\n darkBorderRadius: base.borderRadius,\n arrowHeightPixel: 0,\n paddingPixel: 8 // must be same as arrowHeight if arrowHeight is > 0\n\n },\n Progress: {\n backgroundColor: base.neutral200,\n tooltipBackgroundColor: base.interactiveColorPrimary,\n puckWidth: '100%',\n puckBackground: external_tinycolor2_default()(base.statusColorInfo).lighten(10).toRgbString()\n },\n RadioBar: {\n segmentedAppearance: true,\n padding: '1px',\n background: base.interactiveColorBackground,\n borderRadius: base.borderRadius,\n disabledBackground: base.interactiveColorBackgroundDisabled,\n errorBorder: \"1px solid \".concat(base.accentColorNegative),\n Option: {\n backgroundColor: 'inherit',\n activeBackgroundColor: base.interactiveColorOverlayActive,\n hoverFocusBackgroundColor: base.interactiveColorOverlayHover,\n selectedBackgroundColor: base.radioBarOptionSelectedBackgroundColor,\n selectedDisabledBackgroundColor: base.backgroundColorPage,\n selectedShadow: base.embossShadow,\n focusShadow: base.focusShadow,\n borderRadius: '3px',\n marginLeft: '2px',\n boxShadow: 'none',\n minHeight: '32px',\n lineHeight: '18px',\n disabledTextColor: base.contentColorDisabled,\n selectedTextColor: base.contentColorActive,\n hoverTextColor: base.contentColorActive,\n textColor: base.contentColorDefault,\n disabledIconColor: base.contentColorDisabled,\n selectedIconColor: base.contentColorDefault,\n hoverIconColor: base.contentColorDefault,\n iconColor: base.contentColorMuted\n }\n },\n Resize: {\n resizeColor: base.contentColorDefault,\n borderColor: base.interactiveColorBackground\n },\n ResultsMenu: {\n backgroundColor: base.backgroundColorPopup,\n borderRadius: base.borderRadius,\n footerColor: base.contentColorMuted,\n footerBorderBottom: \"1px solid \".concat(base.neutral200),\n footerBorderTop: \"1px solid \".concat(base.neutral200),\n footerPadding: '12px 16px',\n loadingMessageColor: base.contentColorMuted,\n loadingLineHeight: '24px',\n loadingPadding: '12px 16px'\n },\n Select: {\n filterBorderBottom: \"1px solid \".concat(base.neutral200),\n filterBorderTop: \"1px solid \".concat(base.neutral200)\n },\n SidePanel: {\n panelBackgroundColor: base.backgroundColorSidebar,\n panelBoxShadow: base.overlayShadow\n },\n Slider: {\n sliderBarHeight: '4px',\n sliderBarStepMarksColor: base.neutral100,\n sliderBarTop: '16px',\n sliderBarDisabledBackgroundColor: base.contentColorDisabled,\n sliderBarLeftSideColor: base.contentColorActive,\n sliderBarRightSideColor: base.interactiveColorBorder,\n labelDisabledColor: base.contentColorDisabled,\n sliderThumbBackgroundColor: base.contentColorActive,\n sliderThumbDisabledBackgroundColor: base.neutral400,\n sliderThumbHoverShadow: 'none',\n sliderThumbFocusShadow: base.focusShadow,\n sliderThumbWidth: 20,\n sliderThumBorderRadius: '10px',\n sliderTooltipTop: '8px'\n },\n StepBar: {\n Step: {\n currentStepColor: base.contentColorActive,\n currentStepFontWeight: base.fontWeightSemiBold,\n grayFill: base.contentColorMuted,\n nextStroke: base.contentColorMuted,\n prevOrActiveFillColor: base.interactiveColorPrimary,\n color: base.contentColorDisabled\n }\n },\n Switch: {\n labelPaddingLeft: '12px',\n labelPosition: 'relative',\n labelShiftWithSmall: '-1px',\n padding: '8px 0',\n wrapperErrorColor: base.accentColorNegative,\n Checkbox: {\n color: base.white,\n borderColor: base.contentColorMuted,\n margin: '3px',\n focusShadow: base.focusShadow,\n hasBackground: true,\n selectedBorderColor: base.interactiveColorPrimary,\n selectedBackgroundColor: base.interactiveColorPrimary,\n disabledBorderColor: base.contentColorDisabled,\n disabledColor: base.contentColorDisabled,\n errorBorderColor: base.accentColorNegative,\n accentColorNegative: base.accentColorNegative,\n selectedErrorBorderColor: base.accentColorNegative,\n someSize: '6px',\n someMargin: '0px',\n top: '1px'\n },\n Radio: {\n color: base.interactiveColorPrimary,\n borderColor: base.contentColorMuted,\n margin: '3px',\n focusShadow: base.focusShadow,\n hasBackground: true,\n selectedBorderColor: base.interactiveColorPrimary,\n disabledColor: base.contentColorDisabled,\n disabledBorderColor: base.contentColorDisabled,\n errorBorderColor: base.accentColorNegative,\n accentColorNegative: base.accentColorNegative,\n selectedErrorBorderColor: base.accentColorNegative,\n top: '-2px'\n },\n Toggle: {\n width: '30px',\n shadow: 'none',\n toggleIndicatorShadowOn: base.embossShadow,\n toggleIndicatorShadowOff: base.embossShadow,\n toggleFocusShadow: base.focusShadow,\n toggleFocusBorderColor: base.transparent,\n indicatorSize: '14px',\n indicatorMargin: '2px',\n indicatorBorderColor: base.transparent,\n toggleIndicatorBorderStyle: 'none',\n backgroundColor: base.contentColorMuted,\n borderColor: base.transparent,\n selectedBorderColor: base.transparent,\n indicatorBackgroundColor: base.white,\n outlineMargin: '-6px',\n outlineBorderRadius: '15px',\n outlineHoverBackgroundColor: base.interactiveColorOverlayHover,\n outlineFocusBackgroundColor: base.focusColor,\n disabledShadow: 'none',\n disabledBorderColor: base.transparent,\n disabledBackgroundColor: base.interactiveColorBackgroundDisabled,\n disabledIndBackgroundColor: external_tinycolor2_default()(base.white).setAlpha(0.3).toRgbString(),\n disabledIndBorderColor: base.transparent,\n selectedBackgroundColor: base.interactiveColorPrimary,\n selectedDisabledBackgroundColor: external_tinycolor2_default()(base.interactiveColorPrimary).setAlpha(0.7).toRgbString(),\n selectedDisabledIndBackgroundColor: external_tinycolor2_default()(base.white).setAlpha(0.3).toRgbString(),\n errorToggleOutlineBorderColor: base.transparent,\n errorToggleBackgroundColor: base.accentColorNegative,\n indicatorHoverBackgroundColor: base.white,\n top: '1px'\n }\n },\n TabBar: {\n borderColor: base.neutral200,\n Tab: {\n clickableBold: true,\n clickableColor: base.contentColorDefault,\n focusColor: base.contentColorActive,\n focusShadowInset: base.focusShadowInset,\n hoverColor: base.contentColorActive,\n labelWithUnderlineMargin: '16px 0 15px',\n labelMargin: '8px 0',\n fontWeight: base.fontWeightSemiBold,\n selectedColor: base.contentColorActive,\n selectedFontWeight: base.fontWeightSemiBold,\n tabUnderlineSize: '1px',\n underlineBackgroundColor: base.transparent,\n underlineHorizontalBottom: '-1px',\n underlineSelectedBackgroundColor: base.contentColorActive,\n borderRadius: base.borderRadius\n }\n },\n Table: {\n focusShadowInset: base.focusShadowInset,\n Cell: {\n clickableHoverBackgroundColor: base.backgroundColorHover,\n clickableExpandIconColor: base.contentColorActive,\n padding: '12px 8px 11px 8px',\n rowActionsPadding: '6px 8px 5px 0',\n expandPadding: '11px 0 0 0',\n linkColor: base.contentColorDefault,\n linkFocusColor: base.focusColor,\n fontSize: base.fontSize,\n lineHeight: '24px',\n verticalAlign: 'middle',\n disabledTextColor: base.contentColorDisabled\n },\n Head: {\n toggleAllWidth: '36px',\n infoWidth: '36px'\n },\n HeadCell: {\n backgroundColor: base.interactiveColorBackground,\n draggingBackgroundColor: base.interactiveColorOverlayActive,\n focusShadow: base.focusShadowInset,\n borderLeftColor: base.transparent,\n moreInfoHeadCellPadding: '3px 0 0 0',\n focusBackgroundColor: base.interactiveColorOverlayHover,\n toggleAllFocusBorderColor: base.contentColorDefault,\n hoverBackgroundColor: base.interactiveColorOverlayHover,\n guideLineBackgroundColor: base.interactiveColorPrimary\n },\n HeadInner: {\n toggleAllPadding: '6px 0',\n color: base.contentColorDefault,\n fontSize: base.fontSizeSmall,\n lineHeight: '16px',\n hoverColor: base.contentColorDefault,\n helperBackgroundColor: base.accentColorD50,\n sortIconColor: base.contentColorMuted,\n sortIconPosition: 'relative',\n sortedIconColor: base.contentColorDefault,\n menuIconColor: base.contentColorDefault,\n menuIconPadding: '1px 0 0 4px',\n padding: '12px 8px',\n dragContainerTop: '0px',\n dragContainerLeft: '0px',\n menuIconRight: '0',\n dragContainerPadding: '12px 12px',\n dragShadow: base.dragShadow\n },\n HeadTable: {\n dockedShadow: 'none'\n },\n Row: {\n backgroundColor: base.transparent,\n stripeHoverBackgroundColor: base.interactiveColorOverlayHover,\n hoverColor: base.interactiveColorOverlayHover,\n stripeNoneClickableHoverBackgroundColor: base.interactiveColorOverlayHover,\n stripeEvenBackgroundColor: base.transparent,\n clickableHoverColor: base.linkColor,\n borderBottom: \"1px solid \".concat(base.neutral100),\n selectedTextColor: base.contentColorActive,\n disabledBackgroundColor: base.interactiveColorBackgroundDisabled,\n linkHoverColor: base.contentColorActive,\n linkFocusBackgroundColor: base.interactiveColorOverlayHover,\n linkActiveBackgroundColor: base.interactiveColorOverlayActive\n },\n RowDragCell: {\n draggablePadding: '17px 0 16px 0',\n draggingBackgroundColor: base.interactiveColorOverlayActive,\n helperBackgroundColor: base.accentColorD50,\n width: '36px',\n shadow: base.dragShadow,\n guideLineBackgroundColor: base.interactiveColorPrimary\n },\n Toggle: {\n inHeadMargin: '-10px 0',\n margin: '-6px 0'\n }\n },\n Text: {\n clearIconRight: '8px',\n clearIconTop: '6px',\n clearIconPadding: '6px',\n inputBackgroundColor: base.transparent,\n inputColor: base.contentColorActive,\n inputDisabledColor: base.contentColorDisabled,\n inputBorder: \"1px solid \".concat(base.interactiveColorBorder),\n inputHoverBorderColor: base.interactiveColorBorderHover,\n inputErrorBorderColor: base.accentColorNegative,\n inputFocusBorderColor: base.focusColor,\n inputFocusColor: base.contentColorActive,\n inputFocusShadow: 'none',\n inputDisabledBackgroundColor: base.transparent,\n inputDisabledBorderColor: base.interactiveColorBorderDisabled,\n inputErrorColor: base.contentColorActive,\n inputClearOrSearchPaddingRight: '40px',\n placeholderColor: base.contentColorMuted,\n placeholderMediumSize: '16px',\n placeholderWithSearchLeft: '40px',\n spacingHalf: '16px',\n spacingQuarter: '7px',\n searchIconWrapperColor: base.contentColorDefault,\n clearColor: base.contentColorMuted,\n disabledSearchIconColor: base.contentColorDisabled,\n searchIconWrapperRight: '12px',\n searchIconWrapperTop: '10px',\n searchIconPosition: 'left',\n searchIconPaddingLeft: '40px',\n titleAndDescriptionWrapperDisplay: 'flex',\n titleAndDescriptionWrapperFlexDirection: 'column'\n },\n Tooltip: {\n compactFontSize: '12px',\n compactLineHeight: '16px',\n compactPadding: '4px 8px',\n contentFontSize: '14px',\n contentLineHeight: '24px',\n contentPadding: '12px 16px',\n defaultQuestionMark: null,\n iconFocusHoverColor: base.contentColorActive,\n iconFocusHoverBackgroundColor: base.interactiveColorOverlayHover,\n iconColor: base.contentColorMuted,\n openDelayPrimary: 300,\n openDelaySecondary: 750,\n placement: 'below',\n linkColor: base.linkColor\n },\n WaitSpinner: {\n circleStroke: base.contentColorDefault\n }\n }\n };\n});\n// CONCATENATED MODULE: ./src/themes/scp.ts\nfunction scp_ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); keys.push.apply(keys, symbols); } return keys; }\n\nfunction scp_objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { scp_ownKeys(Object(source), true).forEach(function (key) { scp_defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { scp_ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }\n\nfunction scp_defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }\n\n// eslint-disable-next-line @typescript-eslint/ban-ts-comment\n// @ts-nocheck\n\n\nvar additions = {\n radioBarOptionSelectedBackgroundColor: 'rgba(255, 255, 255, 0.2)'\n};\n/* harmony default export */ var scp = (scpBase(scp_objectSpread(scp_objectSpread({}, scp_default.a), additions)));\n// EXTERNAL MODULE: external \"@splunk/themes/scpLight\"\nvar scpLight_ = __webpack_require__(93);\nvar scpLight_default = /*#__PURE__*/__webpack_require__.n(scpLight_);\n\n// CONCATENATED MODULE: ./src/themes/scpLight.ts\nfunction scpLight_ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); keys.push.apply(keys, symbols); } return keys; }\n\nfunction scpLight_objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { scpLight_ownKeys(Object(source), true).forEach(function (key) { scpLight_defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { scpLight_ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }\n\nfunction scpLight_defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }\n\n// eslint-disable-next-line @typescript-eslint/ban-ts-comment\n// @ts-nocheck\n\n\nvar scpLight_additions = {\n radioBarOptionSelectedBackgroundColor: '#ffffff'\n};\n/* harmony default export */ var scpLight = (scpBase(scpLight_objectSpread(scpLight_objectSpread({}, scpLight_default.a), scpLight_additions)));\n// CONCATENATED MODULE: ./src/themes/themes.ts\n// eslint-disable-next-line @typescript-eslint/ban-ts-comment\n// @ts-nocheck\n\n\n\n\n\n/**\n * @file\n * A collection of theme data sets and helpers for this library. Example usage:\n *\n * ```js\n * import { themes as reactUIThemes } from '@splunk/react-ui/themes';\n * ```\n */\n\n/**\n * Theme data for Splunk Enterprise.\n * ```js\n * {\n * 'react-ui': {\n * Calendar: {\n * Day: {\n * buttonColor: '#5c6773',\n * },\n * },\n * [...]\n * },\n * ```\n * @public\n */\n\nvar themes_enterprise = enterprise;\n/**\n * Theme data for Splunk Enterprise Dark. See above for an example.\n * @public\n */\n\nvar themes_enterpriseDark = enterpriseDark;\n/**\n * Theme data for Splunk Lite. See above for an example.\n * @public\n */\n\nvar themes_lite = lite;\n/**\n * Theme data for SCP Dark. See above for an example.\n * @public\n */\n\nvar themes_scp = scp;\n/**\n * Theme data for SCP Light. See above for an example.\n * @public\n */\n\nvar themes_scpLight = scpLight;\n/**\n * An object containing all available theme data sets with theme names as keys.\n * ```js\n * {\n * enterprise: {Enterprise Light theme},\n * enterpriseDark: {Enterprise Dark theme},\n * lite: {Splunk Light theme},\n * scp: {SCP Dark theme},\n * scpLight: {SCP Light theme},\n * }\n * ```\n * @public\n */\n\nvar themes = {\n enterprise: themes_enterprise,\n enterpriseDark: themes_enterpriseDark,\n lite: themes_lite,\n scp: themes_scp,\n scpLight: themes_scpLight\n};\n\nvar getTheme = function getTheme(props) {\n return props.theme && props.theme['react-ui'] ? props.theme['react-ui'] : themes_enterprise['react-ui'];\n};\n\nvar variable = function variable() {\n for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {\n args[_key] = arguments[_key];\n }\n\n return function (props) {\n return args.length === 1 ? getTheme(props).base[args[0]] : args.reduce(function (acc, val) {\n return acc && acc[val] ? acc[val] : null;\n }, getTheme(props));\n };\n};\nvar mixin = function mixin(name) {\n return function () {\n for (var _len2 = arguments.length, args = new Array(_len2), _key2 = 0; _key2 < _len2; _key2++) {\n args[_key2] = arguments[_key2];\n }\n\n return function (props) {\n var _getTheme$base$mixins;\n\n return (_getTheme$base$mixins = getTheme(props).base.mixins)[name].apply(_getTheme$base$mixins, args);\n };\n };\n};\n\n// CONCATENATED MODULE: ./src/themes/index.ts\n\n\n/***/ })\n\n/******/ });\n\n//# sourceURL=webpack:////build/sa-commoninformationmodel/node_modules/@splunk/react-ui/themes.js?"); + +/***/ }), + +/***/ "../../node_modules/@splunk/swc-cim/dist/index.js": +/*!***********************************************************************************!*\ + !*** /build/sa-commoninformationmodel/node_modules/@splunk/swc-cim/dist/index.js ***! + \***********************************************************************************/ +/*! no static exports found */ +/***/ (function(module, exports, __webpack_require__) { + +eval("!function(e,t){ true?module.exports=t():undefined}(window,(function(){return function(e){function t(t){for(var n,r,o=t[0],a=t[1],s=0,c=[];s1?i-1:0),o=1;o0?\" Additional arguments: \"+r.join(\", \"):\"\")));return x(a)}return y(t,e),t}(Error),P=/^[^\\S\\n]*?\\/\\* sc-component-id:\\s*(\\S+)\\s+\\*\\//gm,I=function(e){var t=\"\"+(e||\"\"),n=[];return t.replace(P,(function(e,t,i){return n.push({componentId:t,matchIndex:i}),e})),n.map((function(e,i){var r=e.componentId,o=e.matchIndex,a=n[i+1];return{componentId:r,cssFromDOM:a?t.slice(o,a.matchIndex):t.slice(o)}}))},N=/^\\s*\\/\\/.*$/gm,D=new r.a({global:!1,cascade:!0,keyframe:!1,prefix:!1,compress:!1,semicolon:!0}),R=new r.a({global:!1,cascade:!0,keyframe:!1,prefix:!0,compress:!1,semicolon:!1}),z=[],j=function(e){if(-2===e){var t=z;return z=[],t}},B=a()((function(e){z.push(e)})),H=void 0,F=void 0,W=void 0,V=function(e,t,n){return t>0&&-1!==n.slice(0,t).indexOf(F)&&n.slice(t-F.length,t)!==F?\".\"+H:e};R.use([function(e,t,n){2===e&&n.length&&n[0].lastIndexOf(F)>0&&(n[0]=n[0].replace(W,V))},B,j]),D.use([B,j]);var q=function(e){return D(\"\",e)};function U(e,t,n){var i=arguments.length>3&&void 0!==arguments[3]?arguments[3]:\"&\",r=e.join(\"\").replace(N,\"\"),o=t&&n?n+\" \"+t+\" { \"+r+\" }\":r;return H=i,F=t,W=new RegExp(\"\\\\\"+F+\"\\\\b\",\"g\"),R(n||!t?\"\":t,o)}var G=function(){return n.nc},X=function(e,t,n){n&&((e[t]||(e[t]=Object.create(null)))[n]=!0)},Y=function(e,t){e[t]=Object.create(null)},$=function(e){return function(t,n){return void 0!==e[t]&&e[t][n]}},K=function(e){var t=\"\";for(var n in e)t+=Object.keys(e[n]).join(\" \")+\" \";return t.trim()},Z=function(e){if(e.sheet)return e.sheet;for(var t=document.styleSheets.length,n=0;n\"+e()+\"\"}},ne=function(e,t){return function(){var n,i=((n={})[_]=K(t),n[\"data-styled-version\"]=\"4.3.2\",n),r=G();return r&&(i.nonce=r),l.a.createElement(\"style\",v({},i,{dangerouslySetInnerHTML:{__html:e()}}))}},ie=function(e){return function(){return Object.keys(e)}},re=function(e){return document.createTextNode(J(e))},oe=function e(t,n){var i=void 0===t?Object.create(null):t,r=void 0===n?Object.create(null):n,o=function(e){var t=r[e];return void 0!==t?t:r[e]=[\"\"]},a=function(){var e=\"\";for(var t in r){var n=r[t][0];n&&(e+=J(t)+n)}return e};return{clone:function(){var t=function(e){var t=Object.create(null);for(var n in e)t[n]=v({},e[n]);return t}(i),n=Object.create(null);for(var o in r)n[o]=[r[o][0]];return e(t,n)},css:a,getIds:ie(r),hasNameForId:$(i),insertMarker:o,insertRules:function(e,t,n){o(e)[0]+=t.join(\" \"),X(i,e,n)},removeRules:function(e){var t=r[e];void 0!==t&&(t[0]=\"\",Y(i,e))},sealed:!1,styleTag:null,toElement:ne(a,i),toHTML:te(a,i)}},ae=function(e,t,n,i,r){if(T&&!n){var o=function(e,t,n){var i=document.createElement(\"style\");i.setAttribute(_,\"\"),i.setAttribute(\"data-styled-version\",\"4.3.2\");var r=G();if(r&&i.setAttribute(\"nonce\",r),i.appendChild(document.createTextNode(\"\")),e&&!t)e.appendChild(i);else{if(!t||!e||!t.parentNode)throw new E(6);t.parentNode.insertBefore(i,n?t:t.nextSibling)}return i}(e,t,i);return O?function(e,t){var n=Object.create(null),i=Object.create(null),r=void 0!==t,o=!1,a=function(t){var r=i[t];return void 0!==r?r:(i[t]=re(t),e.appendChild(i[t]),n[t]=Object.create(null),i[t])},s=function(){var e=\"\";for(var t in i)e+=i[t].data;return e};return{clone:function(){throw new E(5)},css:s,getIds:ie(i),hasNameForId:$(n),insertMarker:a,insertRules:function(e,i,s){for(var l=a(e),c=[],h=i.length,u=0;u0&&(o=!0,t().insertRules(e+\"-import\",c))},removeRules:function(a){var s=i[a];if(void 0!==s){var l=re(a);e.replaceChild(l,s),i[a]=l,Y(n,a),r&&o&&t().removeRules(a+\"-import\")}},sealed:!1,styleTag:e,toElement:ne(s,n),toHTML:te(s,n)}}(o,r):function(e,t){var n=Object.create(null),i=Object.create(null),r=[],o=void 0!==t,a=!1,s=function(e){var t=i[e];return void 0!==t?t:(i[e]=r.length,r.push(0),Y(n,e),i[e])},l=function(){var t=Z(e).cssRules,n=\"\";for(var o in i){n+=J(o);for(var a=i[o],s=ee(r,a),l=s-r[a];l0&&(a=!0,t().insertRules(i+\"-import\",f)),r[h]+=p,X(n,i,c)},removeRules:function(s){var l=i[s];if(void 0!==l){var c=r[l];!function(e,t,n){for(var i=t-n,r=t;r>i;r-=1)e.deleteRule(r)}(Z(e),ee(r,l)-1,c),r[l]=0,Y(n,s),o&&a&&t().removeRules(s+\"-import\")}},sealed:!1,styleTag:e,toElement:ne(l,n),toHTML:te(l,n)}}(o,r)}return oe()},se=/\\s+/,le=void 0;le=T?O?40:1e3:-1;var ce=0,he=void 0,ue=function(){function e(){var t=this,n=arguments.length>0&&void 0!==arguments[0]?arguments[0]:T?document.head:null,i=arguments.length>1&&void 0!==arguments[1]&&arguments[1];m(this,e),this.getImportRuleTag=function(){var e=t.importRuleTag;if(void 0!==e)return e;var n=t.tags[0];return t.importRuleTag=ae(t.target,n?n.styleTag:null,t.forceServer,!0)},ce+=1,this.id=ce,this.forceServer=i,this.target=i?null:n,this.tagMap={},this.deferred={},this.rehydratedNames={},this.ignoreRehydratedNames={},this.tags=[],this.capacity=1,this.clones=[]}return e.prototype.rehydrate=function(){if(!T||this.forceServer)return this;var e=[],t=[],n=!1,i=document.querySelectorAll(\"style[\"+_+'][data-styled-version=\"4.3.2\"]'),r=i.length;if(!r)return this;for(var o=0;o0&&void 0!==arguments[0]&&arguments[0];he=new e(void 0,t).rehydrate()},e.prototype.clone=function(){var t=new e(this.target,this.forceServer);return this.clones.push(t),t.tags=this.tags.map((function(e){for(var n=e.getIds(),i=e.clone(),r=0;r1?t-1:0),i=1;i=4;)t=1540483477*(65535&(t=255&e.charCodeAt(r)|(255&e.charCodeAt(++r))<<8|(255&e.charCodeAt(++r))<<16|(255&e.charCodeAt(++r))<<24))+((1540483477*(t>>>16)&65535)<<16),i=1540483477*(65535&i)+((1540483477*(i>>>16)&65535)<<16)^(t=1540483477*(65535&(t^=t>>>24))+((1540483477*(t>>>16)&65535)<<16)),n-=4,++r;switch(n){case 3:i^=(255&e.charCodeAt(r+2))<<16;case 2:i^=(255&e.charCodeAt(r+1))<<8;case 1:i=1540483477*(65535&(i^=255&e.charCodeAt(r)))+((1540483477*(i>>>16)&65535)<<16)}return((i=1540483477*(65535&(i^=i>>>13))+((1540483477*(i>>>16)&65535)<<16))^i>>>15)>>>0}var we=function(e){return String.fromCharCode(e+(e>25?39:97))};function ke(e){var t=\"\",n=void 0;for(n=e;n>52;n=Math.floor(n/52))t=we(n%52)+t;return we(n%52)+t}function Me(e,t){for(var n=0;n2&&void 0!==arguments[2]?arguments[2]:M,i=!!n&&e.theme===n.theme,r=e.theme&&!i?e.theme:t||n.theme;return r},Te=/[[\\].#*$><+~=|^:(),\"'`-]+/g,Oe=/(^-|-$)/g;function Le(e){return e.replace(Te,\"-\").replace(Oe,\"\")}function Ee(e){return\"string\"==typeof e&&!0}var Pe={childContextTypes:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDerivedStateFromProps:!0,propTypes:!0,type:!0},Ie={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},Ne=((Se={})[h.ForwardRef]={$$typeof:!0,render:!0},Se),De=Object.defineProperty,Re=Object.getOwnPropertyNames,ze=Object.getOwnPropertySymbols,je=void 0===ze?function(){return[]}:ze,Be=Object.getOwnPropertyDescriptor,He=Object.getPrototypeOf,Fe=Object.prototype,We=Array.prototype;function Ve(e,t,n){if(\"string\"!=typeof t){var i=He(t);i&&i!==Fe&&Ve(e,i,n);for(var r=We.concat(Re(t),je(t)),o=Ne[e.$$typeof]||Pe,a=Ne[t.$$typeof]||Pe,s=r.length,l=void 0,c=void 0;s--;)if(c=r[s],!(Ie[c]||n&&n[c]||a&&a[c]||o&&o[c])&&(l=Be(t,c)))try{De(e,c,l)}catch(e){}return e}return e}var qe=Object(s.createContext)(),Ue=qe.Consumer,Ge=function(e){function t(n){m(this,t);var i=x(this,e.call(this,n));return i.getContext=Object(u.a)(i.getContext.bind(i)),i.renderInner=i.renderInner.bind(i),i}return y(t,e),t.prototype.render=function(){return this.props.children?l.a.createElement(qe.Consumer,null,this.renderInner):null},t.prototype.renderInner=function(e){var t=this.getContext(this.props.theme,e);return l.a.createElement(qe.Provider,{value:t},l.a.Children.only(this.props.children))},t.prototype.getTheme=function(e,t){if(S(e))return e(t);if(null===e||Array.isArray(e)||\"object\"!==(void 0===e?\"undefined\":g(e)))throw new E(8);return v({},t,e)},t.prototype.getContext=function(e,t){return this.getTheme(e,t)},t}(s.Component),Xe=function(){function e(){m(this,e),this.masterSheet=ue.master,this.instance=this.masterSheet.clone(),this.sealed=!1}return e.prototype.seal=function(){if(!this.sealed){var e=this.masterSheet.clones.indexOf(this.instance);this.masterSheet.clones.splice(e,1),this.sealed=!0}},e.prototype.collectStyles=function(e){if(this.sealed)throw new E(2);return l.a.createElement(Ke,{sheet:this.instance},e)},e.prototype.getStyleTags=function(){return this.seal(),this.instance.toHTML()},e.prototype.getStyleElement=function(){return this.seal(),this.instance.toReactElements()},e.prototype.interleaveWithNodeStream=function(e){throw new E(3)},e}(),Ye=Object(s.createContext)(),$e=Ye.Consumer,Ke=function(e){function t(n){m(this,t);var i=x(this,e.call(this,n));return i.getContext=Object(u.a)(i.getContext),i}return y(t,e),t.prototype.getContext=function(e,t){if(e)return e;if(t)return new ue(t);throw new E(4)},t.prototype.render=function(){var e=this.props,t=e.children,n=e.sheet,i=e.target;return l.a.createElement(Ye.Provider,{value:this.getContext(n,i)},t)},t}(s.Component),Ze={};var Qe=function(e){function t(){m(this,t);var n=x(this,e.call(this));return n.attrs={},n.renderOuter=n.renderOuter.bind(n),n.renderInner=n.renderInner.bind(n),n}return y(t,e),t.prototype.render=function(){return l.a.createElement($e,null,this.renderOuter)},t.prototype.renderOuter=function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:ue.master;return this.styleSheet=e,this.props.forwardedComponent.componentStyle.isStatic?this.renderInner():l.a.createElement(Ue,null,this.renderInner)},t.prototype.renderInner=function(e){var t=this.props.forwardedComponent,n=t.componentStyle,i=t.defaultProps,r=(t.displayName,t.foldedComponentIds),o=t.styledComponentId,a=t.target,l=void 0;l=n.isStatic?this.generateAndInjectStyles(M,this.props):this.generateAndInjectStyles(_e(this.props,e,i)||M,this.props);var c=this.props.as||this.attrs.as||a,h=Ee(c),u={},p=v({},this.attrs,this.props),f=void 0;for(f in p)\"forwardedComponent\"!==f&&\"as\"!==f&&(\"forwardedRef\"===f?u.ref=p[f]:\"forwardedAs\"===f?u.as=p[f]:h&&!Object(d.a)(f)||(u[f]=p[f]));return this.props.style&&this.attrs.style&&(u.style=v({},this.attrs.style,this.props.style)),u.className=Array.prototype.concat(r,this.props.className,o,this.attrs.className,l).filter(Boolean).join(\" \"),Object(s.createElement)(c,u)},t.prototype.buildExecutionContext=function(e,t,n){var i=this,r=v({},t,{theme:e});return n.length?(this.attrs={},n.forEach((function(e){var t,n=e,o=!1,a=void 0,s=void 0;for(s in S(n)&&(n=n(r),o=!0),n)a=n[s],o||!S(a)||(t=a)&&t.prototype&&t.prototype.isReactComponent||C(a)||(a=a(r)),i.attrs[s]=a,r[s]=a})),r):r},t.prototype.generateAndInjectStyles=function(e,t){var n=t.forwardedComponent,i=n.attrs,r=n.componentStyle;n.warnTooManyClasses;return r.isStatic&&!i.length?r.generateAndInjectStyles(M,this.styleSheet):r.generateAndInjectStyles(this.buildExecutionContext(e,t,i),this.styleSheet)},t}(s.Component);function Je(e,t,n){var i=C(e),r=!Ee(e),o=t.displayName,a=void 0===o?function(e){return Ee(e)?\"styled.\"+e:\"Styled(\"+A(e)+\")\"}(e):o,s=t.componentId,c=void 0===s?function(e,t,n){var i=\"string\"!=typeof t?\"sc\":Le(t),r=(Ze[i]||0)+1;Ze[i]=r;var o=i+\"-\"+e.generateName(i+r);return n?n+\"-\"+o:o}(Ce,t.displayName,t.parentComponentId):s,h=t.ParentComponent,u=void 0===h?Qe:h,d=t.attrs,f=void 0===d?k:d,g=t.displayName&&t.componentId?Le(t.displayName)+\"-\"+t.componentId:t.componentId||c,m=i&&e.attrs?Array.prototype.concat(e.attrs,f).filter(Boolean):f,b=new Ce(i?e.componentStyle.rules.concat(n):n,m,g),y=void 0,x=function(e,t){return l.a.createElement(u,v({},e,{forwardedComponent:y,forwardedRef:t}))};return x.displayName=a,(y=l.a.forwardRef(x)).displayName=a,y.attrs=m,y.componentStyle=b,y.foldedComponentIds=i?Array.prototype.concat(e.foldedComponentIds,e.styledComponentId):k,y.styledComponentId=g,y.target=i?e.target:e,y.withComponent=function(e){var i=t.componentId,r=function(e,t){var n={};for(var i in e)t.indexOf(i)>=0||Object.prototype.hasOwnProperty.call(e,i)&&(n[i]=e[i]);return n}(t,[\"componentId\"]),o=i&&i+\"-\"+(Ee(e)?e:Le(A(e)));return Je(e,v({},r,{attrs:m,componentId:o,ParentComponent:u}),n)},Object.defineProperty(y,\"defaultProps\",{get:function(){return this._foldedDefaultProps},set:function(t){this._foldedDefaultProps=i?Object(p.a)(e.defaultProps,t):t}}),y.toString=function(){return\".\"+y.styledComponentId},r&&Ve(y,e,{attrs:!0,componentStyle:!0,displayName:!0,foldedComponentIds:!0,styledComponentId:!0,target:!0,withComponent:!0}),y}var et=function(e){return function e(t,n){var i=arguments.length>2&&void 0!==arguments[2]?arguments[2]:M;if(!Object(h.isValidElementType)(n))throw new E(1,String(n));var r=function(){return t(n,i,ye.apply(void 0,arguments))};return r.withConfig=function(r){return e(t,n,v({},i,r))},r.attrs=function(r){return e(t,n,v({},i,{attrs:Array.prototype.concat(i.attrs,r).filter(Boolean)}))},r}(Je,e)};[\"a\",\"abbr\",\"address\",\"area\",\"article\",\"aside\",\"audio\",\"b\",\"base\",\"bdi\",\"bdo\",\"big\",\"blockquote\",\"body\",\"br\",\"button\",\"canvas\",\"caption\",\"cite\",\"code\",\"col\",\"colgroup\",\"data\",\"datalist\",\"dd\",\"del\",\"details\",\"dfn\",\"dialog\",\"div\",\"dl\",\"dt\",\"em\",\"embed\",\"fieldset\",\"figcaption\",\"figure\",\"footer\",\"form\",\"h1\",\"h2\",\"h3\",\"h4\",\"h5\",\"h6\",\"head\",\"header\",\"hgroup\",\"hr\",\"html\",\"i\",\"iframe\",\"img\",\"input\",\"ins\",\"kbd\",\"keygen\",\"label\",\"legend\",\"li\",\"link\",\"main\",\"map\",\"mark\",\"marquee\",\"menu\",\"menuitem\",\"meta\",\"meter\",\"nav\",\"noscript\",\"object\",\"ol\",\"optgroup\",\"option\",\"output\",\"p\",\"param\",\"picture\",\"pre\",\"progress\",\"q\",\"rp\",\"rt\",\"ruby\",\"s\",\"samp\",\"script\",\"section\",\"select\",\"small\",\"source\",\"span\",\"strong\",\"style\",\"sub\",\"summary\",\"sup\",\"table\",\"tbody\",\"td\",\"textarea\",\"tfoot\",\"th\",\"thead\",\"time\",\"title\",\"tr\",\"track\",\"u\",\"ul\",\"var\",\"video\",\"wbr\",\"circle\",\"clipPath\",\"defs\",\"ellipse\",\"foreignObject\",\"g\",\"image\",\"line\",\"linearGradient\",\"marker\",\"mask\",\"path\",\"pattern\",\"polygon\",\"polyline\",\"radialGradient\",\"rect\",\"stop\",\"svg\",\"text\",\"tspan\"].forEach((function(e){et[e]=et(e)}));var tt=function(){function e(t,n){m(this,e),this.rules=t,this.componentId=n,this.isStatic=Me(t,k),ue.master.hasId(n)||ue.master.deferredInject(n,[])}return e.prototype.createStyles=function(e,t){var n=U(ve(this.rules,e,t),\"\");t.inject(this.componentId,n)},e.prototype.removeStyles=function(e){var t=this.componentId;e.hasId(t)&&e.remove(t)},e.prototype.renderStyles=function(e,t){this.removeStyles(t),this.createStyles(e,t)},e}();function nt(e){for(var t=arguments.length,n=Array(t>1?t-1:0),i=1;i1?t-1:0),i=1;i=0||(r[n]=e[n]);return r}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(r[n]=e[n])}return r}var d={children:a.a.node,elementRef:a.a.func,flex:a.a.bool,inline:a.a.bool};function p(e){var t=e.children,n=e.elementRef,i=e.flex,o=e.inline,a=u(e,[\"children\",\"elementRef\",\"flex\",\"inline\"]);return r.a.createElement(c,h({},Object(s.ref)(n),a,{\"data-inline\":o||void 0,\"data-flex\":i||void 0}),t)}p.propTypes=d,p.defaultProps={flex:!1,inline:!1};var f=p;n.d(t,\"default\",(function(){return f}))},2:function(e,t){e.exports=n(1)},3:function(e,t){e.exports=n(10)}})},101:function(e,t,n){\"use strict\";function i(e){return e&&\"object\"==typeof e&&\"default\"in e?e.default:e}Object.defineProperty(t,\"__esModule\",{value:!0});var r=i(n(604)),o=i(n(605)),a=i(n(606)),s=i(n(608)),l=i(n(609)),c=i(n(246)),h=i(n(611)),u=i(n(613)),d=i(n(1));i(n(6)),i(n(614));var p,f=(p=null,function(){if(null!==p)return p;var e,t,n,i=!1;try{window.addEventListener(\"test\",null,(e={},t=\"passive\",n={get:function(){i=!0}},Object.defineProperty(e,t,n)))}catch(e){}return p=i,i}()),g={capture:!1,passive:!1};function m(e){return u({},g,e)}function b(e,t,n){var i=[e,t];return i.push(f?n:n.capture),i}function v(e,t,n,i){e.addEventListener.apply(e,b(t,n,i))}function y(e,t,n,i){e.removeEventListener.apply(e,b(t,n,i))}function x(e,t){e.children,e.target;var n=h(e,[\"children\",\"target\"]);Object.keys(n).forEach((function(e){if(\"on\"===e.substring(0,2)){var i=n[e],r=c(i),o=\"object\"===r;if(o||\"function\"===r){var a=\"capture\"===e.substr(-7).toLowerCase(),s=e.substring(2).toLowerCase();s=a?s.substring(0,s.length-7):s,o?t(s,i.handler,i.options):t(s,i,m({capture:a}))}}}))}var w=function(e){function t(){return r(this,t),a(this,s(t).apply(this,arguments))}return l(t,e),o(t,[{key:\"componentDidMount\",value:function(){this.applyListeners(v)}},{key:\"componentDidUpdate\",value:function(e){this.applyListeners(y,e),this.applyListeners(v)}},{key:\"componentWillUnmount\",value:function(){this.applyListeners(y)}},{key:\"applyListeners\",value:function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:this.props,n=t.target;if(n){var i=n;\"string\"==typeof n&&(i=window[n]),x(t,e.bind(null,i))}}},{key:\"render\",value:function(){return this.props.children||null}}]),t}(d.PureComponent);w.propTypes={},t.withOptions=function(e,t){return{handler:e,options:m(t)}},t.default=w},102:function(e,t,n){\"use strict\";t.__esModule=!0,t.default=function(e){var t={};for(var n in e)Object.prototype.hasOwnProperty.call(e,n)&&(t[n]=\"number\"==typeof e[n]?e[n]:e[n].val);return t},e.exports=t.default},103:function(e,t,n){(function(t){(function(){var n,i,r;\"undefined\"!=typeof performance&&null!==performance&&performance.now?e.exports=function(){return performance.now()}:null!=t&&t.hrtime?(e.exports=function(){return(n()-r)/1e6},i=t.hrtime,r=(n=function(){var e;return 1e9*(e=i())[0]+e[1]})()):Date.now?(e.exports=function(){return Date.now()-r},r=Date.now()):(e.exports=function(){return(new Date).getTime()-r},r=(new Date).getTime())}).call(this)}).call(this,n(42))},104:function(e,t,n){(function(t){e.exports=l;var i=n(68).Buffer;l.WritableState=s;var r=n(70);r.inherits=n(41);var o=n(69);function a(e,t,n){this.chunk=e,this.encoding=t,this.callback=n}function s(e,i){var r=n(43),o=(e=e||{}).highWaterMark,a=e.objectMode?16:16384;this.highWaterMark=o||0===o?o:a,this.objectMode=!!e.objectMode,i instanceof r&&(this.objectMode=this.objectMode||!!e.writableObjectMode),this.highWaterMark=~~this.highWaterMark,this.needDrain=!1,this.ending=!1,this.ended=!1,this.finished=!1;var s=!1===e.decodeStrings;this.decodeStrings=!s,this.defaultEncoding=e.defaultEncoding||\"utf8\",this.length=0,this.writing=!1,this.corked=0,this.sync=!0,this.bufferProcessing=!1,this.onwrite=function(e){!function(e,n){var i=e._writableState,r=i.sync,o=i.writecb;if(function(e){e.writing=!1,e.writecb=null,e.length-=e.writelen,e.writelen=0}(i),n)!function(e,n,i,r,o){i?t.nextTick((function(){n.pendingcb--,o(r)})):(n.pendingcb--,o(r));e._writableState.errorEmitted=!0,e.emit(\"error\",r)}(e,i,r,n,o);else{var a=d(e,i);a||i.corked||i.bufferProcessing||!i.buffer.length||u(e,i),r?t.nextTick((function(){h(e,i,a,o)})):h(e,i,a,o)}}(i,e)},this.writecb=null,this.writelen=0,this.buffer=[],this.pendingcb=0,this.prefinished=!1,this.errorEmitted=!1}function l(e){var t=n(43);if(!(this instanceof l||this instanceof t))return new l(e);this._writableState=new s(e,this),this.writable=!0,o.call(this)}function c(e,t,n,i,r,o,a){t.writelen=i,t.writecb=a,t.writing=!0,t.sync=!0,n?e._writev(r,t.onwrite):e._write(r,o,t.onwrite),t.sync=!1}function h(e,t,n,i){n||function(e,t){0===t.length&&t.needDrain&&(t.needDrain=!1,e.emit(\"drain\"))}(e,t),t.pendingcb--,i(),f(e,t)}function u(e,t){if(t.bufferProcessing=!0,e._writev&&t.buffer.length>1){for(var n=[],i=0;i>5==6?2:e>>4==14?3:e>>3==30?4:e>>6==2?-1:-2}function s(e){var t=this.lastTotal-this.lastNeed,n=function(e,t,n){if(128!=(192&t[0]))return e.lastNeed=0,\"�\";if(e.lastNeed>1&&t.length>1){if(128!=(192&t[1]))return e.lastNeed=1,\"�\";if(e.lastNeed>2&&t.length>2&&128!=(192&t[2]))return e.lastNeed=2,\"�\"}}(this,e);return void 0!==n?n:this.lastNeed<=e.length?(e.copy(this.lastChar,t,0,this.lastNeed),this.lastChar.toString(this.encoding,0,this.lastTotal)):(e.copy(this.lastChar,t,0,e.length),void(this.lastNeed-=e.length))}function l(e,t){if((e.length-t)%2==0){var n=e.toString(\"utf16le\",t);if(n){var i=n.charCodeAt(n.length-1);if(i>=55296&&i<=56319)return this.lastNeed=2,this.lastTotal=4,this.lastChar[0]=e[e.length-2],this.lastChar[1]=e[e.length-1],n.slice(0,-1)}return n}return this.lastNeed=1,this.lastTotal=2,this.lastChar[0]=e[e.length-1],e.toString(\"utf16le\",t,e.length-1)}function c(e){var t=e&&e.length?this.write(e):\"\";if(this.lastNeed){var n=this.lastTotal-this.lastNeed;return t+this.lastChar.toString(\"utf16le\",0,n)}return t}function h(e,t){var n=(e.length-t)%3;return 0===n?e.toString(\"base64\",t):(this.lastNeed=3-n,this.lastTotal=3,1===n?this.lastChar[0]=e[e.length-1]:(this.lastChar[0]=e[e.length-2],this.lastChar[1]=e[e.length-1]),e.toString(\"base64\",t,e.length-n))}function u(e){var t=e&&e.length?this.write(e):\"\";return this.lastNeed?t+this.lastChar.toString(\"base64\",0,3-this.lastNeed):t}function d(e){return e.toString(this.encoding)}function p(e){return e&&e.length?this.write(e):\"\"}t.StringDecoder=o,o.prototype.write=function(e){if(0===e.length)return\"\";var t,n;if(this.lastNeed){if(void 0===(t=this.fillLast(e)))return\"\";n=this.lastNeed,this.lastNeed=0}else n=0;return n=0)return r>0&&(e.lastNeed=r-1),r;if(--i=0)return r>0&&(e.lastNeed=r-2),r;if(--i=0)return r>0&&(2===r?r=0:e.lastNeed=r-3),r;return 0}(this,e,t);if(!this.lastNeed)return e.toString(\"utf8\",t);this.lastTotal=n;var i=e.length-(n-this.lastNeed);return e.copy(this.lastChar,0,i),e.toString(\"utf8\",t,i)},o.prototype.fillLast=function(e){if(this.lastNeed<=e.length)return e.copy(this.lastChar,this.lastTotal-this.lastNeed,0,this.lastNeed),this.lastChar.toString(this.encoding,0,this.lastTotal);e.copy(this.lastChar,this.lastTotal-this.lastNeed,0,e.length),this.lastNeed-=e.length}},106:function(e,t,n){e.exports=a;var i=n(43),r=n(70);function o(e,t){this.afterTransform=function(e,n){return function(e,t,n){var i=e._transformState;i.transforming=!1;var o=i.writecb;if(!o)return e.emit(\"error\",new Error(\"no writecb in Transform class\"));i.writechunk=null,i.writecb=null,r.isNullOrUndefined(n)||e.push(n);o&&o(t);var a=e._readableState;a.reading=!1,(a.needReadable||a.lengthh;)if((s=l[h++])!=s)return!0}else for(;c>h;h++)if((e||h in l)&&l[h]===n)return e||h||0;return!e&&-1}}},11:function(e,t,n){var i=n(7),r=n(173),o=n(37),a=Object.defineProperty;t.f=n(13)?Object.defineProperty:function(e,t,n){if(i(e),t=o(t,!0),i(n),r)try{return a(e,t,n)}catch(e){}if(\"get\"in n||\"set\"in n)throw TypeError(\"Accessors not supported!\");return\"value\"in n&&(e[t]=n.value),e}},110:function(e,t,n){var i=n(108)(\"keys\"),r=n(46);e.exports=function(e){return i[e]||(i[e]=r(e))}},111:function(e,t){e.exports=\"constructor,hasOwnProperty,isPrototypeOf,propertyIsEnumerable,toLocaleString,toString,valueOf\".split(\",\")},112:function(e,t,n){var i=n(32);e.exports=Array.isArray||function(e){return\"Array\"==i(e)}},113:function(e,t,n){var i=n(8).document;e.exports=i&&i.documentElement},114:function(e,t,n){var i=n(5),r=n(7),o=function(e,t){if(r(e),!i(t)&&null!==t)throw TypeError(t+\": can't set as prototype!\")};e.exports={set:Object.setPrototypeOf||(\"__proto__\"in{}?function(e,t,i){try{(i=n(30)(Function.call,n(34).f(Object.prototype,\"__proto__\").set,2))(e,[]),t=!(e instanceof Array)}catch(e){t=!0}return function(e,n){return o(e,n),t?e.__proto__=n:i(e,n),e}}({},!1):void 0),check:o}},115:function(e,t){e.exports=\"\\t\\n\\v\\f\\r   ᠎             　\\u2028\\u2029\\ufeff\"},116:function(e,t,n){var i=n(5),r=n(114).set;e.exports=function(e,t,n){var o,a=t.constructor;return a!==n&&\"function\"==typeof a&&(o=a.prototype)!==n.prototype&&i(o)&&r&&r(e,o),e}},117:function(e,t){e.exports=Math.sign||function(e){return 0==(e=+e)||e!=e?e:e<0?-1:1}},118:function(e,t){var n=Math.expm1;e.exports=!n||n(10)>22025.465794806718||n(10)<22025.465794806718||-2e-17!=n(-2e-17)?function(e){return 0==(e=+e)?e:e>-1e-6&&e<1e-6?e+e*e/2:Math.exp(e)-1}:n},119:function(e,t,n){\"use strict\";var i=n(57),r=n(0),o=n(21),a=n(25),s=n(19),l=n(73),c=n(188),h=n(56),u=n(50),d=n(9)(\"iterator\"),p=!([].keys&&\"next\"in[].keys()),f=function(){return this};e.exports=function(e,t,n,g,m,b,v){c(n,t,g);var y,x,w,k=function(e){if(!p&&e in C)return C[e];switch(e){case\"keys\":case\"values\":return function(){return new n(this,e)}}return function(){return new n(this,e)}},M=t+\" Iterator\",S=\"values\"==m,A=!1,C=e.prototype,_=C[d]||C[\"@@iterator\"]||m&&C[m],T=_||k(m),O=m?S?k(\"entries\"):T:void 0,L=\"Array\"==t&&C.entries||_;if(L&&(w=u(L.call(new e)))!==Object.prototype&&w.next&&(h(w,M,!0),i||s(w,d)||a(w,d,f)),S&&_&&\"values\"!==_.name&&(A=!0,T=function(){return _.call(this)}),i&&!v||!p&&!A&&C[d]||a(C,d,T),l[t]=T,l[M]=f,m)if(y={values:S?T:k(\"values\"),keys:b?T:k(\"keys\"),entries:O},v)for(x in y)x in C||o(C,x,y[x]);else r(r.P+r.F*(p||A),t,y);return y}},12:function(e,t,n){\n/*!\n * Copyright © 2018 Splunk Inc.\n * SPLUNK CONFIDENTIAL – Use or disclosure of this material in whole or in part\n * without a valid written license from Splunk Inc. is PROHIBITED.\n */\ne.exports=function(e){var t={};function n(i){if(t[i])return t[i].exports;var r=t[i]={i:i,l:!1,exports:{}};return e[i].call(r.exports,r,r.exports,n),r.l=!0,r.exports}return n.m=e,n.c=t,n.d=function(e,t,i){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:i})},n.r=function(e){\"undefined\"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:\"Module\"}),Object.defineProperty(e,\"__esModule\",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&\"object\"==typeof e&&e&&e.__esModule)return e;var i=Object.create(null);if(n.r(i),Object.defineProperty(i,\"default\",{enumerable:!0,value:e}),2&t&&\"string\"!=typeof e)for(var r in e)n.d(i,r,function(t){return e[t]}.bind(null,r));return i},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,\"a\",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p=\"\",n(n.s=93)}({12:function(e,t){e.exports=n(91)},3:function(e,t){e.exports=n(10)},48:function(e,t){e.exports=n(466)},5:function(e,t){e.exports=n(532)},6:function(e,t){e.exports=n(223)},84:function(e,t){e.exports=n(138)},85:function(e,t){e.exports=n(225)},93:function(e,t,n){\"use strict\";n.r(t);var i=n(3),r=n.n(i),o=n(84),a=n.n(o),s=n(12),l=n.n(s),c=function(e){return{\"react-ui\":{base:e,Button:{iconPaddingRight:\"3px\",iconOnlyPadding:e.spacingQuarter,paddingSmall:e.spacingQuarter,paddingLarge:e.fontSize},ButtonSimple:{Primary:{shadow:\"inset 0 -2px 0 \".concat(l()(\"black\").setAlpha(.1).toRgbString()),selectedShadow:\"inset 0 2px 0 \".concat(l()(\"black\").setAlpha(.1).toRgbString()),focusShadow:\"inset 0 -2px 0 \".concat(l()(\"black\").setAlpha(.1).toRgbString(),\", \").concat(e.focusShadow),selectedFocusShadow:\"inset 0 2px 0 \".concat(l()(\"black\").setAlpha(.1).toRgbString(),\", \").concat(e.focusShadow),color:e.white,backgroundColor:e.brandColor,hoverBackgroundColor:e.brandColorD20,activeBackgroundColor:e.brandColorD30,selectedBackgroundColor:e.brandColorD20,disabledBackgroundColor:e.brandColorL10,disabledTextColor:e.brandColorL30,disabledSelectedBackgroundColor:e.brandColorD20,disabledSelectedBorderColor:e.borderColor,prependBorderLeftColor:e.brandColorD20},Error:{shadow:\"inset 0 -2px 0 \".concat(l()(\"black\").setAlpha(.1).toRgbString()),selectedShadow:\"inset 0 2px 0 \".concat(l()(\"black\").setAlpha(.1).toRgbString()),focusShadow:\"inset 0 -2px 0 \".concat(l()(\"black\").setAlpha(.1).toRgbString(),\", \").concat(e.focusShadow),selectedFocusShadow:\"inset 0 2px 0 \".concat(l()(\"black\").setAlpha(.1).toRgbString(),\", \").concat(e.focusShadow),color:e.white,backgroundColor:e.errorColor,activeBackgroundColor:e.errorColorD30,hoverBackgroundColor:e.errorColorD20,selectedBackgroundColor:e.errorColorD20,disabledBackgroundColor:e.errorColorL10,disabledTextColor:e.errorColorL30,disabledSelectedBackgroundColor:e.errorColorD20,disabledSelectedBorderColor:e.borderColor,prependBorderLeftColor:e.errorColorD20},Default:{shadow:\"inset 0 -1px 0 rgba(0,0,0,0.1)\",hoverShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1)\",activeShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1)\",selectedShadow:\"inset 0 1px 0 rgba(0,0,0,0.1)\",focusShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow),focusHoverShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow),focusActiveShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow),focusSelectedShadow:\"inset 0 1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow),focusAppendShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1), inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow,\", inset -1px 0 0 \").concat(e.borderColor),focusAppendSelectedShadow:\"inset 0 1px 0 rgba(0,0,0,0.1), inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow,\", inset -1px 0 0 \").concat(e.borderColor),color:e.gray45,border:e.border,backgroundColor:e.gray98,selectedBackgroundColor:e.gray92,hoverBackgroundColor:l()(e.gray96).darken(2.5).toHexString(),activeBackgroundColor:e.gray92,disabledBackgroundColor:e.gray96,disabledBorderColor:e.borderLightColor,disabledSelectedBackgroundColor:e.gray92,disabledSelectedBorderColor:e.borderColor,disabledTextColor:e.textDisabledColor,activePrependLeftBorderColor:e.borderColor},Secondary:{shadow:\"inset 0 -1px 0 rgba(0,0,0,0.1)\",hoverShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1)\",activeShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1)\",selectedShadow:\"inset 0 1px 0 rgba(0,0,0,0.1)\",focusShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow),focusHoverShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow),focusActiveShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow),focusSelectedShadow:\"inset 0 1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow),focusAppendShadow:\"inset 0 -1px 0 rgba(0,0,0,0.1), inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow,\", inset -1px 0 0 \").concat(e.borderColor),focusAppendSelectedShadow:\"inset 0 1px 0 rgba(0,0,0,0.1), inset 0 -1px 0 rgba(0,0,0,0.1), \".concat(e.focusShadow,\", inset -1px 0 0 \").concat(e.borderColor),color:e.gray45,border:e.border,backgroundColor:e.gray98,selectedBackgroundColor:e.gray92,hoverBackgroundColor:l()(e.gray96).darken(2.5).toHexString(),activeBackgroundColor:e.gray92,disabledBackgroundColor:e.gray96,disabledBorderColor:e.borderLightColor,disabledSelectedBackgroundColor:e.gray92,disabledSelectedBorderColor:e.borderColor,disabledTextColor:e.textDisabledColor,activePrependLeftBorderColor:e.borderColor},Pill:{color:e.gray45,hoverBackgroundColor:e.backgroundColorHover,hoverBorderColor:e.borderColor,hoverColor:e.linkColor,focusColor:e.linkColor,expandedBackgroundColor:e.gray92,invalidColor:e.errorColor,selectedBorderColor:e.accentColor,selectedDisabledBorderColor:e.borderLightColor,disabledTextColor:e.textDisabledColor}},Calendar:{width:\"220px\",padding:\"8px\",DateTable:{tableHeaderColor:e.textGray,paddingBottom:\"2px\",fontSize:e.fontSizeSmall},Day:{buttonColor:e.gray45,buttonHoverColor:e.linkColor,buttonHoverBackgroundColor:e.backgroundColorHover,buttonSelectedBorderColor:e.accentColor,buttonSelectedBorderHoverColor:e.linkColor,buttonSelectedBackgroundColor:\"transparent\",width:\"2em\",lineHeight:\"2em\",border:\"1px solid transparent\",borderRadius:e.borderRadius,focusShadow:e.focusShadow},MonthHeader:{textTransform:\"capitalize\"}},Card:{backgroundColor:e.backgroundColor,clickableSelectedBorderColor:e.focusColor,borderColor:e.borderLightColor,hoverShadow:e.overlayShadow,focusShadow:e.focusShadow,Header:{subtitleColor:e.textGray,padding:e.spacing},Body:{padding:e.spacing,firstChildPaddingTop:\"0\"},Footer:{boxColor:e.textGray,padding:e.spacing,borderTop:\"1px solid \".concat(e.gray92)}},Chip:{clickableBackgroundColor:e.gray92,clickableColor:e.textGray,clickableHoverBackgroundColor:e.gray96,clickableDisabledBackgroundColor:\"rgba(0, 0, 0, 0.05)\",errorColorBackgroundColor:e.errorColorL10,labelColor:e.textColor,iconColor:e.textColor,infoColorBackgroundColor:e.infoColorL10,successColorBackgroundColor:e.successColorL10,warningColorBackgroundColor:e.warningColorL10},Clickable:{disabledColor:e.textDisabledColor},Code:{commentToken:e.syntaxGray,prologToken:e.syntaxGray,doctypeToken:e.syntaxGray,cdataToken:e.syntaxGray,punctuationToken:e.syntaxGray,propertyToken:e.syntaxPurple,tagToken:e.syntaxPurple,booleanToken:e.syntaxPurple,numberToken:e.syntaxPurple,constantToken:e.syntaxPurple,symbolToken:e.syntaxPurple,deletedToken:e.syntaxPurple,selectorToken:e.syntaxGreen,\"attr-nameToken\":e.syntaxGreen,stringToken:e.syntaxGreen,charToken:e.syntaxGreen,builtinToken:e.syntaxGreen,insertedToken:e.syntaxGreen,operatorToken:e.syntaxBrown,entityToken:e.syntaxBrown,urlToken:e.syntaxBrown,atruleToken:e.syntaxBlue,\"attr-valueToken\":e.syntaxBlue,keywordToken:e.syntaxBlue,functionToken:e.syntaxRed,regexToken:e.syntaxOrange,importantToken:e.syntaxOrange,variableToken:e.syntaxOrange},CollapsiblePanel:{minHeight:\"calc(\".concat(e.lineHeight,\" + 12px)\"),marginTop:\"2px\",iconTransition:\"transform 300ms\",iconPosition:\"12px\",iconTransfromClose:\"rotate(90deg)\",titleLineHeight:e.lineHeight,titlePadding:\"6px calc(\".concat(e.spacing,\" + \").concat(e.spacingHalf,\")\"),titleClickableColor:e.textColor,titleClickableCollapsedBackgroundColor:e.gray96,titleClickableHoverBackgroundColor:e.gray92,titleFocusShadow:e.focusShadowInset},Color:{width:\"180px\",clickableInvalidBorderColor:e.errorColor,swatchesListMarginRight:\"-6px\",swatchesListMarginBottom:\"6px\",Swatch:{marginRight:e.spacingQuarter,marginBottom:e.spacingQuarter,nullLineColor:\"#ed1e24\",transparentPatternEvenColor:\"transparent\",transparentPatternOddColor:e.gray80,border:e.border,focusBorderColor:l()(e.focusColor).setAlpha(.8).toRgbString(),boxShadow:e.focusShadow,smallSize:e.inputHeightSmall},Input:{width:\"100%\"}},Concertina:{panelBodyErrorBackgroundColor:e.errorColorL50,panelBodyWarningBackgroundColor:e.warningColorL50,Heading:{clickableColor:e.textColor,clickableBackgroundColor:e.gray96,clickableHoverBackgroundColor:e.gray92,clickableDisabledBackgroundColor:e.gray96}},ControlGroup:{boxInvalidColor:e.errorColor,helpColor:e.textGray},Date:{width:\"105px\",widthLarge:\"130px\",widthSmall:\"80px\"},File:{mediumDropTargetBoxBorderColor:e.borderColor,mediumDropTargetBoxDisabledColor:e.textGray,mediumDropTargetBoxDisabledFileCount0BackgroundColor:e.gray96,largeDropTargetBoxDisabledColor:e.textGray,linkColor:e.linkColor,linkFocusShadow:e.focusShadowInset,iconFill:e.gray60,padding:e.spacingQuarter,borderDragOver:\"1px solid \".concat(e.accentColorL10),disabledBorder:\"none\",windowDropBorder:\"5px solid \".concat(e.accentColorL10),Item:{backgroundColor:\"transparent\",boxBackgroundColor:e.gray92,boxColor:e.textGray,labelColor:e.textColor,labelErrorTextColor:e.errorColor,labelDisabledBackgroundColor:e.gray96,labelDisabledTextColor:e.textGray,removeClickableFocusColor:e.linkColor,removeClickableHoverBackgroundColor:e.gray96,removeClickableHoverColor:e.linkColor,borderRadius:\"2px\",padding:\"3px 0 3px \".concat(e.spacingHalf),flex:\"0 0 \".concat(e.inputHeight),removeClickableBorderRadius:\"0 2px 2px 0\",removeClickablePadding:\"3px 0\",removeClickableErrorBorder:\"1px solid \".concat(e.errorColor),removeClickableFocusShadow:e.focusShadow,removeClickableSmallFlexBasis:e.inputHeightSmall}},Heading:{sectionColor:e.gray45,fontWeight:e.fontWeightSemiBold,fontSize:e.fontSize,h1FontSize:e.fontSizeXXLarge,h2FontSize:e.fontSizeXLarge,h3FontSize:e.fontSizeLarge,h4FontSize:e.fontSize,h5FontSize:\"12px\"},Image:{boxBackgroundColor:e.gray92,boxColor:e.textGray,labelColor:e.textColor,labelDisabledBackgroundColor:e.gray96,removeClickableFocusColor:e.linkColor,removeClickableHoverBackgroundColor:e.gray96,removeClickableHoverColor:e.linkColor,padding:\"3px 0 3px \".concat(e.spacingHalf),removeClickableColor:\"inherit\",removeClickableFlex:\"0 0 \".concat(e.inputHeight),removeClickableFocusShadow:e.focusShadow},JSONTree:{TreeNode:{expandLinkClickableColor:e.linkColor,propertyColor:e.syntaxRed,typeColorString:e.syntaxTeal,typeColorNumber:e.syntaxBlue,typeColorBoolean:e.syntaxPurple,typeColorNull:e.syntaxBrown,typeColorObject:e.textColor}},Link:{clickableColor:e.linkColor,focusShadow:\"0 0 1px 2px \".concat(l()(e.focusColor).setAlpha(.6).toRgbString()),disabledColor:e.textDisabledColor,focusTextDecoration:\"none\",externalMargin:\"0 0 0 3px\"},Logo:{svgTextFill:e.gray20,svgInvertedTextFill:e.white},Markdown:{codeBlockBackgroundColor:e.gray96,codeInlineBackgroundColor:e.gray92},Menu:{backgroundColor:e.backgroundColor,Item:{backgroundColorHover:e.backgroundColorHover,clickableColor:e.gray45,disabledSelectedIconColor:e.gray80,focusShadowInset:e.focusShadowInset,matchColor:e.accentColor,descriptionColor:e.textGray,itemSelectedIconColor:e.accentColorL10,itemSelectedIconLeft:\"8px\",itemSelectedIconTop:\"5px\",itemIconVertical:\"middle\",submenuColor:e.textGray,padding:\"6px \".concat(e.spacingHalf),lineHeight:e.lineHeight,selectablePaddingLeft:\"28px\",selectablePaddingRight:e.spacingHalf,selectablePosition:\"left\",checkboxPaddingLeft:\"32px\"},Heading:{padding:\"\".concat(e.spacingQuarter,\" \").concat(e.spacingHalf,\" 6px\")}},Message:{iconColor:e.white,iconInfoColor:e.infoColor,iconSuccessColor:e.successColor,iconWarningColor:e.warningColor,iconErrorColor:e.errorColor,boxInfoBackgroundColor:e.infoColorL50,boxSuccessBackgroundColor:e.successColorL50,boxWarningBackgroundColor:e.warningColorL50,boxErrorBackgroundColor:e.errorColorL50},Modal:{boxShadow:\"0 1px 5px \".concat(e.black),transform:\"translateX(-50%)\",Body:{boxBackgroundColor:e.backgroundColor},Footer:{boxBackgroundColor:e.backgroundColor,boxBorderTopColor:e.borderColor},Header:{boxBackgroundColor:e.backgroundColor,boxBorderBottomColor:e.borderColor,boxPadding:\"25px 28px\",closeAndPeekPaddingRight:\"94px\",closeOrPeekPaddingRight:\"54px\",titleFontWeightSemiBold:e.fontWeightSemiBold,titleLineHeight:\"22px\",subTitleLineHeight:e.lineHeight}},ModalLayer:{backgroundColor:e.gray30},Monogram:{color:e.white,clickableFocusHoverBoxShadow:e.focusShadowInset,backgroundColors:[\"#006d9c\",\"#ec9960\",\"#af575a\",\"#62b3b2\",\"#4fa484\",\"#f8be34\",\"#5a4575\",\"#708794\",\"#294e70\",\"#b6c75a\",\"#5cc05c\",\"#007abd\",\"#dc4e41\",\"#f1813f\",\"#f8be34\",\"#53a051\",\"#006d9c\",\"#77d6d8\",\"#f589ad\",\"#6a2c5d\"]},Multiselect:{Normal:{boxBackgroundColor:e.white,boxDisabledBackgroundColor:e.gray96,boxInvalidBorderColor:e.errorColor,boxInvalidColor:e.errorColor}},Number:{incrementorWidth:\"20px\",mediumWidth:\"100px\",minusButtonBorderRightColor:e.borderColor,plusButtonBorderRightColor:e.borderColor},Paragraph:{marginBottom:\"calc(\".concat(e.lineHeight,\" / 2)\")},Popover:{align:\"center\",lightBackgroundColor:e.backgroundColor,lightBorder:e.border,lightBoxShadow:\"0 2px 2px \".concat(l()(e.gray20).setAlpha(.1).toRgbString()),lightColor:e.textColor,arrowBorderBottomColor:e.borderColor,darkBackgroundColor:e.gray20,darkColor:e.white,darkArrowBorderBottomColor:e.gray20,arrowHeightPixel:8,paddingPixel:8},Progress:{tooltipBackgroundColor:e.accentColorD10},Resize:{resizeColor:e.borderColor},ResultsMenu:{footerColor:e.textGray,loadingMessageColor:e.textGray},SidePanel:{panelBackgroundColor:e.backgroundColor},Slider:{sliderBarDisabledBackgroundColor:e.gray92,sliderBarLeftSideColor:e.gray45,sliderBarRightSideColor:e.gray80,sliderBarStepMarksColor:e.gray96,sliderThumbBackgroundColor:e.gray45,sliderThumbDisabledBackgroundColor:e.gray92,labelDisabledColor:e.textDisabledColor},StepBar:{Step:{color:e.textDisabledColor,grayFill:e.gray80,nextStroke:e.gray80,prevOrActiveFillColor:e.brandColor}},Switch:{wrapperErrorColor:e.errorColor,labelPaddingLeft:e.spacingQuarter,Checkbox:{color:e.gray45,focusShadow:e.focusShadow,selectedBorderColor:e.gray45,disabledBorderColor:e.gray80,disabledColor:e.gray80,errorColor:e.errorColor,errorBorderColor:e.errorColorL30,selectedErrorBorderColor:e.errorColor},Radio:{color:e.gray45,selectedLeft:\"4px\",selectedTop:\"4px\",focusShadow:e.focusShadow,selectedBorderColor:e.gray45,disabledBorderColor:e.gray80,disabledColor:e.gray80,errorColor:e.errorColor,errorBorderColor:e.errorColorL30,selectedErrorBorderColor:e.errorColor},Toggle:{shadow:\"inset 0 2px 0 rgba(0, 0, 0, 0.1)\",toggleFocusShadow:\"\".concat(e.focusShadow,\", inset 0 2px 0 rgba(0, 0, 0, 0.1)\"),backgroundColor:e.gray98,borderColor:e.borderColor,indicatorBackgroundColor:e.gray98,indicatorBorderColor:e.borderColor,indicatorHoverBackgroundColor:e.gray96,toggleIndicatorBorderStyle:\"solid\",selectedBackgroundColor:e.accentColorL10,selectedBorderColor:e.accentColorL10,disabledBorderColor:e.borderLightColor,disabledBackgroundColor:e.gray96,disabledIndBorderColor:l()(e.borderLightColor).setAlpha(.8).toRgbString(),selectedDisabledBackgroundColor:e.accentColorL40,errorToggleOutlineBorderColor:e.errorColor}},TabBar:{Tab:{clickableColor:e.textColor,focusShadowInset:e.focusShadowInset,underlineSelectedBackgroundColor:e.accentColor}},Table:{focusShadowInset:e.focusShadowInset,Cell:{linkColor:e.linkColor,clickableBackgroundColor:e.accentColorL50,padding:\"6px 12px\",expandPadding:0,verticalAlign:\"top\"},Head:{toggleAllWidth:\"42px\",infoWidth:\"32px\"},HeadCell:{backgroundColor:e.gray92,borderLeftColor:e.backgroundColor,draggingBackgroundColor:e.gray80,guideLineBackgroundColor:e.linkColor,focusShadow:e.focusShadowInset,moreInfoHeadCellPadding:\"5px 0 0 0\"},HeadInner:{hoverColor:e.linkColorHover,helperBackgroundColor:e.accentColorL50,sortIconColor:e.textGray,sortIconPosition:\"absolute\",sortedIconColor:e.accentColor,menuIconColor:e.textGray,menuIconPadding:\"1px 0 0 4px\",padding:\"6px 12px\",dragContainerTop:\"0px\",dragContainerLeft:\"0px\",menuIconRight:\"0\",dragContainerPadding:\"9px 12px\"},Row:{stripeNoneClickableHoverBackgroundColor:e.accentColorL50,stripeEvenBackgroundColor:e.gray96,expandContainerWidth:\"8px\"},RowDragCell:{draggablePadding:\"9px 0\",draggingBackgroundColor:e.gray80,guideLineBackgroundColor:e.linkColor,helperBackgroundColor:e.accentColorL50,width:\"32px\"},Toggle:{inHeadMargin:\"-6px 0\",margin:\"-6px 0\"}},Text:{clearIconRight:\"1px\",clearIconTop:\"2px\",clearIconPadding:\"8px\",inputFocusShadow:e.focusShadow,inputColor:e.textColor,inputBackgroundColor:e.white,inputFocusColor:e.textColor,inputErrorBorderColor:e.errorColor,inputErrorColor:e.errorColor,inputDisabledBackgroundColor:e.gray96,inputDisabledBorderColor:e.gray92,inputDisabledColor:e.textDisabledColor,inputClearOrSearchPaddingRight:\"28px\",placeholderMediumSize:\"11px\",placeholderWithSearchLeft:\"11px\",spacingHalf:e.spacingHalf,spacingQuarter:e.spacingQuarter,searchIconWrapperColor:e.gray60,searchIconWrapperRight:\"8px\",searchIconWrapperTop:\"8px\",clearColor:e.gray60,placeholderColor:e.textGray,searchIconPosition:\"right\"},Tooltip:{linkColor:e.linkColor},WaitSpinner:{circleStroke:e.gray60}}}},h=c(a.a),u=n(48),d=n.n(u),p=n(6),f=n.n(p),g=d()({},c(f.a),{\"react-ui\":{ButtonSimple:{Default:{shadow:\"inset 0 -1px 0 \".concat(f.a.gray30),hoverShadow:\"inset 0 -1px 0 \".concat(f.a.gray25),activeShadow:\"inset 0 -1px 0 \".concat(f.a.gray22),selectedShadow:\"inset 0 1px 0 \".concat(f.a.black),focusShadow:\"inset 0 -1px 0 \".concat(f.a.gray30,\", \").concat(f.a.focusShadow),focusHoverShadow:\"inset 0 -1px 0 \".concat(f.a.gray25,\", \").concat(f.a.focusShadow),focusActiveShadow:\"inset 0 -1px 0 \".concat(f.a.gray22,\", \").concat(f.a.focusShadow),focusSelectedShadow:\"inset 0 1px 0 \".concat(f.a.black,\", \").concat(f.a.focusShadow),focusAppendShadow:\"inset 0 -1px 0 \".concat(f.a.gray30,\", \").concat(f.a.focusShadow,\", inset -1px 0 0 \").concat(f.a.borderColor),focusAppendSelectedShadow:\"inset 0 1px 0 \".concat(f.a.black,\", \").concat(f.a.focusShadow,\", inset -1px 0 0 \").concat(f.a.borderColor),backgroundColor:f.a.gray45,color:f.a.white,selectedBackgroundColor:f.a.gray22,hoverBackgroundColor:f.a.gray30,selectedBorderColor:f.a.gray20,activeBorderColor:f.a.gray20,activeBackgroundColor:f.a.gray22,disabledBackgroundColor:f.a.gray30,disabledBorderColor:f.a.gray30,disabledSelectedBackgroundColor:f.a.gray22,disabledSelectedBorderColor:f.a.gray20},Secondary:{shadow:\"inset 0 -1px 0 \".concat(f.a.gray30),hoverShadow:\"inset 0 -1px 0 \".concat(f.a.gray25),activeShadow:\"inset 0 -1px 0 \".concat(f.a.gray22),selectedShadow:\"inset 0 1px 0 \".concat(f.a.black),focusShadow:\"inset 0 -1px 0 \".concat(f.a.gray30,\", \").concat(f.a.focusShadow),focusHoverShadow:\"inset 0 -1px 0 \".concat(f.a.gray25,\", \").concat(f.a.focusShadow),focusActiveShadow:\"inset 0 -1px 0 \".concat(f.a.gray22,\", \").concat(f.a.focusShadow),focusSelectedShadow:\"inset 0 1px 0 \".concat(f.a.black,\", \").concat(f.a.focusShadow),focusAppendShadow:\"inset 0 -1px 0 \".concat(f.a.gray30,\", \").concat(f.a.focusShadow,\", inset -1px 0 0 \").concat(f.a.borderColor),focusAppendSelectedShadow:\"inset 0 1px 0 \".concat(f.a.black,\", \").concat(f.a.focusShadow,\", inset -1px 0 0 \").concat(f.a.borderColor),backgroundColor:f.a.gray45,color:f.a.white,selectedBackgroundColor:f.a.gray22,hoverBackgroundColor:f.a.gray30,selectedBorderColor:f.a.gray20,activeBorderColor:f.a.gray20,activeBackgroundColor:f.a.gray22,disabledBackgroundColor:f.a.gray30,disabledBorderColor:f.a.gray30,disabledSelectedBackgroundColor:f.a.gray22,disabledSelectedBorderColor:f.a.gray20},Pill:{color:f.a.white,hoverColor:f.a.white,focusColor:f.a.white,expandedBackgroundColor:f.a.gray22}},Calendar:{Day:{buttonColor:f.a.gray98}},Chip:{clickableBackgroundColor:f.a.gray45,clickableHoverBackgroundColor:f.a.gray30,clickableDisabledBackgroundColor:\"rgba(0, 0, 0, 0.15)\"},Code:{color:f.a.gray92,commentToken:f.a.gray60,prologToken:f.a.gray60,doctypeToken:f.a.gray60,cdataToken:f.a.gray60,punctuationToken:f.a.gray60,propertyToken:f.a.syntaxPurpleLight,tagToken:f.a.syntaxPurpleLight,booleanToken:f.a.syntaxPurpleLight,numberToken:f.a.syntaxPurpleLight,constantToken:f.a.syntaxPurpleLight,symbolToken:f.a.syntaxPurpleLight,deletedToken:f.a.syntaxPurpleLight,selectorToken:f.a.syntaxGreenLight,\"attr-nameToken\":f.a.syntaxGreenLight,stringToken:f.a.syntaxGreenLight,charToken:f.a.syntaxGreenLight,builtinToken:f.a.syntaxGreenLight,insertedToken:f.a.syntaxGreenLight,operatorToken:f.a.syntaxBrown,entityToken:f.a.syntaxBrown,urlToken:f.a.syntaxBrown,atruleToken:f.a.syntaxBlueLight,\"attr-valueToken\":f.a.syntaxBlueLight,keywordToken:f.a.syntaxBlueLight,functionToken:f.a.syntaxRedLight,regexToken:f.a.syntaxOrange,importantToken:f.a.syntaxOrange,variableToken:f.a.syntaxOrange},CollapsiblePanel:{titleClickableCollapsedBackgroundColor:f.a.gray45,titleClickableHoverBackgroundColor:f.a.gray30},Concertina:{panelBodyErrorBackgroundColor:l()(f.a.errorColor).setAlpha(.5).toRgbString(),panelBodyWarningBackgroundColor:l()(f.a.warningColor).setAlpha(.5).toRgbString(),Heading:{clickableBackgroundColor:f.a.gray45,clickableHoverBackgroundColor:f.a.gray30,clickableDisabledBackgroundColor:f.a.gray80}},File:{mediumDropTargetBoxBorderColor:f.a.textGray,mediumDropTargetBoxDisabledFileCount0BackgroundColor:f.a.gray60,iconFill:f.a.gray80,Item:{boxBackgroundColor:f.a.gray45,removeClickableHoverBackgroundColor:f.a.gray30,labelDisabledBackgroundColor:f.a.gray60}},Heading:{sectionColor:f.a.gray80},JSONTree:{TreeNode:{propertyColor:f.a.syntaxRedLight,expandLinkClickableColor:f.a.accentColorL40,typeColorNumber:f.a.syntaxBlueLight,typeColorBoolean:f.a.syntaxPurpleLight}},Logo:{svgTextFill:f.a.white,svgInvertedTextFill:f.a.gray20},Markdown:{codeBlockBackgroundColor:f.a.gray22,codeInlineBackgroundColor:f.a.gray22},Menu:{Item:{clickableColor:f.a.gray96}},Message:{boxInfoBackgroundColor:l()(f.a.infoColor).setAlpha(.5).toRgbString(),boxSuccessBackgroundColor:l()(f.a.successColor).setAlpha(.5).toRgbString(),boxWarningBackgroundColor:l()(f.a.warningColor).setAlpha(.5).toRgbString(),boxErrorBackgroundColor:l()(f.a.errorColor).setAlpha(.5).toRgbString()},Modal:{Footer:{boxBorderTopColor:f.a.gray20},Header:{boxBorderBottomColor:f.a.gray20}},Multiselect:{Normal:{boxBackgroundColor:f.a.gray22,boxBorderColor:f.a.gray20,boxDisabledBackgroundColor:f.a.gray22,boxDisabledBorderColor:f.a.gray30}},Number:{incrementorBorderColor:f.a.gray20,incrementorDisabledBorderColor:f.a.gray22},Popover:{lightBorder:f.a.borderDark,lightBoxShadow:\"0 1px 2px #000\",arrowBorderBottomColor:f.a.borderDarkColor,darkBackgroundColor:f.a.white,darkColor:f.a.gray20,darkArrowBorderBottomColor:f.a.white},Resize:{resizeColor:f.a.gray92},Slider:{sliderBarStepMarksColor:f.a.gray20},Switch:{Checkbox:{color:f.a.gray80,borderColor:f.a.gray80,selectedBorderColor:f.a.gray80,disabledBorderColor:f.a.gray45,disabledColor:f.a.gray45,errorBorderColor:f.a.errorColor},Radio:{color:f.a.gray80,borderColor:f.a.gray80,selectedBorderColor:f.a.gray80,disabledBorderColor:f.a.gray45,disabledColor:f.a.gray45,errorBorderColor:f.a.errorColor},Toggle:{backgroundColor:f.a.gray45,indicatorBackgroundColor:f.a.gray80,indicatorHoverBackgroundColor:l()(f.a.gray80).darken(6).toRgbString(),disabledBorderColor:f.a.borderColor,disabledBackgroundColor:f.a.gray30,disabledIndBackgroundColor:f.a.gray45,disabledIndBorderColor:f.a.gray22,selectedDisabledBackgroundColor:f.a.accentColorD20}},Table:{Cell:{clickableBackgroundColor:f.a.accentColorD50},HeadCell:{backgroundColor:\"#212527\",draggingBackgroundColor:f.a.gray20},HeadInner:{helperBackgroundColor:f.a.accentColorD50},Row:{stripeNoneClickableHoverBackgroundColor:f.a.accentColorD50,stripeEvenBackgroundColor:f.a.gray25,stripeOddBackgroundColor:f.a.gray22},RowDragCell:{draggingBackgroundColor:f.a.gray20,helperBackgroundColor:f.a.accentColorD50}},Text:{inputBackgroundColor:f.a.gray22,inputBorderColor:f.a.gray20,inputDisabledBackgroundColor:f.a.gray22,inputDisabledBorderColor:f.a.gray30,searchIconWrapperColor:f.a.white,clearColor:f.a.white},WaitSpinner:{circleStroke:f.a.white}}}),m=n(85),b=c(n.n(m).a),v=n(5),y=n.n(v),x=c(y.a);delete x[\"react-ui\"].ButtonSimple.Pill,delete x[\"react-ui\"].Table.Cell.clickableBackgroundColor;var w=d()({},x,{\"react-ui\":{Button:{disabledIconColor:y.a.textDisabledColor,iconColor:y.a.gray68,iconOnlyColor:y.a.gray96,iconOnlyDisabledColor:y.a.textDisabledColor,iconPaddingRight:\"8px\",iconOnlyPadding:\"12px\",paddingSmall:\"6px\",paddingLarge:\"16px\",primaryIconColor:y.a.gray96},ButtonSimple:{Primary:{shadow:\"none\",selectedShadow:\"none\",focusShadow:\"none\",selectedFocusShadow:\"none\",borderRadius:\"24px\",color:y.a.gray96,backgroundColor:y.a.blue1,activeBackgroundColor:y.a.blue3,focusBackgroundColor:y.a.blue2,hoverBackgroundColor:y.a.blue2,selectedBackgroundColor:y.a.blue2,disabledBackgroundColor:y.a.gray35,disabledSelectedBackgroundColor:y.a.gray29,disabledTextColor:y.a.gray68,prependBorderLeftColor:y.a.blue2},Error:{shadow:\"none\",selectedShadow:\"none\",focusShadow:\"none\",selectedFocusShadow:\"none\",disabledTextColor:y.a.gray68},Default:{shadow:\"none\",hoverShadow:\"none\",activeShadow:\"none\",selectedShadow:\"none\",focusShadow:\"none\",focusHoverShadow:\"none\",focusActiveShadow:\"none\",focusSelectedShadow:\"none\",focusAppendShadow:\"none\",focusAppendSelectedShadow:\"none\",color:y.a.gray96,border:y.a.borderLight,borderRadius:\"24px\",backgroundColor:y.a.transparent,activeBackgroundColor:y.a.gray29,focusBackgroundColor:y.a.gray35,hoverBackgroundColor:y.a.gray35,selectedBackgroundColor:y.a.gray29,disabledBackgroundColor:y.a.transparent,disabledBorderColor:y.a.gray29,disabledSelectedBackgroundColor:y.a.gray20,disabledTextColor:y.a.textDisabledColor,activePrependLeftBorderColor:y.a.gray68},Secondary:{shadow:\"none\",hoverShadow:\"none\",activeShadow:\"none\",selectedShadow:\"none\",focusShadow:\"none\",focusHoverShadow:\"none\",focusActiveShadow:\"none\",focusSelectedShadow:\"none\",focusAppendShadow:\"none\",focusAppendSelectedShadow:\"none\",color:y.a.gray96,border:\"1px solid \".concat(y.a.transparent),borderRadius:\"24px\",backgroundColor:y.a.transparent,activeBackgroundColor:y.a.gray17,focusBackgroundColor:y.a.gray35,hoverBackgroundColor:y.a.gray35,selectedBackgroundColor:y.a.gray29,disabledBackgroundColor:y.a.transparent,disabledBorderColor:y.a.transparent,disabledTextColor:y.a.textDisabledColor,disabledSelectedBackgroundColor:y.a.gray20,activePrependLeftBorderColor:y.a.transparent,disabledSelectedBorderColor:y.a.transparent,selectedPrependLeftBorderColor:y.a.transparent},Toggle:{border:y.a.border,color:y.a.gray96,activeBorderColor:y.a.gray35,activeBackgroundColor:y.a.gray20,focusBackgroundColor:y.a.gray35,hoverBackgroundColor:y.a.gray35,selectedBackgroundColor:y.a.gray35,disabledBorderColor:y.a.gray29,disabledTextColor:y.a.textDisabledColor,disabledSelectedBackgroundColor:y.a.gray17},Flat:{border:\"1px solid \".concat(y.a.transparent),color:y.a.gray96,backgroundColor:y.a.gray29,activeBackgroundColor:y.a.gray29,focusBackgroundColor:y.a.gray35,hoverBackgroundColor:y.a.gray35,selectedBackgroundColor:y.a.gray35,disabledBackgroundColor:y.a.gray20,disabledTextColor:y.a.textDisabledColor,disabledSelectedBackgroundColor:y.a.gray17}},Calendar:{width:\"332px\",padding:\"16px\",DateTable:{paddingBottom:\"6px\",fontSize:\"14px\"},Day:{buttonColor:y.a.gray96,buttonHoverColor:y.a.gray96,buttonHoverBackgroundColor:y.a.gray35,buttonFocusBackgroundColor:y.a.gray35,buttonSelectedBorderColor:\"none\",buttonSelectedColor:y.a.gray11,buttonSelectedBackgroundColor:y.a.gray96,buttonSelectedFontWeight:y.a.fontWeightBold,width:\"36px\",lineHeight:\"36px\",border:\"none\",borderRadius:\"50%\",focusShadow:\"none\"},MonthHeader:{fontSize:\"20px\",fontWeight:y.a.fontWeightBold,textTransform:\"uppercase\",wordSpacing:\"32px\",textColor:y.a.gray96,shortForm:!0}},Card:{backgroundColor:y.a.gray17,clickableSelectedBorderColor:y.a.transparent,borderColor:y.a.transparent,borderRadius:y.a.borderRadius,hoverShadow:\"none\",focusShadow:\"none\",hoverBackgroundColor:y.a.gray29,focusBackgroundColor:y.a.gray29,selectedBackgroundColor:y.a.gray29,Header:{padding:\"12px 8px 12px 16px\"},Body:{padding:\"16px\",firstChildPaddingTop:\"16px\"},Footer:{padding:\"8px 16px 16px\",borderTop:\"none\"}},Chip:{clickableColor:y.a.gray96,clickableBackgroundColor:y.a.gray29,clickableHoverBackgroundColor:y.a.gray35,clickableDisabledBackgroundColor:y.a.gray20,labelColor:y.a.gray96,iconColor:y.a.gray96,errorColorBackgroundColor:y.a.red1},Code:{commentToken:y.a.gray52,prologToken:y.a.gray52,doctypeToken:y.a.gray52,cdataToken:y.a.gray52,punctuationToken:y.a.gray52,propertyToken:y.a.syntaxPurpleLight,tagToken:y.a.syntaxPurpleLight,booleanToken:y.a.syntaxPurpleLight,numberToken:y.a.syntaxPurpleLight,constantToken:y.a.syntaxPurpleLight,symbolToken:y.a.syntaxPurpleLight,deletedToken:y.a.syntaxPurpleLight,selectorToken:y.a.syntaxGreenLight,\"attr-nameToken\":y.a.syntaxGreenLight,stringToken:y.a.syntaxGreenLight,charToken:y.a.syntaxGreenLight,builtinToken:y.a.syntaxGreenLight,insertedToken:y.a.syntaxGreenLight,operatorToken:y.a.syntaxBrown,entityToken:y.a.syntaxBrown,urlToken:y.a.syntaxBrown,atruleToken:y.a.syntaxBlueLight,\"attr-valueToken\":y.a.syntaxBlueLight,keywordToken:y.a.syntaxBlueLight,functionToken:y.a.syntaxRedLight,regexToken:y.a.syntaxOrange,importantToken:y.a.syntaxOrange,variableToken:y.a.syntaxOrange},CollapsiblePanel:{minHeight:\"40px\",backgroundColor:y.a.gray17,marginTop:\"1px\",iconTransition:\"transform 200ms\",iconPosition:\"calc(100% - 24px);\",iconTransfromOpen:\"rotate(90deg)\",iconTransfromClose:\"translateY(-2px) rotate(-90deg)\",iconTransfromOrigin:\"center\",paddingBottom:\"2px\",titleLineHeight:\"24px\",titlePadding:\"8px 16px\",titleBackgroundColor:y.a.gray11,titleClickableCollapsedBackgroundColor:y.a.gray11,titleClickableHoverBackgroundColor:y.a.gray11,titleClickableColor:y.a.white,titleClickableCollapsedColor:y.a.gray52,titleBorder:\"1px solid transparent\",titleFocusBorder:\"1px solid \".concat(y.a.gray68),titleShadow:\"0px -1px 0px rgba(255, 255, 255, 0.1), 0px 1px 0px rgba(255, 255, 255, 0.1)\",titleFocusShadow:\"none\",descriptionPosition:\"relative\",descriptionPositionRight:\"20px\"},Color:{inputTopLayout:!0,width:\"214px\",display:\"flex\",flexDirection:\"column-reverse\",borderRadius:\"4px\",swatchesListMarginRight:\"-8px\",swatchesListMarginBottom:\"-8px\",Swatch:{marginRight:\"8px\",marginBottom:\"8px\",borderRadius:\"2px\",border:\"1px solid \".concat(y.a.gray35),transparentPatternEvenColor:y.a.transparent,transparentPatternOddColor:\"rgba(0, 0, 0, 0.2)\",transparentBackgroundColor:y.a.white,textBoxSwatch:!0,focusBorderColor:y.a.gray35,smallSize:\"22px\"},Input:{width:\"calc(100% - 2px)\",marginBottom:\"8px\",position:\"relative\"}},Date:{position:\"relative\",letterSpacing:\"2px\",spacedFormat:!0,width:\"145px\",widthLarge:\"155px\",widthSmall:\"125px\",shouldRenderIcon:!0},File:{cloudIcon:!0,mediumDropTargetBoxBorderColor:y.a.gray52,mediumDropTargetBoxDisabledFileCount0BackgroundColor:y.a.transparent,borderDragOver:\"1px dashed \".concat(y.a.gray52),iconFill:y.a.white,iconErrorFill:y.a.errorColor,iconDisabledFill:y.a.gray52,padding:\"8px\",backgroundColorDragOver:y.a.gray35,errorTextColor:y.a.errorColor,disabledBorder:\"1px solid \".concat(y.a.gray35),linkErrorColor:y.a.errorColor,linkFocusShadow:\"none\",windowDropBorder:\"5px solid \".concat(y.a.blue2),Item:{itemRemoveable:!0,boxColor:y.a.white,labelColor:y.a.white,boxBackgroundColor:y.a.gray29,labelDisabledBackgroundColor:y.a.gray29,labelDisabledTextColor:y.a.textDisabledColor,borderRadius:y.a.borderRadius,fontSize:\"12px\",padding:\"4px 0 3px 8px\",cursor:\"pointer\",flex:\"none\",labelHoverBackgroundColor:y.a.gray35,labelErrorBackgroundColor:\"rgba(254, 58, 58, 0.1)\",labelErrorHoverBackgroundColor:\"rgba(254, 58, 58, 0.2)\",removeClickableBackgroundColor:y.a.gray35,removeClickableBorderRadius:\"50%\",removeClickableErrorBorder:\"none\",removeClickableErrorBackgroundColor:l()(y.a.errorColor).setAlpha(.7).toRgbString(),removeClickableErrorHoverBackgroundColor:y.a.errorColor,removeClickableErrorFocusBackgroundColor:y.a.errorColor,removeClickableFocusShadow:\"none\",removeClickableFocusBackgroundColor:y.a.gray52,removeClickableFocusColor:y.a.white,removeClickableHoverBackgroundColor:y.a.gray52,removeClickableHoverColor:y.a.white,removeClickableSmallFlexBasis:\"auto\",removeClickableSmallTop:\"6px\"}},Heading:{fontSize:y.a.fontSize,fontWeight:y.a.fontWeightBold,h1FontSize:\"36px\",h2FontSize:\"24px\",h3FontSize:\"20px\",h4FontSize:\"16px\",h5FontSize:\"13px\",h1LineHeight:\"48px\",h2LineHeight:\"24px\",h3LineHeight:\"24px\",h4LineHeight:\"24px\",h5LineHeight:\"16px\",headingColor:y.a.gray96,sectionColor:y.a.gray68},Image:{cloudIcon:!0,overflow:\"hidden\",borderRadius:y.a.borderRadius,boxBackgroundColor:y.a.gray29,boxBackgroundHoverColor:y.a.gray35,cursor:\"pointer\",labelColor:y.a.white,padding:\"8px 10px\",fontSize:\"12px\",lineHeight:\"16px\",removeClickableColor:y.a.white,removeClickableFlex:\"none\",removeClickableBorderRadius:\"50%\",removeClickableBackgroundColor:y.a.gray52,removeClickableHoverBackgroundColor:y.a.gray68,removeClickableHoverLabelBackgroundColor:y.a.gray68,removeClickableHoverColor:y.a.white,removeClickableFocusColor:y.a.white,removeClickableFocusShadow:\"none\",removeClickableFocusBackgroundColor:y.a.gray68},JSONTree:{TreeNode:{propertyColor:y.a.syntaxRedLight,expandLinkClickableColor:y.a.accentColorL40,typeColorNumber:y.a.syntaxBlueLight,typeColorBoolean:y.a.syntaxPurpleLight}},Link:{focusShadow:\"none\",disabledColor:y.a.gray52,focusTextDecoration:\"underline\",focusActiveTextDecoration:\"none\",externalMargin:\"0 0 0 4px\"},Logo:{svgTextFill:y.a.white,svgInvertedTextFill:y.a.gray20},Markdown:{codeBlockBackgroundColor:y.a.gray29,codeInlineBackgroundColor:y.a.gray29},Menu:{backgroundColor:y.a.gray29,Divider:{borderColor:y.a.gray35},Item:{clickableColor:y.a.gray96,matchColorBackground:y.a.gray96,matchColor:y.a.gray11,descriptionLineHeight:\"16px\",descriptionColor:y.a.gray68,backgroundColorHover:y.a.gray35,backgroundColorFocus:y.a.gray35,backgroundColorActive:y.a.gray35,focusShadowInset:\"inset 0 0 0 0 \".concat(y.a.transparent),itemIconMarginRight:\"16px\",itemIconVertical:\"initial\",itemSelectedIconColor:y.a.gray96,itemSelectedIconLeft:\"initial\",itemSelectedIconTop:\"11px\",itemSelectedIconRight:\"16px\",disabledSelectedIconColor:y.a.gray52,lineHeight:\"24px\",spacingHalf:\"16px\",padding:\"12px 16px\",selectablePaddingLeft:\"16px\",selectablePaddingRight:\"44px\",selectablePosition:\"right\",checkboxPaddingLeft:\"56px\"},Heading:{padding:\"13px 16px 10px 16px\"}},Message:{boxInfoBackgroundColor:l()(y.a.infoColor).setAlpha(.5).toRgbString(),boxSuccessBackgroundColor:l()(y.a.successColor).setAlpha(.5).toRgbString(),boxWarningBackgroundColor:l()(y.a.warningColor).setAlpha(.5).toRgbString(),boxErrorBackgroundColor:l()(y.a.errorColor).setAlpha(.5).toRgbString()},Modal:{boxShadow:\"0px 4px 8px 0px rgba(0,0,0,0.5)\",verticalAlign:\"center\",transform:\"translate(-50%, -50%)\",Body:{boxBackgroundColor:y.a.gray20},Footer:{boxBackgroundColor:y.a.gray20,boxBorderTopColor:y.a.gray29},Header:{boxBackgroundColor:y.a.gray20,boxBorderBottomColor:y.a.gray29,titleColor:y.a.gray96,boxPadding:\"24px\",closeAndPeekPaddingRight:\"88px\",closeOrPeekPaddingRight:\"52px\",titleFontWeightSemiBold:\"500\",titleLineHeight:\"24px\",subTitleLineHeight:\"24px\",iconBackgroundColor:y.a.gray29}},ModalLayer:{backgroundColor:y.a.gray11},Multiselect:{Normal:{boxBackgroundColor:y.a.gray17,boxBorderColor:y.a.gray29,boxDisabledBackgroundColor:y.a.gray29,boxDisabledBorderColor:y.a.gray23}},Number:{controlsBorder:\"1px solid transparent\",incrementorBackgroundColor:y.a.gray20,incrementorBorderColor:y.a.transparent,incrementorColor:y.a.gray68,incrementorDisabledBorderColor:y.a.transparent,incrementorDisabledColor:y.a.gray35,incrementorHoverColor:y.a.gray96,incrementorWidth:\"22px\",mediumWidth:\"116px\",minusButtonBorderRightColor:y.a.transparent,plusButtonBorderRightColor:y.a.transparent},Paragraph:{marginBottom:\"14px\"},Popover:{align:\"edge\",lightBorder:y.a.transparent,lightBoxShadow:\"0px 4px 8px 0px rgba(0,0,0,0.5)\",lightBackgroundColor:y.a.gray17,lightColor:y.a.gray96,darkBackgroundColor:y.a.gray96,darkColor:y.a.gray17,darkBorderRadius:y.a.borderRadius,arrowHeightPixel:0,paddingPixel:8},Resize:{resizeColor:y.a.gray96},Slider:{sliderBarStepMarksColor:y.a.gray20,sliderBarDisabledBackgroundColor:y.a.gray23,sliderBarLeftSideColor:y.a.gray35,sliderBarRightSideColor:y.a.gray68,sliderThumbBackgroundColor:y.a.gray35,sliderThumbDisabledBackgroundColor:y.a.gray23},StepBar:{Step:{currentStepColor:y.a.gray96,currentStepFontWeight:y.a.fontWeightSemiBold,grayFill:y.a.gray68,nextStroke:y.a.gray68,prevOrActiveFillColor:y.a.blue2}},Switch:{labelPaddingLeft:\"12px\",labelLineHeight:\"24px\",Checkbox:{color:y.a.white,borderColor:y.a.gray52,top:\"3px\",margin:\"3px\",focusShadow:\"none\",hasBackground:!0,selectedBorderColor:y.a.blue2,selectedBackgroundColor:y.a.blue2,disabledBorderColor:y.a.gray52,disabledColor:y.a.gray52,errorBorderColor:y.a.errorColor,someSize:\"6px\",someMargin:\"0px\"},Radio:{color:y.a.white,borderColor:y.a.gray52,margin:\"3px\",focusShadow:\"none\",hasBackground:!0,selectedBorderColor:y.a.white,disabledColor:y.a.gray35,disabledBorderColor:y.a.gray35,errorBorderColor:y.a.errorColor},Toggle:{top:\"3px\",width:\"30px\",toggleShadow:\"none\",toggleIndicatorShadowOn:\"0px 3px 8px rgba(0, 0, 0, 0.25)\",toggleIndicatorShadowOff:\"0px 1px 3px rgba(0, 0, 0, 0.25)\",toggleFocusShadow:\"none\",toggleFocusBorderColor:y.a.transparent,indicatorSize:\"14px\",indicatorMargin:\"2px\",toggleIndicatorBorderStyle:\"none\",backgroundColor:y.a.gray35,borderColor:y.a.transparent,selectedBorderColor:y.a.transparent,indicatorBackgroundColor:y.a.white,outlineMargin:\"-6px\",outlineBorderRadius:\"15px\",outlineHoverBackgroundColor:\"rgba(255, 255, 255, 0.15)\",outlineFocusBackgroundColor:\"rgba(255, 255, 255, 0.15)\",disabledBorderColor:y.a.gray20,disabledBackgroundColor:y.a.gray20,disabledIndBackgroundColor:y.a.gray35,disabledIndBorderColor:y.a.transparent,selectedBackgroundColor:y.a.blue2,selectedDisabledBackgroundColor:y.a.gray29,selectedDisabledIndBackgroundColor:y.a.gray52,errorToggleOutlineBorderColor:y.a.transparent,errorToggleBackgroundColor:y.a.errorColor}},TabBar:{Tab:{afterColor:\"transparent\",afterContent:\"attr(title)\",afterDisplay:\"block\",afterFontWeight:\"bold\",afterHeight:\"0px\",afterOverflow:\"hidden\",afterVisibility:\"hidden\",clickableColor:y.a.gray68,hoverColor:y.a.gray96,focusColor:y.a.gray96,focusShadowInset:\"inset 0 0 0 0 \".concat(y.a.transparent),selectedColor:y.a.gray96,selectedFontWeight:\"bold\",underlineSelectedBackgroundColor:y.a.borderLightColor}},Table:{focusShadowInset:\"none\",Cell:{clickableHoverBackgroundColor:y.a.gray20,clickableExpandIconColor:y.a.white,expandContainerHoverBackgroundColor:y.a.gray20,padding:\"12px 8px 11px 8px\",firstChildColor:y.a.gray96,rowActionsPadding:\"6px 8px 5px 0\",expandPadding:\"6px 2px 0 0\",linkColor:y.a.gray68,linkFocusColor:y.a.white,fontSize:y.a.fontSize,lineHeight:\"24px\",verticalAlign:\"middle\",disabledTextColor:y.a.gray52},Head:{toggleAllWidth:\"36px\",infoWidth:\"36px\"},HeadCell:{backgroundColor:y.a.gray11,draggingBackgroundColor:y.a.gray04,focusShadow:\"none\",borderLeftColor:y.a.transparent,moreInfoHeadCellPadding:\"7px 9px 8px 6px\",focusBackgroundColor:y.a.gray35,toggleAllFocusBorderColor:y.a.gray96},HeadInner:{sortIconColor:y.a.gray96,sortIconPosition:\"relative\",sortedIconColor:y.a.gray96,menuIconColor:y.a.gray96,menuIconPadding:\"0 0 0 4px\",helperBackgroundColor:y.a.accentColorD50,hoverColor:y.a.gray96,borderRadius:y.a.borderRadius,padding:\"8px 0\",toggleAllPadding:\"6px 0\",toggleAllFocusBorderColor:y.a.gray96,labelPadding:\"4px 8px\",menuIconRight:\"16px\",color:y.a.gray96,fontSize:y.a.fontSizeSmall,lineHeight:\"16px\",dragContainerTop:\"8px\",dragContainerLeft:\"10px\",dragContainerPadding:\"5px 16px 5px 8px\",focusBackgroundColor:y.a.gray35},Row:{backgroundColor:y.a.gray11,stripeHoverBackgroundColor:y.a.gray20,hoverColor:y.a.gray96,stripeNoneClickableHoverBackgroundColor:y.a.gray20,stripeEvenBackgroundColor:y.a.gray11,clickableHoverColor:y.a.gray96,borderBottom:\"1px solid \".concat(y.a.gray29),toggleAllFocusBorderColor:y.a.gray96,toggleFocusBackgroundColor:y.a.gray35,toggleFocusBorderColor:y.a.transparent,expandContainerWidth:\"36px\",borderRadius:\"18px\",padding:\"4px 0 8px\",selectedTextColor:y.a.gray96,disabledBackgroundColor:y.a.gray17,linkHoverColor:y.a.gray96,linkFocusBackgroundColor:y.a.gray20,linkActiveBackgroundColor:y.a.gray17},RowDragCell:{draggablePadding:\"17px 0 16px 0\",draggingBackgroundColor:y.a.gray04,helperBackgroundColor:y.a.accentColorD50,width:\"36px\",toggleAllFocusBorderColor:y.a.gray96},Toggle:{inHeadMargin:\"-10px 0\",margin:\"-6px 0\",position:\"relative\",top:\"-3px\"}},Text:{clearIconRight:\"8px\",clearIconTop:\"6px\",clearIconPadding:\"6px\",inputBackgroundColor:y.a.gray17,inputColor:y.a.gray96,inputDisabledColor:y.a.textDisabledColor,inputErrorBorderColor:y.a.red1,inputFocusBorderColor:y.a.gray52,inputFocusColor:y.a.gray96,inputFocusShadow:\"none\",inputDisabledBackgroundColor:y.a.gray17,inputDisabledBorderColor:y.a.gray17,inputErrorColor:y.a.gray96,inputClearOrSearchPaddingRight:\"40px\",placeholderMediumSize:\"16px\",placeholderWithSearchLeft:\"40px\",spacingHalf:\"16px\",spacingQuarter:\"7px\",searchIconWrapperColor:y.a.gray68,clearColor:y.a.gray68,disabledSearchIconColor:y.a.textDisabledColor,searchIconWrapperRight:\"12px\",searchIconWrapperTop:\"10px\",searchIconPosition:\"left\",searchIconPaddingLeft:\"40px\"},WaitSpinner:{circleStroke:y.a.white}}});var k=h,M=g,S=b,A=w,C={enterprise:k,enterpriseDark:M,lite:S,scp:A},_=function(e){return e.theme&&e.theme[\"react-ui\"]?e.theme[\"react-ui\"]:k[\"react-ui\"]},T=function(){for(var e=arguments.length,t=new Array(e),n=0;n1?arguments[1]:void 0,n),l=a>2?arguments[2]:void 0,c=void 0===l?n:r(l,n);c>s;)t[s++]=e;return t}},126:function(e,t,n){\"use strict\";var i=n(7);e.exports=function(){var e=i(this),t=\"\";return e.global&&(t+=\"g\"),e.ignoreCase&&(t+=\"i\"),e.multiline&&(t+=\"m\"),e.unicode&&(t+=\"u\"),e.sticky&&(t+=\"y\"),t}},127:function(e,t,n){var i=n(7),r=n(31),o=n(9)(\"species\");e.exports=function(e,t){var n,a=i(e).constructor;return void 0===a||null==(n=i(a)[o])?t:r(n)}},128:function(e,t,n){\"use strict\";var i=n(8),r=n(13),o=n(57),a=n(90),s=n(25),l=n(60),c=n(4),h=n(59),u=n(33),d=n(14),p=n(200),f=n(49).f,g=n(11).f,m=n(125),b=n(56),v=i.ArrayBuffer,y=i.DataView,x=i.Math,w=i.RangeError,k=i.Infinity,M=v,S=x.abs,A=x.pow,C=x.floor,_=x.log,T=x.LN2,O=r?\"_b\":\"buffer\",L=r?\"_l\":\"byteLength\",E=r?\"_o\":\"byteOffset\";function P(e,t,n){var i,r,o,a=Array(n),s=8*n-t-1,l=(1<>1,h=23===t?A(2,-24)-A(2,-77):0,u=0,d=e<0||0===e&&1/e<0?1:0;for((e=S(e))!=e||e===k?(r=e!=e?1:0,i=l):(i=C(_(e)/T),e*(o=A(2,-i))<1&&(i--,o*=2),(e+=i+c>=1?h/o:h*A(2,1-c))*o>=2&&(i++,o/=2),i+c>=l?(r=0,i=l):i+c>=1?(r=(e*o-1)*A(2,t),i+=c):(r=e*A(2,c-1)*A(2,t),i=0));t>=8;a[u++]=255&r,r/=256,t-=8);for(i=i<0;a[u++]=255&i,i/=256,s-=8);return a[--u]|=128*d,a}function I(e,t,n){var i,r=8*n-t-1,o=(1<>1,s=r-7,l=n-1,c=e[l--],h=127&c;for(c>>=7;s>0;h=256*h+e[l],l--,s-=8);for(i=h&(1<<-s)-1,h>>=-s,s+=t;s>0;i=256*i+e[l],l--,s-=8);if(0===h)h=1-a;else{if(h===o)return i?NaN:c?-k:k;i+=A(2,t),h-=a}return(c?-1:1)*i*A(2,h-t)}function N(e){return e[3]<<24|e[2]<<16|e[1]<<8|e[0]}function D(e){return[255&e]}function R(e){return[255&e,e>>8&255]}function z(e){return[255&e,e>>8&255,e>>16&255,e>>24&255]}function j(e){return P(e,52,8)}function B(e){return P(e,23,4)}function H(e,t,n){g(e.prototype,t,{get:function(){return this[n]}})}function F(e,t,n,i){var r=p(+n);if(r+t>e[L])throw w(\"Wrong index!\");var o=e[O]._b,a=r+e[E],s=o.slice(a,a+t);return i?s:s.reverse()}function W(e,t,n,i,r,o){var a=p(+n);if(a+t>e[L])throw w(\"Wrong index!\");for(var s=e[O]._b,l=a+e[E],c=i(+r),h=0;hG;)(V=U[G++])in v||s(v,V,M[V]);o||(q.constructor=v)}var X=new y(new v(2)),Y=y.prototype.setInt8;X.setInt8(0,2147483648),X.setInt8(1,2147483649),!X.getInt8(0)&&X.getInt8(1)||l(y.prototype,{setInt8:function(e,t){Y.call(this,e,t<<24>>24)},setUint8:function(e,t){Y.call(this,e,t<<24>>24)}},!0)}else v=function(e){h(this,v,\"ArrayBuffer\");var t=p(e);this._b=m.call(Array(t),0),this[L]=t},y=function(e,t,n){h(this,y,\"DataView\"),h(e,v,\"DataView\");var i=e[L],r=u(t);if(r<0||r>i)throw w(\"Wrong offset!\");if(r+(n=void 0===n?i-r:d(n))>i)throw w(\"Wrong length!\");this[O]=e,this[E]=r,this[L]=n},r&&(H(v,\"byteLength\",\"_l\"),H(y,\"buffer\",\"_b\"),H(y,\"byteLength\",\"_l\"),H(y,\"byteOffset\",\"_o\")),l(y.prototype,{getInt8:function(e){return F(this,1,e)[0]<<24>>24},getUint8:function(e){return F(this,1,e)[0]},getInt16:function(e){var t=F(this,2,e,arguments[1]);return(t[1]<<8|t[0])<<16>>16},getUint16:function(e){var t=F(this,2,e,arguments[1]);return t[1]<<8|t[0]},getInt32:function(e){return N(F(this,4,e,arguments[1]))},getUint32:function(e){return N(F(this,4,e,arguments[1]))>>>0},getFloat32:function(e){return I(F(this,4,e,arguments[1]),23,4)},getFloat64:function(e){return I(F(this,8,e,arguments[1]),52,8)},setInt8:function(e,t){W(this,1,e,D,t)},setUint8:function(e,t){W(this,1,e,D,t)},setInt16:function(e,t){W(this,2,e,R,t,arguments[2])},setUint16:function(e,t){W(this,2,e,R,t,arguments[2])},setInt32:function(e,t){W(this,4,e,z,t,arguments[2])},setUint32:function(e,t){W(this,4,e,z,t,arguments[2])},setFloat32:function(e,t){W(this,4,e,B,t,arguments[2])},setFloat64:function(e,t){W(this,8,e,j,t,arguments[2])}});b(v,\"ArrayBuffer\"),b(y,\"DataView\"),s(y.prototype,a.VIEW,!0),t.ArrayBuffer=v,t.DataView=y},129:function(e,t){t.BITS=32,t.GROUPS=4,t.RE_ADDRESS=/^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g,t.RE_SUBNET_STRING=/\\/\\d{1,2}$/},13:function(e,t,n){e.exports=!n(4)((function(){return 7!=Object.defineProperty({},\"a\",{get:function(){return 7}}).a}))},130:function(e,t){t.BITS=128,t.GROUPS=8,t.SCOPES={0:\"Reserved\",1:\"Interface local\",2:\"Link local\",4:\"Admin local\",5:\"Site local\",8:\"Organization local\",14:\"Global\",15:\"Reserved\"},t.TYPES={\"ff01::1/128\":\"Multicast (All nodes on this interface)\",\"ff01::2/128\":\"Multicast (All routers on this interface)\",\"ff02::1/128\":\"Multicast (All nodes on this link)\",\"ff02::2/128\":\"Multicast (All routers on this link)\",\"ff05::2/128\":\"Multicast (All routers in this site)\",\"ff02::5/128\":\"Multicast (OSPFv3 AllSPF routers)\",\"ff02::6/128\":\"Multicast (OSPFv3 AllDR routers)\",\"ff02::9/128\":\"Multicast (RIP routers)\",\"ff02::a/128\":\"Multicast (EIGRP routers)\",\"ff02::d/128\":\"Multicast (PIM routers)\",\"ff02::16/128\":\"Multicast (MLDv2 reports)\",\"ff01::fb/128\":\"Multicast (mDNSv6)\",\"ff02::fb/128\":\"Multicast (mDNSv6)\",\"ff05::fb/128\":\"Multicast (mDNSv6)\",\"ff02::1:2/128\":\"Multicast (All DHCP servers and relay agents on this link)\",\"ff05::1:2/128\":\"Multicast (All DHCP servers and relay agents in this site)\",\"ff02::1:3/128\":\"Multicast (All DHCP servers on this link)\",\"ff05::1:3/128\":\"Multicast (All DHCP servers in this site)\",\"::/128\":\"Unspecified\",\"::1/128\":\"Loopback\",\"ff00::/8\":\"Multicast\",\"fe80::/10\":\"Link-local unicast\"},t.RE_BAD_CHARACTERS=/([^0-9a-f:\\/%])/gi,t.RE_BAD_ADDRESS=/([0-9a-f]{5,}|:{3,}|[^:]:$|^:[^:]|\\/$)/gi,t.RE_SUBNET_STRING=/\\/\\d{1,3}(?=%|$)/,t.RE_ZONE_STRING=/%.*$/,t.RE_URL=new RegExp(/^\\[{0,1}([0-9a-f:]+)\\]{0,1}/),t.RE_URL_WITH_PORT=new RegExp(/\\[([0-9a-f:]+)\\]:([0-9]{1,5})/)},131:function(e,t){e.exports=function(e){return\"string\"!=typeof e?e:(/^['\"].*['\"]$/.test(e)&&(e=e.slice(1,-1)),/[\"'() \\t\\n]/.test(e)?'\"'+e.replace(/\"/g,'\\\\\"').replace(/\\n/g,\"\\\\n\")+'\"':e)}},132:function(e,t,n){var i=n(479),r=n(485);e.exports=function(e,t){var n=r(e,t);return i(n)?n:void 0}},133:function(e,t,n){var i=n(76),r=n(51);e.exports=function(e){if(!r(e))return!1;var t=i(e);return\"[object Function]\"==t||\"[object GeneratorFunction]\"==t||\"[object AsyncFunction]\"==t||\"[object Proxy]\"==t}},134:function(e,t,n){var i=n(62).Symbol;e.exports=i},135:function(e,t,n){var i=n(211);e.exports=function(e,t,n){\"__proto__\"==t&&i?i(e,t,{configurable:!0,enumerable:!0,value:n,writable:!0}):e[t]=n}},136:function(e,t){var n=Array.isArray;e.exports=n},137:function(e,t,n){var i=n(133),r=n(215);e.exports=function(e){return null!=e&&r(e.length)&&!i(e)}},138:function(e,t,n){\"use strict\";Object.defineProperty(t,\"__esModule\",{value:!0});var i,r=Object.assign||function(e){for(var t=1;t0&&void 0!==arguments[0]?arguments[0]:\"inline\",r=!(arguments.length>1&&void 0!==arguments[1])||arguments[1];return i({},r?t:{},{all:\"initial\",fontFamily:e.fontFamily,fontSize:e.fontSize,lineHeight:e.lineHeight,color:e.textColor,boxSizing:\"border-box\",display:n,borderWidth:\"1px\",visibility:\"inherit\",outline:\"medium none \"+e.focusColor})}},t.clearfix=function(){return{\"&::after\":{display:\"table\",content:'\"\"',clear:\"both\"}}},t.ellipsis=function(){return{overflow:\"hidden\",textOverflow:\"ellipsis\",whiteSpace:\"nowrap\"}},t.printWidth100Percent=function(){return{maxWidth:\"100% !important\",width:\"100% !important\",overflow:\"hidden !important\"}},t.printHide=function(){return{display:\"none !important\"}},t.printNoBackground=function(){return{background:\"none !important\"}},t.printWrapAll=function(){return{wordBreak:\"break-all !important\",wordWrap:\"break-word !important\",overflowWrap:\"break-word !important\",whiteSpace:\"normal !important\"}}},14:function(e,t,n){var i=n(33),r=Math.min;e.exports=function(e){return e>0?r(i(e),9007199254740991):0}},140:function(e,t,n){\"use strict\";!function e(){if(\"undefined\"!=typeof __REACT_DEVTOOLS_GLOBAL_HOOK__&&\"function\"==typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE){0;try{__REACT_DEVTOOLS_GLOBAL_HOOK__.checkDCE(e)}catch(e){console.error(e)}}}(),e.exports=n(536)},141:function(e,t,n){var i=n(78);e.exports=function(e,t){if(!i(e))return e;var n,r;if(t&&\"function\"==typeof(n=e.toString)&&!i(r=n.call(e)))return r;if(\"function\"==typeof(n=e.valueOf)&&!i(r=n.call(e)))return r;if(!t&&\"function\"==typeof(n=e.toString)&&!i(r=n.call(e)))return r;throw TypeError(\"Can't convert object to primitive value\")}},142:function(e,t){var n=Math.ceil,i=Math.floor;e.exports=function(e){return isNaN(e=+e)?0:(e>0?i:n)(e)}},143:function(e,t){e.exports=function(e){if(null==e)throw TypeError(\"Can't call method on \"+e);return e}},144:function(e,t){e.exports=!0},145:function(e,t){e.exports={}},146:function(e,t,n){var i=n(77),r=n(551),o=n(150),a=n(148)(\"IE_PROTO\"),s=function(){},l=function(){var e,t=n(228)(\"iframe\"),i=o.length;for(t.style.display=\"none\",n(556).appendChild(t),t.src=\"javascript:\",(e=t.contentWindow.document).open(),e.write(\" + + + + + + <% + page_path = "/static/app/" + app_name + "/cim_setup.js" + %> + + + + + \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/bin/data_model_simple_rest_handler.py b/deps/apps/Splunk_SA_CIM/bin/data_model_simple_rest_handler.py new file mode 100644 index 000000000..bee41a2e9 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/bin/data_model_simple_rest_handler.py @@ -0,0 +1 @@ +# This script intentionally left blank diff --git a/deps/apps/Splunk_SA_CIM/bin/datamodelsimple.py b/deps/apps/Splunk_SA_CIM/bin/datamodelsimple.py new file mode 100644 index 000000000..b476826c4 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/bin/datamodelsimple.py @@ -0,0 +1,101 @@ +import splunk.Intersplunk +import sys + +from splunk import AuthenticationFailed +from splunk.clilib.bundle_paths import make_splunkhome_path + +sys.path.append(make_splunkhome_path(["etc", "apps", "Splunk_SA_CIM", "lib"])) +from cim_models import DataModels +from splunk_sa_cim.log import setup_logger + +logger = setup_logger("datamodelsimple") + + +if __name__ == "__main__": + logger.info("Starting datamodelsimple search command") + + return_type = "models" + datamodel = None + obj = None + nodename = None + + # Override Defaults w/ opts below + if len(sys.argv) > 1: + for a in sys.argv: + if a.startswith("type="): + where = a.find("=") + return_type = a[where + 1 : len(a)] + elif a.startswith("datamodel="): + where = a.find("=") + datamodel = a[where + 1 : len(a)] + elif a.startswith("object="): + where = a.find("=") + obj = a[where + 1 : len(a)] + elif a.startswith("nodename="): + where = a.find("=") + nodename = a[where + 1 : len(a)] + + # if nodename is specified, create obj + if nodename and not obj: + obj = nodename.split(".") + obj = obj[-1] + + results, dummyresults, settings = splunk.Intersplunk.getOrganizedResults() + results = [] # we don't care about incoming results + + sessionKey = settings.get("sessionKey", False) + + try: + # validate sessionKey + if not sessionKey: + raise AuthenticationFailed + + if return_type == "models": + models = DataModels.getDatamodelList(sessionKey) + results = [{"datamodel": i} for i in models] + + elif return_type == "objects": + if datamodel: + objects = DataModels.getDatamodelObjectList(datamodel, sessionKey) + modelJson = DataModels.getDatamodelJson(datamodel, sessionKey) + results = [ + { + "object": i, + "lineage": DataModels.getObjectLineage(i, modelJson=modelJson), + } + for i in objects + ] + else: + e = "Must specify datamodel for type: objects" + logger.error(e) + results = splunk.Intersplunk.generateErrorResults(e) + + elif return_type == "attributes": + if datamodel and obj: + # get the model + modelJson = DataModels.getDatamodelJson(datamodel, sessionKey) + # getAvailableFields for non-transforming search + availableFieldsMap = DataModels.getAvailableFieldsMap(obj, modelJson) + # if we were able to determine lineage extend fields + if availableFieldsMap is not None: + for lineage_field, field in availableFieldsMap.items(): + results.append({"attribute": field, "lineage": lineage_field}) + else: + e = "Could not determine lineage for datamodel: %s, object: %s" % ( + datamodel, + obj, + ) + logger.error(e) + raise Exception(e) + + else: + e = "Must specify datamodel and object for type: attributes" + logger.error(e) + results = splunk.Intersplunk.generateErrorResults(e) + + except Exception as e: + logger.error(e) + results = splunk.Intersplunk.generateErrorResults(str(e)) + + splunk.Intersplunk.outputResults(results) + logger.info("Finishing datamodelinfo search command") diff --git a/deps/apps/Splunk_SA_CIM/bin/modaction_adhoc_rest_handler.py b/deps/apps/Splunk_SA_CIM/bin/modaction_adhoc_rest_handler.py new file mode 100644 index 000000000..0b4408487 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/bin/modaction_adhoc_rest_handler.py @@ -0,0 +1,694 @@ +try: + import http.client as http_client +except ImportError: + import httplib as http_client +import json +import operator +import re +import splunk +import splunk.auth +import splunk.rest +import splunk.util +import sys + +try: + from urllib.request import quote +except ImportError: + from urllib import quote +from splunk.clilib.bundle_paths import make_splunkhome_path +from splunk.persistconn.application import PersistentServerConnectionApplication +from time import gmtime + +sys.path.append(make_splunkhome_path(["etc", "apps", "Splunk_SA_CIM", "lib"])) +from splunk_sa_cim.log import setup_logger + +logger = setup_logger("modaction_adhoc_rest_handler") + + +class ModularActionAdhocException(Exception): + """Custom exception for Modular Action Adhoc REST handler""" + + pass + + +class ModularActionAdhocRestHandler(PersistentServerConnectionApplication): + """REST handler for dispatching modular actions in ad-hoc mode.""" + + ALERT_ACTIONS_URI = "/services/alerts/alert_actions/%s" + + PARAM_ACTION_NAME = "action_name" + TOKENS_EXPECTED = ("action_name", "_time", "source", "indexer_guid", "event_hash") + TOKENS_TRIGGER_TIME = ("trigger_time",) + TOKENS_RANDOM = ("#random",) + TOKENS_UNAVAILABLE = ("name_hash", "name") + TOKENS_UNAVAILABLE_KV = ("results.file", "results.url") + + # Simple regular expression for finding tokens in search commands. + TEMPLATE_REGEX = re.compile(r"""\$([\w.*#\- ]+)(?:\{([^}]+)\})?\$""") + + # key=value replacement + TEMPLATE_REGEX_KV = re.compile( + r""" + "? # Optional opening double quotation mark + ('? # Optional opening single quotation mark + [A-Za-z0-9_.-]+ # A word representing a Splunk field name + '?) # Optional closing single quotation mark + \s* # Optional whitespace + = # Required equals character + \s* # Optional whitespace + "? # Optional opening double quotation mark + \$ # Required opening dollar sign indicating Splunk string substitution + ([\w.*#\- ]+) # A word representing a string substitution + (?:\{([^}]+)\})? # A complex value substitution + \$ # Required closing dollar sign. + "? # Optional closing double quotation mark + """, + re.X, + ) + + PARAM_TEMPLATE = "action.%s." + + def __init__(self, command_line, command_arg): + super(ModularActionAdhocRestHandler, self).__init__() + + @classmethod + def get_action(cls, action, session_key): + """Retrieve an alert action configuration via REST. + Only alert actions that use sendalert are valid for adhoc invocations. + + :param action: An alert action name. + :type action: str + :param session_key: A Splunk session key. + :type session_key: str + + :return A dictionary representing the alert action configuration, + retrieved from REST. + :rtype dict + """ + + getargs = {"output_mode": "json", "count": 0} + unused_response, content = splunk.rest.simpleRequest( + cls.ALERT_ACTIONS_URI % action, getargs=getargs, sessionKey=session_key + ) + parsed_content = json.loads(content)["entry"][0]["content"] + + # param._cam is a JSON string in its own right. + cam_params = json.loads(parsed_content.get("param._cam", "{}")) + + if splunk.util.normalizeBoolean(cam_params.get("supports_adhoc", False)): + return parsed_content + else: + raise ModularActionAdhocException( + "Alert action does not support adhoc invocation." + ) + + @classmethod + def replace_tokens(cls, inputstr, tokens, replacement="", kv=False): + """Replace a token in a search. + + :param inputstr: A Splunk search string. + :type inputstr: str + :param tokens: A list of tokens to be substituted. + :type tokens: list(str) + :param replacement: A replacement string. + :type replacement: str + :param kv: A Boolean governing the behavior of the token replacement + on key=value pairs (see below) + :type kv: bool + + :return A Splunk search string with tokens replaced. + :rtype str + + Two replacement modes are provided based on + the value of the "kv" Boolean: + + If kv==True, tokens in this form are REMOVED ENTIRELY from the string. + This is used to scrub key=value pairs from a search string when the + subject of the replacement is unavailable. + + Whitespace around the equals sign is permitted + in this replacement mode. + + ="$token$" + ''="$token$" + =$token$ + ''=$token$ + + If kv==False, tokens in this form are merely replaced: + + $token$ + '$token$' + "$token$" + + Only the token itself is replaced in this mode; + leading and trailing quotes are unaltered. + """ + # idx is the index of the replacement group that must match the token. + rx, idx = (cls.TEMPLATE_REGEX_KV, 1) if kv else (cls.TEMPLATE_REGEX, 0) + + rv = inputstr + # Tokens are replaced in reverse order to avoid recalculating indexes. + for match_obj in reversed(list(rx.finditer(inputstr))): + if match_obj.groups()[idx] in tokens: + rv = rv[: match_obj.start()] + str(replacement) + rv[match_obj.end() :] + return rv + + @classmethod + def replace_standard_tokens(cls, inputstr): + """Replace tokens that are either always unavailable or + that have a constant value when a modular action is + executed in the ad-hoc context. + + :param inputstr: A Splunk search string. + :type inputstr: str + + :return A Splunk search string with tokens replaced. + :rtype str + """ + + tmpstr = inputstr + + # Replace any key-value pairs found that reference these tokens. + tmpstr = cls.replace_tokens(tmpstr, cls.TOKENS_UNAVAILABLE_KV, kv=True) + + # Replace standalone tokens. + tmpstr = cls.replace_tokens(tmpstr, cls.TOKENS_UNAVAILABLE) + + # Replace random tokens. + tmpstr = cls.replace_tokens(tmpstr, cls.TOKENS_RANDOM, "$random$") + + # Replace trigger_time + tmpstr = cls.replace_tokens( + tmpstr, cls.TOKENS_TRIGGER_TIME, splunk.util.mktimegm(gmtime()) + ) + + return tmpstr + + @classmethod + def replace_event_tokens(cls, inputstr, replacement_map, substitute_defaults=False): + """Replace tokens in a search string using data submitted by the user. + + :param inputstr: A Splunk search string. + :type inputstr: str + :param replacement_map: + A dictionary of key=value replacements to be conducted. + :param substitute_defaults: + Whether or not do substitute tokens with defaults specified. + For instance, $action..{default=""}$ + :type substitute_defaults: bool + + :return A tuple (search, unused_token_dict) representing: + - a Splunk search string with tokens replaced + - any unused tokens. + :rtype tuple(str, dict) + """ + + rv = inputstr + unused = {} + default_re = re.compile(r"^default\s*=\s*(.+)$") + + for k, v in replacement_map.items(): + tmp = cls.replace_tokens(rv, [k], v) + if tmp == rv: + unused[k] = v + else: + rv = tmp + + # substitute defaults + if substitute_defaults: + for match_obj in reversed(list(cls.TEMPLATE_REGEX.finditer(rv))): + if match_obj.group(2): + logger.debug( + "Discovered token replacement with default specified: %s", + match_obj.groups(), + ) + default_match = default_re.match(match_obj.group(2)) + if default_match: + replacement = default_match.group(1).strip('"') + rv = ( + rv[: match_obj.start()] + + replacement + + rv[match_obj.end() :] + ) + + return rv, unused + + @classmethod + def quote_value(cls, value): + """Quote an injected token's value by: + + - enclosing the string in double quotation marks + - escaping internal double quotation marks + + :param value: A value to be quoted. + :type value: str + + :return: A properly quoted token. + :rtype: str + """ + return '"%s"' % value.strip('"').replace('"', r"\"") + + @classmethod + def inject_tokens(cls, action_name, inputstr, inject_map): + """Inject tokens received from user input into + the sendalert clause of the search string. + + If a token is already present in the sendalert clause, + it will NOT be re-inserted, since that would cause duplicate arguments + to be passed to the "sendalert" command. + + :param action_name: The modular action name. + :type action_name: str + :param inputstr: + A string representing a Splunk search, + which is expected to contain "sendalert". + :type inputstr: str + :param inject_map: + A dictionary containing key=value token pairs to be injected. + :type inject_map: dict + + :return A Splunk search string with tokens injected. + :rtype str + """ + + param_template = cls.PARAM_TEMPLATE % action_name + + # CIM-731: permit sendalert pipelines with arbitrary action names + clause_rx = re.compile( + r"sendalert\s+(?P[\w-]+)\s*(?P[^|]*)(?:\||\s*$)" + ) + + tokens = {} + for k, v in inject_map.items(): + tokens[k.replace(param_template, "")] = v + + token_rx = re.compile(r"(%s)\s*=" % "|".join(tokens.keys())) + + clause_match = clause_rx.search(inputstr) + + if clause_match: + # Find the param.* tokens in the command arguments + token_str = clause_match.groupdict()["args"] + token_matches = token_rx.findall(token_str) + + cleaned_inject_map = { + k: v for k, v in tokens.items() if k not in token_matches + } + inject_str = " ".join( + [ + k + "=" + cls.quote_value(cleaned_inject_map[k]) + for k in sorted(cleaned_inject_map) + ] + ) + + if inject_str: + components = ( + i + for i in [ + inputstr[0 : clause_match.span(1)[1]].strip(), + inject_str, + inputstr[clause_match.span(1)[1] :].strip(), + ] + if i != "" + ) + return " ".join(components) + else: + return inputstr + else: + # Should never get here. + raise ModularActionAdhocException( + "Mismatch between modular action name and sendalert clause." + ) + + @classmethod + def get_default_replacements(cls, action_name, action_contents): + """Return alert action parameters derived from REST, + in the action.. format + suitable for use in token substitution. + + :param action_name: A modular action name. + :type action_name: str + :param action_contents: A dictionary of alert action contents. + :type action_contents: dict + + :return A dictionary of key=value pairs + :rtype dict + """ + + v_params = {} + param_template = cls.PARAM_TEMPLATE % action_name + + # Get only the valid modular alert-style parameters + for k, v in action_contents.items(): + if k != "name": + v_params[param_template + k] = v + + return v_params + + @classmethod + def get_user_replacements(cls, action_name, action_contents, replacements): + """Return the valid k=v replacements derived from user input, + in the action.. + format suitable for use in token substitution. + + :param action_name: A modular action name. + :type action_name: str + :param action_contents: A dictionary of alert action contents. + :type action_contents: dict + :param replacements: + A dictionary of key-value substitutions requested by the user. + :type replacements: dict + + :return A dictionary of key=value pairs + :rtype dict + """ + + v_params = {} + param_template = cls.PARAM_TEMPLATE % action_name + + logger.debug("param_template: %s", param_template) + logger.debug("action_contents: %s", action_contents) + logger.debug("replacements: %s", replacements) + + # Get only the valid modular alert-style parameters for the alert action + for k, v in replacements.items(): + if ( + k.startswith(param_template) + and k.replace(param_template, "") in action_contents + ): + v_params[k] = v + elif k == "action_name": + v_params[k] = v + else: + raise ModularActionAdhocException( + "Invalid parameter for adhoc modular action." + ) + + return v_params + + @staticmethod + def error(msg, status): + """ + Return error. + + :param msg: A message describing the problem (a string) + :type msg: str + :param status: An integer to be returned as the HTTP status code. + :type status: int + """ + logger.error(msg) + return {"status": status, "payload": msg} + + def build_command(self, action_name, token_map, session_key): + """Return a modular action search command string valid for adhoc execution, + performing token substitution on the command. + + :param action_name: Name of the alert action. + :type action_name: str + :param token_map: A dictionary of k=v string replacements to be conducted. + :type token_map: dict + :param session_key: A Splunk session key + :type session_key: str + + Parameters that can be substituted in the alert action command are identifiable via $token$ substitution strings: + + MODALERT format (this uses the normal naming scheme): + $action..param.$ + + Example: $action.risk.param.index$ + + LEGACY format: + $action..$ + + Example: $action.risk._risk_object$ + + Values for these parameters can be derived from user input, OR from default values defined in alert_actions.conf. + + 1. SUBSTITUTIONS VIA USER INPUT + + Token substitutions provided by the user will be in the token_map argument to this function. When a value + is derived from user input, the name is expected to be in MODALERT format, e.g.: + + token_map = {'action.risk.param._risk_score': '100'} + + 2. DEFAULT SUBSTITUTIONS + + Token substitutions for which the user has provided no value must be performed using values retrieved from the + alert_actions.conf configuration for the modular action. However, parameter names in alert_actions.conf drop the + "action.action_name" prefix. Thus when a value is derived from alert_actions.conf, it must be mapped as + shown to complete the substitution: + + Modular alert format: + + param. in alert_actions.conf --> replaces token $action..$ + + Legacy format (only applicable to certain alert actions such as "risk"): + + in alert_actions.conf --> replaces token $action..$ + + Inline format: + replaces token $action..{default=}$ + + """ + + # Get the alert action contents. May raise ModularActionAdhocException. + action_contents = self.get_action(action_name, session_key) + + # Perform standard token replacements for any values + # that are never present in an adhoc invocation (e.g., "name_hash") + command = self.replace_standard_tokens(action_contents["command"]) + + # Validate the user-provided replacement strings. + # May raise ModularActionAdhocException. + user_replacements = self.get_user_replacements( + action_name, action_contents, token_map + ) + + # Obtain the default alert action parameters. + default_replacements = self.get_default_replacements( + action_name, action_contents + ) + + # Substitute tokens using user input (unused replacements don't matter) + command, _ = self.replace_event_tokens(command, user_replacements) + + # Substitute tokens using default values + # (unused replacements don't matter) + command, _ = self.replace_event_tokens( + command, default_replacements, substitute_defaults=True + ) + + # Inject unused key=value pairs in the query_args that are NOT substituted into the alert action's "command" + # parameter directly following the alert action name (e.g., "sendalert risk ". + # Parameters already present in the sendalert string will not be duplicated. + # Note: token injection is only performed for commands that use sendalert. + if "sendalert" in command: + command = self.inject_tokens(action_name, command, user_replacements) + + return command + + # Search utility commands + @staticmethod + def _normalize_search(search, alert_cmd): + """Normalize a search for parse or dispatch. + + :param search: A search to be prefixed to the final search. + :type search: str + :param alert_cmd: + An alert action command string, + with all token substitutions already performed. + :type alert_cmd: str + + :return The normalized search string + :rtype str + """ + + if not search.lstrip().startswith(("|", "search")): + search = "search " + search.lstrip() + + if not alert_cmd.strip().startswith("|"): + alert_cmd = " | " + alert_cmd + + return search.strip() + alert_cmd + + @staticmethod + def _parse_search(search, session_key): + """Trivially attempt to parse a search command before dispatching. + + :param search: A search to be prefixed to the final search. + :type search: str + :param session_key: A Splunk session key. + :type session_key: str + + :return True if the search parsed, else ModularActionAdhocException + :rtype bool + :raises ModularActionAdhocException + + Note: We intentionally avoid the similar + splunk.search.Parser.parseSearch() method + because of the excessive number of imports used in that library. + + """ + args = {"output_mode": "json", "parse_only": "t", "q": search} + + r, unused_c = splunk.rest.simpleRequest( + "/search/parser", getargs=args, sessionKey=session_key, raiseAllErrors=True + ) + + if r.status != 200: + raise ModularActionAdhocException("Constructed search could not be parsed.") + + return True + + @staticmethod + def _dispatch_search(search, namespace, owner, session_key, dispatch_args=None): + """Dispatch a search. + + :param search: A search to be prefixed to the final search. + :type search: str + :param session_key: A Splunk session key. + :type session_key: str + + :return The SID of the dispatched search + :rtype str + + Note: We specifically avoid the similar splunk.search.dispatch() + method because of the excessive number of imports used in that library. + """ + + args = { + "output_mode": "json", + # CIM-944: adhoc_search_level essential to proper field extraction + "adhoc_search_level": "verbose", + # CIM-990: preview needs to be false to prevent duped sendalert actions + "preview": "false", + "search": search, + } + + if dispatch_args: + args.update(dispatch_args) + + if namespace and owner: + uri = "/servicesNS/{0}/{1}/search/jobs".format( + quote(owner, safe=""), quote(namespace, safe="") + ) + else: + uri = "search/jobs" + + r, c = splunk.rest.simpleRequest( + uri, postargs=args, sessionKey=session_key, raiseAllErrors=True + ) + + if r.status != http_client.CREATED: + logger.debug("JOBS_ENDPOINT_RESPONSE: %s", r) + logger.debug("JOBS_ENDPOINT_CONTENT: %s", c) + raise ModularActionAdhocException( + 'Error when dispatching search: status_code="%s"' % r.status + ) + + return json.loads(c)["sid"] + + def handle(self, args): + """Main function for REST call. + + :param args: + A JSON string representing a dictionary of arguments to + the REST call. + :type args: str + + :return A valid REST response. + :rtype dict + + - Routing of GET, POST, etc. happens here. + - All exceptions should be caught here. + """ + + logger.debug("ARGS: %s", args) + args = json.loads(args) + + try: + logger.info("Handling %s request.", args["method"]) + method = "handle_" + args["method"].lower() + if callable(getattr(self, method, None)): + return operator.methodcaller(method, args)(self) + else: + return self.error( + "Invalid method for this endpoint", http_client.METHOD_NOT_ALLOWED + ) + except ModularActionAdhocException as e: + msg = "ModularActionException: {0}".format(e) + return self.error(msg, http_client.BAD_REQUEST) + except splunk.RESTException as e: + return self.error( + "RESTexception: %s" % e, http_client.INTERNAL_SERVER_ERROR + ) + except Exception as e: + msg = "Unknown exception: %s" % e + logger.exception(msg) + return self.error(msg, http_client.INTERNAL_SERVER_ERROR) + + def handle_post(self, args): + """Dispatch a modular action in adhoc mode. + + :param args: A dictionary of arguments to the REST call. + :type args: dict + + :return A valid REST response. + :rtype dict + """ + + # Retrieve arguments. Everything not popped from form_args is assumed + # to be a key=value replacement string that will be passed to + # validate_replacements(). + session_key = args["session"]["authtoken"] + post_args = dict(args.pop("form", [])) + action_name = post_args.get("action_name", "") + search = post_args.pop("search", "") + + # If the handler was invoked with a namespace, + # both namespace and owner will be used when dispatching search. + namespace = args.pop("ns", {}).get("app") + owner = args["session"]["user"] + + # Earliest and latest used only in dispatching the search, + # not in any token substitutions. + valid_dispatch_args = ["earliest_time", "latest_time"] + dispatch_args = {k: post_args.pop(k, None) for k in valid_dispatch_args} + + if not all([action_name, search, session_key]): + raise ModularActionAdhocException( + "Missing parameters for adhoc modular action." + ) + + if not post_args: + logger.info("Modular action invoked with no user token replacements.") + + action_cmd = self.build_command(action_name, post_args, session_key) + + # Normalize the search + finalized_cmd = self._normalize_search(search, action_cmd) + logger.info("Finalized command: %s", finalized_cmd) + + # Attempt to parse and dispatch the search + # (may raise ModularActionAdhocException) + if self._parse_search(finalized_cmd, session_key): + sid = self._dispatch_search( + finalized_cmd, namespace, owner, session_key, dispatch_args + ) + + return { + "status": http_client.CREATED, + "payload": { + "command": finalized_cmd, + "sid": sid, + }, + } + + else: + + return { + "status": http_client.BAD_REQUEST, + "payload": { + "command": finalized_cmd, + }, + } diff --git a/deps/apps/Splunk_SA_CIM/bin/modaction_dequeue_handler.py b/deps/apps/Splunk_SA_CIM/bin/modaction_dequeue_handler.py new file mode 100644 index 000000000..ebbfd4095 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/bin/modaction_dequeue_handler.py @@ -0,0 +1,137 @@ +try: + import http.client as http_client +except ImportError: + import httplib as http_client +import json +import operator +import sys + +from splunk import RESTException +from splunk.clilib.bundle_paths import make_splunkhome_path +from splunk.persistconn.application import PersistentServerConnectionApplication + +sys.path.append(make_splunkhome_path(["etc", "apps", "Splunk_SA_CIM", "lib"])) +from splunk_sa_cim.log import setup_logger +from splunk_sa_cim.modaction_queue import ( + ModularActionQueueBR, + ModularActionQueueISE, + ModularActionQueueUnauth, + ModularActionQutils, +) + +logger = setup_logger("modaction_queue_handler") + + +class ModularActionDeQueueHandler(PersistentServerConnectionApplication): + """REST handler for generating modular action queue api keys.""" + + def __init__(self, command_line, command_arg): + super(ModularActionDeQueueHandler, self).__init__() + + try: + self.params = json.loads(command_arg) + except Exception as e: + logger.warn(e) + self.params = {} + + ModularActionQutils.set_log_level(logger, self.params) + + self.modaction_qutils = ModularActionQutils(logger, None) + + def handle(self, args): + """Main function for REST call. + + :param args: A JSON string representing a dictionary + of arguments to the REST call. + :type args: str + + :return A valid REST response. + :rtype dict + + - Routing of GET, POST, etc. happens here. + - All exceptions should be caught here. + """ + + logger.debug("ARGS: %s", args) + args = json.loads(args) + + try: + logger.info("Handling %s request.", args["method"]) + method = "handle_" + args["method"].lower() + if callable(getattr(self, method, None)): + return operator.methodcaller(method, args)(self) + else: + return self.modaction_qutils.error( + "Invalid method for this endpoint", http_client.METHOD_NOT_ALLOWED + ) + except ModularActionQueueBR as e: + msg = "ModularActionException: {0}".format(e) + return self.modaction_qutils.error(msg, http_client.BAD_REQUEST) + except ModularActionQueueUnauth as e: + msg = "ModularActionException: {0}".format(e) + return self.modaction_qutils.error(msg, http_client.UNAUTHORIZED) + except ModularActionQueueISE as e: + msg = "ModularActionException: {0}".format(e) + return self.modaction_qutils.error(msg, http_client.INTERNAL_SERVER_ERROR) + except RESTException as e: + return self.modaction_qutils.error( + "RESTexception: %s" % e, http_client.INTERNAL_SERVER_ERROR + ) + except Exception as e: + msg = "Unknown exception: %s" % e + logger.exception(msg) + return self.modaction_qutils.error(msg, http_client.INTERNAL_SERVER_ERROR) + + def handle_post(self, args): + """Main function for REST call. + + :param args: + A JSON string representing a dictionary of arguments + to the REST call. + :type args: str + + :return A valid REST response. + :rtype dict + + - Routing of GET, POST, etc. happens here. + - All exceptions should be caught here. + """ + # validate encryption + if not self.modaction_qutils.is_connection_encrypted( + args.get("connection", {}) + ): + raise ModularActionQueueISE("Unable to validate encryption") + + # headers + headers = args.get("headers", []) + + # get worker + worker = self.modaction_qutils.get_header_item(headers, "X-API-ID") + + # get api_key + api_key = self.modaction_qutils.get_header_item(headers, "X-API-KEY") + + # get system key + self.modaction_qutils.session_key = args.get("system_authtoken", None) + + # validate api key + if not self.modaction_qutils.is_api_key_valid(worker, api_key): + raise ModularActionQueueUnauth("Unable to validate X-API information") + + # validate payload + payload = args.get("payload", "") + self.modaction_qutils.validate_dequeue_payload(payload, worker) + + # get query + query = {"$or": [{"_key": x} for x in json.loads(payload)]} + logger.debug(query) + + # unsave + try: + self.modaction_qutils.unsave_work(query) + except Exception as e: + logger.exception(e) + logger.warn("Unable to unsave work") + + # delete + return self.modaction_qutils.delete_work(query) diff --git a/deps/apps/Splunk_SA_CIM/bin/modaction_invocations_rest_handler.py b/deps/apps/Splunk_SA_CIM/bin/modaction_invocations_rest_handler.py new file mode 100644 index 000000000..d45dd5fe9 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/bin/modaction_invocations_rest_handler.py @@ -0,0 +1,219 @@ +try: + import http.client as http_client +except ImportError: + import httplib as http_client +import json +import operator +import splunk +import splunk.rest +import splunk.search +import sys + +from splunk.persistconn.application import PersistentServerConnectionApplication +from splunk.clilib.bundle_paths import make_splunkhome_path + +sys.path.append(make_splunkhome_path(["etc", "apps", "Splunk_SA_CIM", "lib"])) +from splunk_sa_cim.log import setup_logger + +# Python 2+3 basestring +try: + basestring +except NameError: + basestring = str + +logger = setup_logger("modaction_invocations_rest_handler") + + +class ModularActionInvocationErrors(object): + """Enum for error strings""" + + ERR_INVALID_ARG = "Invalid argument provided" + + +class ModularActionInvocationsRestHandler(PersistentServerConnectionApplication): + """REST handler to return responses given sid/rid.""" + + MODULAR_ACTION_INVOCATIONS_SEARCH = "| `modular_action_invocations({},{})`" + + def __init__(self, command_line, command_arg): + super(ModularActionInvocationsRestHandler, self).__init__() + + def handle(self, args): + logger.debug("ARGS: %s", args) + + args = json.loads(args) + + try: + logger.info("Handling %s request." % args["method"]) + method = "handle_" + args["method"].lower() + if callable(getattr(self, method, None)): + return operator.methodcaller(method, args)(self) + else: + return self.response( + "Invalid method for this endpoint", http_client.METHOD_NOT_ALLOWED + ) + except ValueError as e: + msg = "ValueError: {0}".format(e) + return self.response(msg, http_client.BAD_REQUEST) + except splunk.RESTException as e: + return self.response( + "RESTexception: %s" % e, http_client.INTERNAL_SERVER_ERROR + ) + except Exception as e: + msg = "Unknown exception: %s" % e + logger.exception(msg) + return self.response(msg, http_client.INTERNAL_SERVER_ERROR) + + @staticmethod + def response(msg, status): + """ + Return a dict for endpoint REST response. + + Arguments: + msg -- Result of the request + status -- HTTP response status + """ + + if status < 400: + payload = msg + else: + # replicate controller's jsonresponse format + payload = { + "success": False, + "messages": [{"type": "ERROR", "message": msg}], + "responses": [], + } + return {"status": status, "payload": payload} + + def validate_args(self, sid, rid): + """ + Validate input arguments. + + Arguments: + sid - sid of an event. + rid - rid of an event. + """ + + if (sid and isinstance(sid, basestring)) and ( + rid and isinstance(rid, basestring) + ): + pass + else: + raise ValueError(ModularActionInvocationErrors.ERR_INVALID_ARG) + + return sid, rid + + def get_search_string(self, sid, rid): + """ + Return search string. + + Arguments: + sid - sid of an event. + rid - rid of an event. + + Returns: + Splunk search string. + + Throws: + ValueError. + """ + + if sid and rid: + return self.MODULAR_ACTION_INVOCATIONS_SEARCH.format(sid, rid) + else: + raise ValueError(ModularActionInvocationErrors.ERR_INVALID_ARG) + + def result_to_dict(self, resultset): + """Take a splunk.search.ResultSet object and turn it into a dictionary + that has a simple representation. + + Return: A dictionary of field values. + """ + result = {} + for key, field in resultset.fields.items(): + result[key] = str(field) + return result + + def run_search(self, sid, rid, session_key=None): + """ + Given rid, sid of an event, return action_names, action_mode + of that event. + + Arguments: + sid - sid of an event. + rid - rid of an event. + + Returns: + A dictionary containing results. + + Throws: + splunk.SearchException if the search fails. + """ + + rv = {"success": False, "responses": []} + + search_string = self.get_search_string(sid, rid) + srch = splunk.search.dispatch(search_string, sessionKey=session_key) + + rv["search_id"] = srch.sid + rv["search"] = srch.search + for result in srch.results: + rv["responses"].append(self.result_to_dict(result)) + + rv["success"] = True if rv["responses"] else False + + return rv + + def get_modaction_invocations(self, sid, rid, session_key=None): + """ + Get all the invocations of an event given it's sid and rid. + + Arguments: + sid - Search id. + rid - Result id. + + Returns: A JSON object. + """ + + logger.debug("sid: %s, rid: %s", sid, rid) + + try: + valid_sid, valid_rid = self.validate_args(sid, rid) + except ValueError as exc: + msg = 'Invalid request: sid="{}" rid="{}" exc="{}"'.format(sid, rid, exc) + logger.exception(msg) + return self.response(msg, http_client.BAD_REQUEST) + + try: + return self.response( + self.run_search(valid_sid, valid_rid, session_key), http_client.OK + ) + except Exception as exc: + msg = 'Search for invocations failed: sid="{}" rid="{}" exc="{}"'.format( + valid_sid, valid_rid, exc + ) + logger.exception(msg) + return self.response(msg, http_client.INTERNAL_SERVER_ERROR) + + def handle_get(self, args): + logger.debug("GET ARGS %s", args) + + query = dict(args.get("query", [])) + try: + session_key = args["session"]["authtoken"] + except KeyError: + return self.response( + "Failed to obtain auth token", http_client.UNAUTHORIZED + ) + + required = ["sid", "rid"] + missing = [r for r in required if r not in query] + if missing: + return self.response( + "Missing required arguments: %s" % missing, http_client.BAD_REQUEST + ) + + sid = query.pop("sid") + rid = query.pop("rid") + + return self.get_modaction_invocations(sid, rid, session_key) diff --git a/deps/apps/Splunk_SA_CIM/bin/modaction_queue_handler.py b/deps/apps/Splunk_SA_CIM/bin/modaction_queue_handler.py new file mode 100644 index 000000000..eb3ffcb52 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/bin/modaction_queue_handler.py @@ -0,0 +1,147 @@ +try: + import http.client as http_client +except ImportError: + import httplib as http_client +import json +import operator +import splunk.rest as rest +import sys + +from splunk import RESTException +from splunk.clilib.bundle_paths import make_splunkhome_path +from splunk.persistconn.application import PersistentServerConnectionApplication + +sys.path.append(make_splunkhome_path(["etc", "apps", "Splunk_SA_CIM", "lib"])) +from splunk_sa_cim.log import setup_logger +from splunk_sa_cim.modaction_queue import ( + ModularActionQueueBR, + ModularActionQueueISE, + ModularActionQueueUnauth, + ModularActionQutils, +) + + +logger = setup_logger("modaction_queue_handler") + + +class ModularActionQueueHandler(PersistentServerConnectionApplication): + """REST handler for generating modular action queue api keys.""" + + DEFAULT_MAX_ITEMS = 10 + + def __init__(self, command_line, command_arg): + super(ModularActionQueueHandler, self).__init__() + + try: + self.params = json.loads(command_arg) + except Exception as e: + logger.warn(e) + self.params = {} + + ModularActionQutils.set_log_level(logger, self.params) + + self.modaction_qutils = ModularActionQutils(logger, None) + + def handle(self, args): + """Main function for REST call. + + :param args: A JSON string representing a dictionary + of arguments to the REST call. + :type args: str + + :return A valid REST response. + :rtype dict + + - Routing of GET, POST, etc. happens here. + - All exceptions should be caught here. + """ + + logger.debug("ARGS: %s", args) + args = json.loads(args) + + try: + logger.info("Handling %s request.", args["method"]) + method = "handle_" + args["method"].lower() + if callable(getattr(self, method, None)): + return operator.methodcaller(method, args)(self) + else: + return self.modaction_qutils.error( + "Invalid method for this endpoint", http_client.METHOD_NOT_ALLOWED + ) + except ModularActionQueueBR as e: + msg = "ModularActionException: {0}".format(e) + return self.modaction_qutils.error(msg, http_client.BAD_REQUEST) + except ModularActionQueueUnauth as e: + msg = "ModularActionException: {0}".format(e) + return self.modaction_qutils.error(msg, http_client.UNAUTHORIZED) + except ModularActionQueueISE as e: + msg = "ModularActionException: {0}".format(e) + return self.modaction_qutils.error(msg, http_client.INTERNAL_SERVER_ERROR) + except RESTException as e: + return self.modaction_qutils.error( + "RESTexception: %s" % e, http_client.INTERNAL_SERVER_ERROR + ) + except Exception as e: + msg = "Unknown exception: %s" % e + logger.exception(msg) + return self.modaction_qutils.error(msg, http_client.INTERNAL_SERVER_ERROR) + + def handle_post(self, args): + """Main function for REST call. + + :param args: + A JSON string representing a dictionary of arguments + to the REST call. + :type args: str + + :return A valid REST response. + :rtype dict + + - Routing of GET, POST, etc. happens here. + - All exceptions should be caught here. + """ + # validate encryption + if not self.modaction_qutils.is_connection_encrypted( + args.get("connection", {}) + ): + raise ModularActionQueueISE("Unable to validate encryption") + + # get max items + max_items = self.params.get("max_items") + + if not (isinstance(max_items, int) and max_items > 0): + max_items = self.DEFAULT_MAX_ITEMS + + # get system key + self.modaction_qutils.session_key = args.get("system_authtoken", None) + + # validate payload + payload = args.get("payload", "") + jsonargs = self.modaction_qutils.validate_queue_payload(payload, max_items) + + # get sid list + sids = [jsonitem["sid"] for jsonitem in jsonargs] + + # save + try: + self.modaction_qutils.save_work(sids) + except Exception as e: + logger.exception(e) + logger.warn("Unable to save work") + + # system key + system_key = args.get("system_authtoken", None) + + # post + batch_save_uri = "/servicesNS/nobody/Splunk_SA_CIM/storage/collections/data/cam_queue/batch_save" + + try: + r, c = rest.simpleRequest( + batch_save_uri, sessionKey=system_key, jsonargs=json.dumps(jsonargs) + ) + + return {"status": r.status, "payload": c.decode("utf-8")} + + except Exception as e: + logger.exception(e) + raise ModularActionQueueISE("Unable to queue item(s)") diff --git a/deps/apps/Splunk_SA_CIM/bin/modaction_queue_key_handler.py b/deps/apps/Splunk_SA_CIM/bin/modaction_queue_key_handler.py new file mode 100644 index 000000000..eddbb55a3 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/bin/modaction_queue_key_handler.py @@ -0,0 +1,92 @@ +import binascii + +try: + import http.client as http_client +except ImportError: + import httplib as http_client +import json +import os +import operator +import sys + +from splunk import RESTException +from splunk.clilib.bundle_paths import make_splunkhome_path +from splunk.persistconn.application import PersistentServerConnectionApplication + +sys.path.append(make_splunkhome_path(["etc", "apps", "Splunk_SA_CIM", "lib"])) +from splunk_sa_cim.log import setup_logger +from splunk_sa_cim.modaction_queue import ModularActionQutils + +logger = setup_logger("modaction_queue_handler") + + +class ModularActionQueueKeyHandler(PersistentServerConnectionApplication): + """REST handler for generating modular action queue api keys.""" + + def __init__(self, command_line, command_arg): + super(ModularActionQueueKeyHandler, self).__init__() + + try: + params = json.loads(command_arg) + except Exception as e: + logger.warn(e) + params = {} + + ModularActionQutils.set_log_level(logger, params) + + self.modaction_qutils = ModularActionQutils(logger, None) + + def handle(self, args): + """Main function for REST call. + + :param args: + A JSON string representing a dictionary of arguments + to the REST call. + :type args: str + + :return A valid REST response. + :rtype dict + + - Routing of GET, POST, etc. happens here. + - All exceptions should be caught here. + """ + + logger.debug("ARGS: %s", args) + args = json.loads(args) + + try: + logger.info("Handling %s request.", args["method"]) + method = "handle_" + args["method"].lower() + if callable(getattr(self, method, None)): + return operator.methodcaller(method, args)(self) + else: + return self.modaction_qutils.error( + "Invalid method for this endpoint", http_client.METHOD_NOT_ALLOWED + ) + except RESTException as e: + return self.modaction_qutils.error( + "RESTexception: %s" % e, http_client.INTERNAL_SERVER_ERROR + ) + except Exception as e: + msg = "Unknown exception: %s" % e + logger.exception(msg) + return self.modaction_qutils.error(msg, http_client.INTERNAL_SERVER_ERROR) + + def handle_get(self, args): + """Main function for REST call. + + :param args: + A JSON string representing a dictionary of arguments + to the REST call. + :type args: str + + :return A valid REST response. + :rtype dict + + - Routing of GET, POST, etc. happens here. + - All exceptions should be caught here. + """ + return { + "status": http_client.OK, + "payload": binascii.hexlify(os.urandom(64)).decode("utf-8"), + } diff --git a/deps/apps/Splunk_SA_CIM/bin/modaction_queue_peek_handler.py b/deps/apps/Splunk_SA_CIM/bin/modaction_queue_peek_handler.py new file mode 100644 index 000000000..c1a666684 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/bin/modaction_queue_peek_handler.py @@ -0,0 +1,151 @@ +try: + import http.client as http_client +except ImportError: + import httplib as http_client +import json +import operator +import sys + +from splunk import RESTException +from splunk.clilib.bundle_paths import make_splunkhome_path +from splunk.persistconn.application import PersistentServerConnectionApplication + +sys.path.append(make_splunkhome_path(["etc", "apps", "Splunk_SA_CIM", "lib"])) +from splunk_sa_cim.log import setup_logger +from splunk_sa_cim.modaction_queue import ( + ModularActionQueueBR, + ModularActionQueueISE, + ModularActionQueueUnauth, + ModularActionQutils, +) + +logger = setup_logger("modaction_queue_handler") + +# Python 2+3 basestring +try: + basestring +except NameError: + basestring = str + + +class ModularActionQueuePeekHandler(PersistentServerConnectionApplication): + """REST handler for generating modular action queue api keys.""" + + def __init__(self, command_line, command_arg): + super(ModularActionQueuePeekHandler, self).__init__() + + try: + params = json.loads(command_arg) + except Exception as e: + logger.warn(e) + params = {} + + ModularActionQutils.set_log_level(logger, params) + + self.modaction_qutils = ModularActionQutils(logger, None) + + def handle(self, args): + """Main function for REST call. + + :param args: + A JSON string representing a dictionary + of arguments to the REST call. + :type args: str + + :return A valid REST response. + :rtype dict + + - Routing of GET, POST, etc. happens here. + - All exceptions should be caught here. + """ + + logger.debug("ARGS: %s", args) + args = json.loads(args) + + try: + logger.info("Handling %s request.", args["method"]) + method = "handle_" + args["method"].lower() + if callable(getattr(self, method, None)): + return operator.methodcaller(method, args)(self) + else: + return self.modaction_qutils.error( + "Invalid method for this endpoint", http_client.METHOD_NOT_ALLOWED + ) + except ModularActionQueueBR as e: + msg = "ModularActionException: {0}".format(e) + return self.modaction_qutils.error(msg, http_client.BAD_REQUEST) + except ModularActionQueueUnauth as e: + msg = "ModularActionException: {0}".format(e) + return self.modaction_qutils.error(msg, http_client.UNAUTHORIZED) + except ModularActionQueueISE as e: + msg = "ModularActionException: {0}".format(e) + return self.modaction_qutils.error(msg, http_client.INTERNAL_SERVER_ERROR) + except RESTException as e: + return self.modaction_qutils.error( + "RESTexception: %s" % e, http_client.INTERNAL_SERVER_ERROR + ) + except Exception as e: + msg = "Unknown exception: %s" % e + logger.exception(msg) + return self.modaction_qutils.error(msg, http_client.INTERNAL_SERVER_ERROR) + + def handle_get(self, args): + """Main function for REST call. + + :param args: + A JSON string representing a dictionary of arguments + to the REST call. + :type args: str + + :return A valid REST response. + :rtype dict + + - Routing of GET, POST, etc. happens here. + - All exceptions should be caught here. + """ + # validate encryption + if not self.modaction_qutils.is_connection_encrypted( + args.get("connection", {}) + ): + raise ModularActionQueueISE("Unable to validate encryption") + + # headers + headers = args.get("headers", []) + + # get worker + worker = self.modaction_qutils.get_header_item(headers, "X-API-ID") + + # get api_key + api_key = self.modaction_qutils.get_header_item(headers, "X-API-KEY") + + # get system key + self.modaction_qutils.session_key = args.get("system_authtoken", None) + + # validate api key + if not self.modaction_qutils.is_api_key_valid(worker, api_key): + raise ModularActionQueueUnauth("Unable to validate X-API information") + + # rest_path + rest_path = args.get("rest_path") + if not isinstance("rest_path", basestring): + rest_path = "/peek" + else: + rest_path = rest_path.rstrip("/") + + # get work + if rest_path.endswith("/peek"): + return { + "status": http_client.OK, + "payload": self.modaction_qutils.get_work(worker), + } + # get results + else: + _key = rest_path.split("/")[-1] + + if rest_path.endswith("/peek/{0}".format(_key)): + return { + "status": http_client.OK, + "payload": self.modaction_qutils.get_results(_key), + } + else: + raise ModularActionQueueBR("Invalid rest path specified") diff --git a/deps/apps/Splunk_SA_CIM/bin/relaymodaction.py b/deps/apps/Splunk_SA_CIM/bin/relaymodaction.py new file mode 100644 index 000000000..a76fdf240 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/bin/relaymodaction.py @@ -0,0 +1,442 @@ +import base64 +from contextlib import contextmanager +import json +import logging +import os +import shutil +import requests +import sys + +from requests.exceptions import HTTPError +from subprocess import Popen, PIPE +from threading import Timer + +try: + from urllib.request import quote +except ImportError: + from urllib import quote + +from splunk.util import normalizeBoolean +from splunk.rest import simpleRequest +from splunk.clilib.cli_common import getConfKeyValue +from splunk.clilib.bundle_paths import make_splunkhome_path + +sys.path.append(make_splunkhome_path(["etc", "apps", "Splunk_SA_CIM", "lib"])) +from splunk_sa_cim.log import setup_logger +from splunk_sa_cim.modaction_queue import ModularActionQutils, ModularActionQueueBR +from splunk_sa_cim.modinput import JsonModularInput, Field + +# Python 2+3 basestring +try: + basestring +except NameError: + basestring = str + + +class RelayModAction(JsonModularInput): + QUEUE_REALM = "cam_queue" + ACTION_NAMESPACE = "Splunk_SA_CIM" + SEARCH_INFO_FILENAME = "info.csv" + + def __init__(self, logger): + self.logger = logger + + scheme_args = { + "title": "Modular Action Relay", + "description": "Relay modaction from remote splunk search head.", + "use_external_validation": "true", + "streaming_mode": "json", + "use_single_instance": "false", + } + + args = [ + Field( + "uri", + "Remote Search Head URI", + "Search head.", + required_on_create=True, + required_on_edit=False, + ), + Field( + "description", + "Description", + "Description of the remote Splunk instance.", + required_on_create=True, + required_on_edit=False, + ), + Field( + "username", + "API Key Username", + "Username for your API key, must be unique.", + required_on_create=True, + required_on_edit=False, + ), + Field( + "verify", + "Verify", + "Need to verify certificates between worker and Search Head?", + required_on_create=False, + required_on_edit=False, + ), + Field( + "client_cert", + "Client Certificate", + "Filename of client certificate for verification.", + required_on_create=False, + required_on_edit=False, + ), + ] + + super(RelayModAction, self).__init__(scheme_args, args) + + def normalize_time(self, timestr): + try: + if not isinstance(timestr, int): + if timestr.isdigit(): + return int(timestr) + elif timestr.endswith("s"): + return int(timestr[:-1]) + elif timestr.endswith("m"): + return int(timestr[:-1]) * 60 + elif timestr.endswith("h"): + return int(timestr[:-1]) * 3600 + elif timestr.endswith("d"): + return int(timestr[:-1]) * 86400 + else: + return None + return timestr + except ValueError: + return None + + def get_password(self, realm, username, session_key): + """ + Get password for the user in given realm + """ + namespace = quote(self.ACTION_NAMESPACE, safe="") + key = quote("%s:%s:" % (realm, username), safe="") + uri = "/servicesNS/nobody/%s/storage/passwords/%s" % (namespace, key) + getargs = {"output_mode": "json"} + try: + unused_r, c = simpleRequest( + uri, getargs=getargs, sessionKey=session_key, raiseAllErrors=True + ) + return json.loads(c)["entry"][0]["content"]["clear_password"] + except Exception as e: + self.logger.error( + "Failed to get credential for %s:%s: %s", realm, username, e + ) + return None + + def request(self, uri, method, worker, password, verify, cert, params="", data=""): + headers = {"X-API-ID": worker, "X-API-KEY": password} + if method == "get": + return requests.get( + uri, params=params, headers=headers, verify=verify, cert=cert + ) + elif method == "post": + return requests.post( + uri, data=data, headers=headers, verify=verify, cert=cert + ) + + def get_actions(self, target, worker, password, verify, client_cert=""): + """ + Get a queue of actions of specified worker + """ + uri = "%s/services/alerts/modaction_queue/peek" % target + r = self.request( + uri, + "get", + worker, + password, + verify, + client_cert, + params={"output_mode": "json"}, + ) + if r.status_code != requests.codes.ok: + self.logger.error("Failed to get actions for %s: %s", worker, r.text) + return [] + self.logger.info("Successfully retrieved actions for %s", worker) + return r.json() + + def get_local_alert_actions(self, session_key): + getargs = { + "output_mode": "json", + "search": "is_custom=1 AND payload_format=json", + "count": 0, + } + try: + unused_r, c = simpleRequest( + "alerts/alert_actions", + getargs=getargs, + sessionKey=session_key, + raiseAllErrors=True, + ) + except Exception as e: + self.logger.error("Failed to get local alert actions: %s", e) + return {} + + local_alert_actions = {} + for action in json.loads(c)["entry"]: + # check if the action supports worker, if yes, add to the return dictionary + name = action["name"] + content = action["content"] + try: + _cam = json.loads(content["param._cam"]) + if normalizeBoolean(_cam["supports_workers"]): + local_alert_actions[name] = action + except Exception: + continue + + return local_alert_actions + + @contextmanager + def ensure_local_dispatch_dir(self, stanza, sid, mode=0o755): + """ + Ensure an emulated local dispatch directory for a given stanza exists + under checkpoint_dir for the duration of the enclosing code block. + """ + destdir = os.path.join(self.checkpoint_dir, stanza, sid) + if not os.path.isdir(destdir): + os.makedirs(destdir, mode) + + try: + yield destdir + finally: + try: + shutil.rmtree(os.path.realpath(destdir)) + except Exception as e: + self.logger.error("Unable to cleanup search results directory: %s", e) + + def fetch_results( + self, target, key, destdir, file_name, worker, password, verify, client_cert="" + ): + dest = os.path.join(destdir, file_name) + uri = "%s/services/alerts/modaction_queue/peek/%s" % (target, key) + r = self.request(uri, "get", worker, password, verify, client_cert) + if r.status_code != requests.codes.ok: + r.raise_for_status() + self.logger.info( + "Successfully fetched results_file content for action with key %s for worker %s", + key, + worker, + ) + try: + # write-binary usage intentional here + with open(dest, "wb") as f: + f.write(base64.b64decode(r.text)) + return dest + except (OSError, IOError) as e: + self.logger.error("Failed to save results file: %s", e) + return None + + def save_search_info(self, b64info, destdir): + if not isinstance(b64info, basestring): + return + + dest = os.path.join(destdir, self.SEARCH_INFO_FILENAME) + try: + # write-binary usage intentional here + with open(dest, "wb") as f: + f.write(base64.b64decode(b64info)) + except (OSError, IOError) as e: + self.logger.error("Failed to save info file: %s", e) + return dest + + def dequeue(self, target, key, worker, password, verify, client_cert=""): + uri = "%s/services/alerts/modaction_queue/dequeue" % target + r = self.request( + uri, "post", worker, password, verify, client_cert, data=json.dumps([key]) + ) + if r.status_code != requests.codes.ok: + self.logger.error("Exception when updating cam queue: %s", r.text) + self.logger.info( + "Successfully dequeued action with key %s for worker %s", key, worker + ) + return r + + def get_action_payload(self, settings): + payload = json.loads(settings) + payload["configuration"].pop("_cam_workers", None) + if "sid" not in payload: + raise ValueError("Missing sid") + if "results_file" not in payload: + raise ValueError("Missing results file") + return payload + + def run_action(self, cmd, settings, maxtime): + p = Popen(cmd, stdin=PIPE, stdout=PIPE, stderr=PIPE) + + def kill(): + self.logger.error("modaction killed due to timeout %s seconds", maxtime) + p.kill() + + timer = Timer(maxtime, kill) + try: + timer.start() + out, err = p.communicate(input=json.dumps(settings).encode("utf-8")) + finally: + timer.cancel() + self.logger.info("action output: %s", out) + self.logger.info("action err: %s", err) + return p.returncode + + def normalize_cert_path(self, filename): + if filename in ["", "..", None] or os.path.basename(filename) != filename: + return "" + return make_splunkhome_path(["etc", "apps", "Splunk_SA_CIM", "auth", filename]) + + def normalize_verify(self, verify): + normalized = normalizeBoolean(verify) + if normalized in [True, False]: + return normalized + if normalized is None or normalized.strip() == "": + return False + return self.normalize_cert_path(verify) + + def validate_action(self, action_name, alert_actions): + alert_action = alert_actions.get(action_name) + if alert_action is None: + return None, None + + maxtime = alert_action["content"]["maxtime"] + normalized_maxtime = self.normalize_time(maxtime) + return alert_action, normalized_maxtime + + def get_python_cmd(self, action_name, alert_actions): + """ + Get python command - based off alert action python.version setting defined in alert_actions.conf + """ + version = None + try: + version = alert_actions.get(action_name)["content"].get( + "python.version", "python" + ) + except Exception: + self.logger.error( + 'unable to determine python version for alert_action="%s"', action_name + ) + + if version == "python3": + return "python3" + elif version == "python2": + return "python2" + + return "python" + + def run(self, params): + stanza_name = params.get("name").split("://", 1)[1] + username = params["username"] + session_key = self._input_config.session_key + password = self.get_password(self.QUEUE_REALM, username, session_key) + if password is None: + self.logger.error("couldn't get password for %s", username) + return + + worker = getConfKeyValue("server", "general", "serverName") + client_cert = self.normalize_cert_path(params["client_cert"]) + target = params["uri"] + verify = self.normalize_verify(params["verify"]) + + if verify not in [True, False] and not os.path.isfile(client_cert): + self.logger.error("invalid verify: %s", params["verify"]) + return + + if client_cert != "" and not os.path.isfile(client_cert): + self.logger.error("invalid client cert: %s", params["client_cert"]) + return + + actions = self.get_actions(target, worker, password, verify, client_cert) + alert_actions = self.get_local_alert_actions(session_key) + self.logger.info("local alert actions: %s", alert_actions.keys()) + + for action in actions: + search_info = action.pop("info", None) + action_name = action["action_name"] + self.logger.info("original action: %s", action_name) + key = None + try: + key = ModularActionQutils.build_key( + {"worker": worker, "sid": action["sid"], "action_name": action_name} + ) + payload = self.get_action_payload(action["settings"]) + except (KeyError, ValueError, ModularActionQueueBR): + self.logger.exception( + "Invalid modaction received: %s", json.dumps(action, indent=2) + ) + if key: + self.dequeue(target, key, worker, password, verify, client_cert) + continue + + sid = payload["sid"] + alert_action, normalized_maxtime = self.validate_action( + action_name, alert_actions + ) + if alert_action is None: + self.logger.error("Modular action %s not found", action_name) + self.dequeue(target, key, worker, password, verify, client_cert) + continue + elif normalized_maxtime is None: + self.logger.error( + "Invalid maxtime received: %s", alert_action["content"]["maxtime"] + ) + self.dequeue(target, key, worker, password, verify, client_cert) + continue + + payload["server_uri"] = target + file_name = os.path.basename(payload["results_file"]) + results_file = None + with self.ensure_local_dispatch_dir(stanza_name, sid) as dispatch_dir: + try: + results_file = self.fetch_results( + target, + key, + dispatch_dir, + file_name, + worker, + password, + verify, + client_cert, + ) + except HTTPError as e: + self.logger.error("Failed to fetch results: %s", e) + if e.response.status_code == requests.codes.not_found: + self.dequeue(target, key, worker, password, verify, client_cert) + + if results_file is not None: + self.save_search_info(search_info, dispatch_dir) + python_cmd = self.get_python_cmd(action_name, alert_actions) + payload["results_file"] = results_file + name = alert_action["name"] + app = alert_action["acl"]["app"] + script = make_splunkhome_path( + ["etc", "apps", app, "bin", "%s.py" % name] + ) + cmd = [ + make_splunkhome_path(["bin", "splunk"]), + "cmd", + python_cmd, + script, + "--execute", + ] + try: + returncode = self.run_action(cmd, payload, normalized_maxtime) + if returncode != 0: + self.logger.info( + "Modular alert exit with code %d", returncode + ) + self.dequeue(target, key, worker, password, verify, client_cert) + except Exception as e: + self.logger.error( + "Exception when running modular alert %s: %s", + stanza_name, + e, + ) + + +if __name__ == "__main__": + logger = setup_logger("relaymodaction", level=logging.INFO) + try: + modinput = RelayModAction(logger=logger) + modinput.execute() + except Exception: + logger.exception("Error") diff --git a/deps/apps/Splunk_SA_CIM/default/alert_actions.conf b/deps/apps/Splunk_SA_CIM/default/alert_actions.conf new file mode 100644 index 000000000..a62a569be --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/alert_actions.conf @@ -0,0 +1,3 @@ + +param._cam = +param._cam_workers = \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/app.conf b/deps/apps/Splunk_SA_CIM/default/app.conf new file mode 100644 index 000000000..d3d8a72e8 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/app.conf @@ -0,0 +1,48 @@ +## Splunk app configuration file + +[install] +is_configured = true +state = enabled +build = 6 + +[launcher] +author=Splunk +description=The Common Information Model add-on provides a collection of datamodels that make building apps and add-ons easier. +version=4.20.0 + +[triggers] +# unchanged except at upgrade +reload.app_permissions = simple +# correlationsearches.csv: reloaded via REST call to handleReload via administrative saved search +# correlationsearches.conf: reloaded via REST calls to handleList +reload.analyticstories = simple +reload.correlationsearches = simple +reload.es_investigations = simple +# handleList will call reload +reload.governance = simple +reload.identityLookup = simple +# handleList will call reload +reload.log_review = simple +reload.managed_configurations = simple +reload.reviewstatuses = simple +# handleList will call reload +reload.suppressions = simple +# handleList will call reload +reload.sequence_templates = simple + +# configuration files from optional apps +reload.eventgen = simple + +# legacy configuration files +reload.aggregate = simple +reload.api = simple +reload.postprocess = simple +reload.tsidx_retention = simple + +[ui] +is_visible = false +label = Splunk Common Information Model +setup_view = cim_setup + +[package] +id = Splunk_SA_CIM diff --git a/deps/apps/Splunk_SA_CIM/default/authorize.conf b/deps/apps/Splunk_SA_CIM/default/authorize.conf new file mode 100644 index 000000000..6339c2b5c --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/authorize.conf @@ -0,0 +1,2 @@ + +[capability::edit_cam_queue] \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/collections.conf b/deps/apps/Splunk_SA_CIM/default/collections.conf new file mode 100644 index 000000000..5aec65b0a --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/collections.conf @@ -0,0 +1,14 @@ + +[cam_queue] +## _key (worker + @@ + sha1(action_name+sid)) +field.time = time +field.sid = string +field.action_name = string +## info b64(csv) +field.info = string +field.worker = string +## settings (original payload) +field.settings = string + +accelerated_fields.default = {"worker": 1} +accelerated_fields.sid = {"sid": 1} diff --git a/deps/apps/Splunk_SA_CIM/default/commands.conf b/deps/apps/Splunk_SA_CIM/default/commands.conf new file mode 100644 index 000000000..f95ee1557 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/commands.conf @@ -0,0 +1,10 @@ + +## Usage: | datamodelsimple type= datamodel= object= nodename= +[datamodelsimple] +filename = datamodelsimple.py +passauth = true +run_in_preview = false +retainsevents = false +streaming = false +supports_multivalues = false +python.version = python3 diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Alerts.json b/deps/apps/Splunk_SA_CIM/default/data/models/Alerts.json new file mode 100644 index 000000000..158f893ab --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Alerts.json @@ -0,0 +1,468 @@ +{ + "modelName": "Alerts", + "displayName": "Alerts", + "description": "Alerts Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "alert" + ] + }, + "objectName": "Alerts", + "displayName": "Alerts", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is deprecated in favor of 'description'." + }, + "fieldName": "body", + "displayName": "body", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The description of the alert event." + }, + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the destination object, such as 'instance', 'storage', 'firewall'." + }, + "fieldName": "dest_type", + "displayName": "dest_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier of the alert event." + }, + "fieldName": "id", + "displayName": "id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The MITRE ATT&CK technique ID of the alert event, searchable at https:\/\/attack.mitre.org\/techniques" + }, + "fieldName": "mitre_technique_id", + "displayName": "mitre_technique_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The human-friendly title of the alert event, such as 'API GetAccountPasswordPolicy was invoked using root credentials.' Split by signature_id when aggregating alert events by types." + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the source object, such as 'instance', 'storage', 'firewall'." + }, + "fieldName": "src_type", + "displayName": "src_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is deprecated in favor of 'signature'." + }, + "fieldName": "subject", + "displayName": "subject", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user involved in the alert event. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user involved in the alert event. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user involved in the alert event. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The account associated with the alert event." + }, + "fieldName": "vendor_account", + "displayName": "vendor_account", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The data center region involved in the alert event, such as us-west-2." + }, + "fieldName": "vendor_region", + "displayName": "vendor_region", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Alerts_fillnull_app", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system, service, or application that generated the alert event. Examples include, but are not limited to the following: GuardDuty, SecurityCenter, 3rd party services, win:app:trendmicro, vmware, nagios.", + "recommended": true + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(app) OR app=\"\",sourcetype,app)" + }, + { + "calculationID": "Alerts_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The object that is the 'target' of the alert event. Examples include an email address, SNMP trap, or virtual machine id. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Alerts_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the alert event. Note: This field is a string. Specific values are required. Use the severity_id field for severity ID fields that are integer data types. Use vendor_severity for the vendor's own human readable strings (such as 'Good', 'Bad', 'Really Bad').", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational", + "unknown" + ], + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "Alerts_fillnull_signature_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor specific policy or rule that generated the alert event, such as 'Policy:IAMUser/RootCredentialUsage.'", + "recommended": true + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature_id) OR signature_id=\"\",\"unknown\",signature_id)" + }, + { + "calculationID": "Alerts_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The object that is the 'actor' of the alert event. You can alias or extract this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "Alerts_fillnull_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The alert event type.", + "expected_values": [ + "alarm", + "alert", + "event", + "task", + "warning", + "unknown" + ], + "recommended": true + }, + "fieldName": "type", + "displayName": "type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(type) OR type=\"\",\"unknown\",type)" + }, + { + "calculationID": "Alerts_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user involved in the alert event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Alerts_fillnull_user_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user_name of user involved in the alert event.", + "recommended": true + }, + "fieldName": "user_name", + "displayName": "user_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user_name) OR user_name=\"\",\"unknown\",user_name)" + } + ], + "constraints": [ + { + "search": "(`cim_Alerts_indexes`) tag=alert" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Application_State.json b/deps/apps/Splunk_SA_CIM/default/data/models/Application_State.json new file mode 100644 index 000000000..68dd7a48c --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Application_State.json @@ -0,0 +1,502 @@ +{ + "modelName": "Application_State", + "displayName": "Application State (Deprecated)", + "description": "This model has been deprecated", + "editable": false, + "objects": [ + { + "comment": { + "ta_relevant": false + }, + "objectName": "All_Application_State", + "displayName": "All Application State", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user account the service is running as, such as System or httpdsvc." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Application_State_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The compute resource where the service is installed. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Application_State_fillnull_process", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of a process or service file, such as sqlsrvr.exe or httpd. Note: This field is not appropriate for service or daemon names, such as SQL Server or Apache Web Server. Service or daemon names belong to the service field.", + "recommended": true + }, + "fieldName": "process", + "displayName": "process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(process) OR process=\"\",\"unknown\",process)" + }, + { + "calculationID": "All_Application_State_fillnull_process_name", + "calculationType": "Rex", + "outputFields": [ + { + "comment": { + "description": "The name of a process.", + "ta_relevant": false + }, + "fieldName": "process_name", + "displayName": "process_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "inputField": "process", + "expression": "^\\s*(?[^\\s]+)" + } + ], + "constraints": [ + { + "search": "(`cim_Application_State_indexes`) (tag=listening tag=port) OR (tag=process tag=report) OR (tag=service tag=report)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "listening", + "port" + ] + }, + "objectName": "Ports", + "displayName": "Ports", + "parentName": "All_Application_State", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Ports_fillnull_dest_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Network ports communicated to by the process, such as 53.", + "recommended": true + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnum(dest_port),dest_port,0)" + }, + { + "calculationID": "Ports_fillnull_transport", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The network ports listened to by the application process, such as tcp, udp, etc.", + "recommended": true + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(transport) OR transport=\"\",\"unknown\",lower(transport))" + }, + { + "calculationID": "Ports_transport_dest_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Calculated as transport\/dest_port, such as tcp\/53.", + "ta_relevant": false + }, + "fieldName": "transport_dest_port", + "displayName": "transport_dest_port", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(transport_dest_port) OR transport_dest_port=\"\",split(replace(mvjoin(mvzip(transport,dest_port),\"|\"),\",\",\"\/\"),\"|\"),transport_dest_port)" + } + ], + "constraints": [ + { + "search": "tag=listening tag=port" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "process", + "report" + ] + }, + "objectName": "Processes", + "displayName": "Processes", + "parentName": "All_Application_State", + "fields": [ + { + "comment": { + "description": "CPU Load in megahertz." + }, + "fieldName": "cpu_load_mhz", + "displayName": "cpu_load_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "CPU Load in percent." + }, + "fieldName": "cpu_load_percent", + "displayName": "cpu_load_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "CPU Time." + }, + "fieldName": "cpu_time", + "displayName": "cpu_time", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Memory used in bytes." + }, + "fieldName": "mem_used", + "displayName": "mem_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=process tag=report" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "service", + "report" + ] + }, + "objectName": "Services", + "displayName": "Services", + "parentName": "All_Application_State", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Services_fillnull_service", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the service, such as SQL Server or Apache Web Server. Note: This field is not appropriate for filenames, such as sqlsrvr.exe or httpd. Filenames should belong to the process field instead. Also, note that field is a string. Use the service_id field for service ID fields that are integer data types.", + "recommended": true + }, + "fieldName": "service", + "displayName": "service", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service) OR service=\"\",\"unknown\",service)" + }, + { + "calculationID": "Services_fillnull_service_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A numeric indicator for a service.", + "recommended": true + }, + "fieldName": "service_id", + "displayName": "service_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service_id) OR service_id=\"\",\"unknown\",service_id)" + }, + { + "calculationID": "Services_fillnull_start_mode", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The start mode for the service.", + "expected_values": [ + "disabled", + "manual", + "auto" + ], + "recommended": true + }, + "fieldName": "start_mode", + "displayName": "start_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(start_mode) OR start_mode=\"\",\"unknown\",start_mode)" + }, + { + "calculationID": "Services_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The status of the service.", + "expected_values": [ + "critical", + "started", + "stopped", + "warning" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + } + ], + "constraints": [ + { + "search": "tag=service tag=report" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Authentication.json b/deps/apps/Splunk_SA_CIM/default/data/models/Authentication.json new file mode 100644 index 000000000..fb42d2604 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Authentication.json @@ -0,0 +1,752 @@ +{ + "modelName": "Authentication", + "displayName": "Authentication", + "description": "Authentication Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "authentication" + ] + }, + "objectName": "Authentication", + "displayName": "Authentication", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The method used to authenticate the request such as SAML, FIDO, or MFA." + }, + "fieldName": "authentication_method", + "displayName": "authentication_method", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The service used to authenticate the request such as Okta, or ActiveDirectory" + }, + "fieldName": "authentication_service", + "displayName": "authentication_service", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the authentication target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the authentication target, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The name of the Active Directory used by the authentication target, if applicable." + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the authentication target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the authentication event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The human-readable message associated with the authentication action (success or failure)." + }, + "fieldName": "reason", + "displayName": "reason", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the authentication event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A human-readable signature name." + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the authentication source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the authentication source, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The name of the Active Directory used by the authentication source, if applicable." + }, + "fieldName": "src_nt_domain", + "displayName": "src_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the authentication source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The unique id of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed." + }, + "fieldName": "src_user_id", + "displayName": "src_user_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The role of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed." + }, + "fieldName": "src_user_role", + "displayName": "src_user_role", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed." + }, + "fieldName": "src_user_type", + "displayName": "src_user_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user agent through which the request was made, such as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) or aws-cli/2.0.0 Python/3.7.4 Darwin/18.7.0 botocore/2.0.0dev4." + }, + "fieldName": "user_agent", + "displayName": "user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The unique id of the user involved in the event. For authentication privilege escalation events, this should represent the user targeted by the escalation." + }, + "fieldName": "user_id", + "displayName": "user_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user involved in the event, or who initiated the event. For authentication privilege escalation events, this should represent the user priority targeted by the escalation. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The role of the user involved in the event, or who initiated the event. For authentication privilege escalation events, this should represent the user role targeted by the escalation." + }, + "fieldName": "user_role", + "displayName": "user_role", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the user involved in the event or who initiated the event, such as IAMUser, Admin, or System. For authentication privilege escalation events, this should represent the user type targeted by the escalation." + }, + "fieldName": "user_type", + "displayName": "user_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The account that manages the user that initiated the request." + }, + "fieldName": "vendor_account", + "displayName": "vendor_account", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Authentication_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action performed on the resource.", + "expected_values": [ + "success", + "failure", + "pending", + "error" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Authentication_fillnull_app", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The application involved in the event, such as ssh, splunk, win:local.", + "recommended": true + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(app) OR app=\"\",sourcetype,app)" + }, + { + "calculationID": "Authentication_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source involved in the authentication. In the case of endpoint protection authentication the src is the client. You can alias this from more specific fields, such as src_host, src_ip, or src_nt_host.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "Authentication_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "In privilege escalation events, src_user represents the user who initiated the privilege escalation. This field is unnecessary when an escalation has not been performed.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)" + }, + { + "calculationID": "Authentication_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The target involved in the authentication. You can alias this from more specific fields, such as dest_host, dest_ip, dest_mac, or dest_nt_host.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Authentication_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the user involved in the event, or who initiated the event. For authentication privilege escalation events this should represent the user targeted by the escalation.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + } + ], + "constraints": [ + { + "search": "(`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication" + ] + }, + "objectName": "Failed_Authentication", + "displayName": "Failed Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"failure\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication" + ] + }, + "objectName": "Successful_Authentication", + "displayName": "Successful Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"success\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "default" + ] + }, + "objectName": "Default_Authentication", + "displayName": "Default Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=\"default\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "default" + ] + }, + "objectName": "Failed_Default_Authentication", + "displayName": "Failed Default Authentication", + "parentName": "Default_Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"failure\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "default" + ] + }, + "objectName": "Successful_Default_Authentication", + "displayName": "Successful Default Authentication", + "parentName": "Default_Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"success\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "insecure" + ] + }, + "objectName": "Insecure_Authentication", + "displayName": "Insecure Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=\"insecure\" OR tag=\"cleartext\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "privileged" + ] + }, + "objectName": "Privileged_Authentication", + "displayName": "Privileged Authentication", + "parentName": "Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=\"privileged\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "privileged" + ] + }, + "objectName": "Failed_Privileged_Authentication", + "displayName": "Failed Privileged Authentication", + "parentName": "Privileged_Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"failure\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "authentication", + "privileged" + ] + }, + "objectName": "Successful_Privileged_Authentication", + "displayName": "Successful Privileged Authentication", + "parentName": "Privileged_Authentication", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"success\"" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Certificates.json b/deps/apps/Splunk_SA_CIM/default/data/models/Certificates.json new file mode 100644 index 000000000..9610f2535 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Certificates.json @@ -0,0 +1,696 @@ +{ + "modelName": "Certificates", + "displayName": "Certificates", + "description": "Certificates Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "certificate" + ] + }, + "objectName": "All_Certificates", + "displayName": "All Certificates", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The target in the certificate management event." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the target, such as email_server or SOX-compliant. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk Enterprise Security.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The port number of the target." + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the target.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the certificate management event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took, in seconds, to receive a response in the certificate management event, if applicable." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source involved in the certificate management event. You can alias this from more specific fields, such as src_host, src_ip, or src_nt_host." + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the certificate management source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the certificate management source, such as email_server or SOX-compliant. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk Enterprise Security.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The port number of the source." + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the certificate management source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The transport protocol of the Network Traffic involved with this certificate." + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(`cim_Certificates_indexes`) tag=certificate" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "certificate", + "ssl" + ] + }, + "objectName": "SSL", + "displayName": "Transport Layer Security", + "parentName": "All_Certificates", + "fields": [ + { + "comment": { + "description": "The expiry time of the certificate.", + "recommended": true + }, + "fieldName": "ssl_end_time", + "displayName": "ssl_end_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the signature engine that created the certificate." + }, + "fieldName": "ssl_engine", + "displayName": "ssl_engine", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's email address." + }, + "fieldName": "ssl_issuer_email", + "displayName": "ssl_issuer_email", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's locality." + }, + "fieldName": "ssl_issuer_locality", + "displayName": "ssl_issuer_locality", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's state of residence." + }, + "fieldName": "ssl_issuer_state", + "displayName": "ssl_issuer_state", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's organization." + }, + "fieldName": "ssl_issuer_organization", + "displayName": "ssl_issuer_organization", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's organizational unit." + }, + "fieldName": "ssl_issuer_unit", + "displayName": "ssl_issuer_unit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate issuer's street address." + }, + "fieldName": "ssl_issuer_street", + "displayName": "ssl_issuer_street", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the ssl certificate." + }, + "fieldName": "ssl_name", + "displayName": "ssl_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The Object Identification Numbers of the certificate's policies in a comma separated string." + }, + "fieldName": "ssl_policies", + "displayName": "ssl_policies", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate's public key." + }, + "fieldName": "ssl_publickey", + "displayName": "ssl_publickey", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The algorithm used to create the public key." + }, + "fieldName": "ssl_publickey_algorithm", + "displayName": "ssl_publickey_algorithm", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate's serial number.", + "recommended": true + }, + "fieldName": "ssl_serial", + "displayName": "ssl_serial", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The session identifier for this certificate." + }, + "fieldName": "ssl_session_id", + "displayName": "ssl_session_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The algorithm used by the Certificate Authority to sign the certificate." + }, + "fieldName": "ssl_signature_algorithm", + "displayName": "ssl_signature_algorithm", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This is the start date and time for this certificate's validity.", + "recommended": true + }, + "fieldName": "ssl_start_time", + "displayName": "ssl_start_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's e-mail address." + }, + "fieldName": "ssl_subject_email", + "displayName": "ssl_subject_email", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's locality." + }, + "fieldName": "ssl_subject_locality", + "displayName": "ssl_subject_locality", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's state of residence." + }, + "fieldName": "ssl_subject_state", + "displayName": "ssl_subject_state", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's organization." + }, + "fieldName": "ssl_subject_organization", + "displayName": "ssl_subject_organization", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's organizational unit." + }, + "fieldName": "ssl_subject_unit", + "displayName": "ssl_subject_unit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The certificate owner's street address." + }, + "fieldName": "ssl_subject_street", + "displayName": "ssl_subject_street", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The ssl version of this certificate." + }, + "fieldName": "ssl_version", + "displayName": "ssl_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "SSL_fillnull_ssl_hash", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The hash of the certificate.", + "recommended": true + }, + "fieldName": "ssl_hash", + "displayName": "ssl_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(ssl_hash) OR ssl_hash=\"\",\"unknown\",ssl_hash)" + }, + { + "calculationID": "SSL_fillnull_ssl_issuer", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The certificate issuer's RFC2253 Distinguished Name.", + "recommended": true + }, + "fieldName": "ssl_issuer", + "displayName": "ssl_issuer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ssl_issuer) OR ssl_issuer=\"\",\"unknown\",ssl_issuer)" + }, + { + "calculationID": "SSL_fillnull_ssl_issuer_common_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The certificate issuer's common name.", + "recommended": true + }, + "fieldName": "ssl_issuer_common_name", + "displayName": "ssl_issuer_common_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ssl_issuer_common_name) OR ssl_issuer_common_name=\"\",\"unknown\",ssl_issuer_common_name)" + }, + { + "calculationID": "SSL_ssl_issuer_email_domain", + "calculationType": "Rex", + "inputField": "ssl_issuer_email", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the certificate issuer's email address.", + "recommended": true + }, + "fieldName": "ssl_issuer_email_domain", + "displayName": "ssl_issuer_email_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^.*@(?.+)$" + }, + { + "calculationID": "SSL_fillnull_ssl_subject", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The certificate owner's RFC2253 Distinguished Name.", + "recommended": true + }, + "fieldName": "ssl_subject", + "displayName": "ssl_subject", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ssl_subject) OR ssl_subject=\"\",\"unknown\",ssl_subject)" + }, + { + "calculationID": "SSL_fillnull_ssl_subject_common_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The certificate subject's common name.", + "recommended": true + }, + "fieldName": "ssl_subject_common_name", + "displayName": "ssl_subject_common_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ssl_subject_common_name) OR ssl_subject_common_name=\"\",\"unknown\",ssl_subject_common_name)" + }, + { + "calculationID": "SSL_ssl_subject_email_domain", + "calculationType": "Rex", + "inputField": "ssl_subject_email", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the certificate subject's email address.", + "recommended": true + }, + "fieldName": "ssl_subject_email_domain", + "displayName": "ssl_subject_email_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^.*@(?.+)$" + }, + { + "calculationID": "SSL_0validity_window", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The length of time, in seconds, for which this certificate is valid.", + "ta_relevant": false + }, + "fieldName": "ssl_validity_window", + "displayName": "ssl_validity_window", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(ssl_end_time) AND isnum(ssl_start_time),ssl_end_time-ssl_start_time,null())" + }, + { + "calculationID": "SSL_1is_valid", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Indicator of whether the ssl certificate is valid or not.", + "expected_values": [ + "true", + "false", + "1", + "0" + ], + "ta_relevant": false + }, + "fieldName": "ssl_is_valid", + "displayName": "ssl_is_valid", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(match(ssl_is_valid, \"^(1|[Tt]|[Tt][Rr][Uu][Ee])$\"),1,match(ssl_is_valid, \"^(0|[Ff]|[Ff][Aa][Ll][Ss][Ee])$\"),0,isnum(ssl_end_time) AND isnum(ssl_start_time) AND _time>=ssl_start_time AND _time<=ssl_end_time,1,isnum(ssl_end_time) AND isnum(ssl_start_time),0,1=1,null())" + } + ], + "constraints": [ + { + "search": "(tag=ssl OR tag=tls)" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Change.json b/deps/apps/Splunk_SA_CIM/default/data/models/Change.json new file mode 100644 index 000000000..833463fa4 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Change.json @@ -0,0 +1,1131 @@ +{ + "modelName": "Change", + "displayName": "Change", + "description": "Change Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "change" + ] + }, + "objectName": "All_Changes", + "displayName": "All Changes", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user agent through which the request was made, such as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) or aws-cli/2.0.0 Python/3.7.4 Darwin/18.7.0 botocore/2.0.0dev4." + }, + "fieldName": "user_agent", + "displayName": "user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of the user involved in the event or who initiated the event, such as IAMUser, Admin, or System. For account management events, this should represent the type of the user changed by the request." + }, + "fieldName": "user_type", + "displayName": "user_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The account associated with the change." + }, + "fieldName": "vendor_account", + "displayName": "vendor_account", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The data center region where the change occurred, such as us-west-2." + }, + "fieldName": "vendor_region", + "displayName": "vendor_region", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Changes_fillnull_change_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of change, such as filesystem or AAA (authentication, authorization, and accounting).", + "expected_values": [ + "restart" + ], + "recommended": true + }, + "fieldName": "change_type", + "displayName": "change_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(change_type) OR change_type=\"\",\"unknown\",change_type)" + }, + { + "calculationID": "All_Changes_fillnull_command", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The command that initiated the change.", + "recommended": true + }, + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(command) OR command=\"\",\"unknown\",if(sourcetype==\"audittrail\",Operation.\" \".ObjectName,command))" + }, + { + "calculationID": "All_Changes_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The resource where change occurred. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Changes_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that reported the change, if applicable, such as a FIP or CIM server. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "All_Changes_fillnull_object", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Name of the affected object on the resource, such as a router interface, user account, or server volume.", + "recommended": true + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object) OR object=\"\",\"unknown\",object)" + }, + { + "calculationID": "All_Changes_fillnull_object_attrs", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The attributes that were updated on the updated resource object, if applicable.", + "recommended": true + }, + "fieldName": "object_attrs", + "displayName": "object_attrs", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(object_attrs) OR object_attrs=\"\",\"unknown\",object_attrs)" + }, + { + "calculationID": "All_Changes_fillnull_object_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Generic name for the class of the updated resource object. Expected values may be specific to an app.", + "expected_values": [ + "directory", + "file", + "group", + "registry", + "user" + ], + "recommended": true + }, + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "All_Changes_fillnull_object_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unique updated resource object ID as presented to the system, if applicable. For example, a SID, UUID, or GUID value.", + "recommended": true + }, + "fieldName": "object_id", + "displayName": "object_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_id) OR object_id=\"\",\"unknown\",object_id)" + }, + { + "calculationID": "All_Changes_fillnull_object_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path of the modified resource object, if applicable, such as a file, directory, or volume.", + "recommended": true + }, + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_path) OR object_path=\"\",\"unknown\",object_path)" + }, + { + "calculationID": "All_Changes_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Status of the update.", + "expected_values": [ + "success", + "failure" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + }, + { + "calculationID": "All_Changes_fillnull_result", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor-specific result of a change, or clarification of an action status. For example, status=failure may be accompanied by result=blocked by policy or result=disk full. Note: result is a string. Use msg_severity_id for severity ID fields that are integer data types.", + "expected_values": [ + "lockout" + ], + "recommended": true + }, + "fieldName": "result", + "displayName": "result", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(result) AND result!=\"\",result,if(isnotnull(signature) AND signature!=\"\",signature,\"unknown\"))" + }, + { + "calculationID": "All_Changes_fillnull_result_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A result indicator for an action status.", + "recommended": true + }, + "fieldName": "result_id", + "displayName": "result_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(result_id) AND result_id!=\"\",result_id,if(isnotnull(signature_id) AND signature_id!=\"\",signature_id,-1))" + }, + { + "calculationID": "All_Changes_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The resource where the change was originated. You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "All_Changes_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user or entity performing the change. For account changes, this is the account that was changed (see src_user for user or entity performing the change).", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "All_Changes_fillnull_user_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user name of the user or entity performing the change. For account changes, this is the account that was changed (see src_user_name for user or entity performing the change).", + "recommended": true + }, + "fieldName": "user_name", + "displayName": "user_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user_name) OR user_name=\"\",\"unknown\",user_name)" + }, + { + "calculationID": "All_Changes_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product or service that detected the change. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + }, + { + "calculationID": "All_Changes_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action attempted on the resource, regardless of success or failure.", + "expected_values": [ + "acl_modified", + "cleared", + "created", + "deleted", + "modified", + "read", + "stopped", + "updated", + "started", + "restarted" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + } + ], + "constraints": [ + { + "search": "(`cim_Change_indexes`) tag=change NOT (object_category=file OR object_category=directory OR object_category=registry)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "audit" + ] + }, + "objectName": "Auditing_Changes", + "displayName": "Auditing Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=audit" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Endpoint_Changes", + "displayName": "Endpoint Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=endpoint" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Endpoint_Restarts", + "displayName": "Endpoint Restarts", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=modified change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Other_Endpoint_Changes", + "displayName": "Other Endpoint Changes", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "NOT change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "network" + ] + }, + "objectName": "Network_Changes", + "displayName": "Network Changes", + "parentName": "All_Changes", + "fields": [ + { + "comment": { + "description": "For network events, the outgoing traffic for a specific destination IP address range. Specify a single IP address, or an IP address range in CIDR notation (for example, 203.0.113.5/32)", + "ta_relevant": false + }, + "fieldName": "dest_ip_range", + "displayName": "dest_ip_range", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents destination port or range. For example, 80 or 8000 - 8080 or 80,443", + "ta_relevant": false + }, + "fieldName": "dest_port_range", + "displayName": "dest_port_range", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents whether the traffic is inbound or outbound.", + "ta_relevant": false + }, + "fieldName": "direction", + "displayName": "direction", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field represents the protocol for the network event rule.", + "ta_relevant": false + }, + "fieldName": "protocol", + "displayName": "protocol", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents whether to allow or deny traffic.", + "ta_relevant": false + }, + "fieldName": "rule_action", + "displayName": "rule_action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents the incoming traffic from a specific source IP address or range. Specify a single IP address, or an IP address range in CIDR notation (for example, 203.0.113.5/32)", + "ta_relevant": false + }, + "fieldName": "src_ip_range", + "displayName": "src_ip_range", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "For network events, this field represents source port or range. For example, 80 or 8000 - 8080 or 80,443", + "ta_relevant": false + }, + "fieldName": "src_port_range", + "displayName": "src_port_range", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=network" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "network" + ] + }, + "objectName": "Device_Restarts", + "displayName": "Device Restarts", + "parentName": "Network_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=modified change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Account_Management", + "displayName": "Account Management", + "parentName": "All_Changes", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "For account management events, this should represent the type of the user changed by the request." + }, + "fieldName": "src_user_type", + "displayName": "src_user_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Account_Management_fillnull_dest_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the destination, if applicable.", + "recommended": true + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)" + }, + { + "calculationID": "Account_Management_fillnull_src_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the source, if applicable.", + "recommended": true + }, + "fieldName": "src_nt_domain", + "displayName": "src_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_nt_domain) OR src_nt_domain=\"\",\"unknown\",src_nt_domain)" + }, + { + "calculationID": "Account_Management_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For account changes, the user or entity performing the change.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)" + }, + { + "calculationID": "Account_Management_fillnull_src_user_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For account changes, the user name of the user or entity performing the change.", + "recommended": true + }, + "fieldName": "src_user_name", + "displayName": "src_user_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user_name) OR src_user_name=\"\",\"unknown\",src_user_name)" + } + ], + "constraints": [ + { + "search": "tag=account" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Created", + "displayName": "Created Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"created\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Deleted", + "displayName": "Deleted Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"deleted\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Account_Lockouts", + "displayName": "Locked Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "result=\"lockout\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Updated", + "displayName": "Updated Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"updated\" OR action=\"modified\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "instance" + ] + }, + "objectName": "Instance_Changes", + "displayName": "Instance Changes", + "parentName": "All_Changes", + "fields": [], + "calculations": [ + { + "calculationID": "Instance_fillnull_image_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For create instance events, this field represents the image ID used for creating the instance such as the OS, applications, installed libraries, and more.", + "recommended": true + }, + "fieldName": "image_id", + "displayName": "image_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(image_id) OR image_id=\"\",\"unknown\",image_id)" + }, + { + "calculationID": "Instance_fillnull_instance_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For create instance events, this field represents the type of instance to build such as the combination of CPU, memory, storage, and network capacity.", + "recommended": true + }, + "fieldName": "instance_type", + "displayName": "instance_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(instance_type) OR instance_type=\"\",\"unknown\",instance_type)" + } + ], + "constraints": [ + { + "search": "tag=instance" + } + ], + "children": [] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Change_Analysis.json b/deps/apps/Splunk_SA_CIM/default/data/models/Change_Analysis.json new file mode 100644 index 000000000..8d8a44c3f --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Change_Analysis.json @@ -0,0 +1,1088 @@ +{ + "modelName": "Change_Analysis", + "displayName": "Change Analysis (Deprecated)", + "description": "This model has been deprecated.", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "change" + ] + }, + "objectName": "All_Changes", + "displayName": "All Changes", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Changes_fillnull_change_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of change, such as filesystem or AAA (authentication, authorization, and accounting).", + "expected_values": [ + "restart" + ], + "recommended": true + }, + "fieldName": "change_type", + "displayName": "change_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(change_type) OR change_type=\"\",\"unknown\",change_type)" + }, + { + "calculationID": "All_Changes_fillnull_command", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The command that initiated the change.", + "recommended": true + }, + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(command) OR command=\"\",\"unknown\",if(sourcetype==\"audittrail\",Operation.\" \".ObjectName,command))" + }, + { + "calculationID": "All_Changes_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The resource where change occurred. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Changes_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that reported the change, if applicable, such as a FIP or CIM server. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "All_Changes_fillnull_object", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Name of the affected object on the resource, such as a router interface, user account, or server volume.", + "recommended": true + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object) OR object=\"\",\"unknown\",object)" + }, + { + "calculationID": "All_Changes_fillnull_object_attrs", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The attributes that were updated on the updated resource object, if applicable.", + "recommended": true + }, + "fieldName": "object_attrs", + "displayName": "object_attrs", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(object_attrs) OR object_attrs=\"\",\"unknown\",object_attrs)" + }, + { + "calculationID": "All_Changes_fillnull_object_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Generic name for the class of the updated resource object. Expected values may be specific to an app.", + "expected_values": [ + "directory", + "file", + "group", + "registry", + "user" + ], + "recommended": true + }, + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "All_Changes_fillnull_object_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unique updated resource object ID as presented to the system, if applicable. For example, a SID, UUID, or GUID value.", + "recommended": true + }, + "fieldName": "object_id", + "displayName": "object_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_id) OR object_id=\"\",\"unknown\",object_id)" + }, + { + "calculationID": "All_Changes_fillnull_object_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path of the modified resource object, if applicable, such as a file, directory, or volume.", + "recommended": true + }, + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_path) OR object_path=\"\",\"unknown\",object_path)" + }, + { + "calculationID": "All_Changes_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Status of the update.", + "expected_values": [ + "success", + "failure" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + }, + { + "calculationID": "All_Changes_fillnull_result", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor-specific result of a change, or clarification of an action status. For example, status=failure may be accompanied by result=blocked by policy or result=disk full. Note: result is a string. Use msg_severity_id for severity ID fields that are integer data types.", + "expected_values": [ + "lockout" + ], + "recommended": true + }, + "fieldName": "result", + "displayName": "result", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(result) AND result!=\"\",result,if(isnotnull(signature) AND signature!=\"\",signature,\"unknown\"))" + }, + { + "calculationID": "All_Changes_fillnull_result_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A result indicator for an action status.", + "recommended": true + }, + "fieldName": "result_id", + "displayName": "result_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(result_id) AND result_id!=\"\",result_id,if(isnotnull(signature_id) AND signature_id!=\"\",signature_id,-1))" + }, + { + "calculationID": "All_Changes_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The resource where the change was originated. You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "All_Changes_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user or entity performing the change. For account changes, this is the account that was changed (see src_user for user or entity performing the change).", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "All_Changes_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product or service that detected the change. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + }, + { + "calculationID": "All_Changes_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action performed on the resource.", + "expected_values": [ + "acl_modified", + "cleared", + "created", + "deleted", + "modified", + "read", + "stopped", + "updated" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + } + ], + "constraints": [ + { + "search": "(`cim_Change_Analysis_indexes`) tag=change" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "audit" + ] + }, + "objectName": "Auditing_Changes", + "displayName": "Auditing Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=audit" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Endpoint_Changes", + "displayName": "Endpoint Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=endpoint" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Filesystem_Changes", + "displayName": "Filesystem Changes", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Filesystem_Changes_eval_file_access_time", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The time the file (the object of the event) was accessed.", + "recommended": true + }, + "fieldName": "file_access_time", + "displayName": "file_access_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_access_time) OR file_access_time=\"\",0,file_access_time)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_create_time", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The time the file (the object of the event) was created.", + "recommended": true + }, + "fieldName": "file_create_time", + "displayName": "file_create_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_create_time) OR file_create_time=\"\",0,file_create_time)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_hash", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A cryptographic identifier assigned to the file object affected by the event.", + "recommended": true + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_hash) OR file_hash=\"\",\"unknown\",file_hash)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_modify_time", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The time the file (the object of the event) was altered.", + "recommended": true + }, + "fieldName": "file_modify_time", + "displayName": "file_modify_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_modify_time) OR file_modify_time=\"\",0,file_modify_time)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the file that is the object of the event (without location information related to local file or directory structure).", + "recommended": true + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_name) OR file_name=\"\",\"unknown\",file_name)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The location of the file that is the object of the event, in local file and directory structure terms.", + "recommended": true + }, + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_path) OR file_path=\"\",\"unknown\",file_path)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_acl", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Access controls associated with the file affected by the event.", + "recommended": true + }, + "fieldName": "file_acl", + "displayName": "file_acl", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_acl) OR file_acl=\"\",\"unknown\",file_acl)" + }, + { + "calculationID": "Filesystem_Changes_eval_file_size", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The size of the file that is the object of the event, in kilobytes.", + "recommended": true + }, + "fieldName": "file_size", + "displayName": "file_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(file_size),file_size,null())" + } + ], + "constraints": [ + { + "search": "(object_category=file OR object_category=directory)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Registry_Changes", + "displayName": "Registry Changes", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "object_category=registry" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Endpoint_Restarts", + "displayName": "Endpoint Restarts", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=modified change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "endpoint" + ] + }, + "objectName": "Other_Endpoint_Changes", + "displayName": "Other Endpoint Changes", + "parentName": "Endpoint_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "NOT (object_category=file OR object_category=directory OR object_category=registry OR change_type=restart)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "network" + ] + }, + "objectName": "Network_Changes", + "displayName": "Network Changes", + "parentName": "All_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=network" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "network" + ] + }, + "objectName": "Device_Restarts", + "displayName": "Device Restarts", + "parentName": "Network_Changes", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=modified change_type=restart" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Account_Management", + "displayName": "Account Management", + "parentName": "All_Changes", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Account_Management_fillnull_dest_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the destination, if applicable.", + "recommended": true + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)" + }, + { + "calculationID": "Account_Management_fillnull_src_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the source, if applicable.", + "recommended": true + }, + "fieldName": "src_nt_domain", + "displayName": "src_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_nt_domain) OR src_nt_domain=\"\",\"unknown\",src_nt_domain)" + }, + { + "calculationID": "Account_Management_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "For account changes, the user or entity performing the change.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)" + } + ], + "constraints": [ + { + "search": "tag=account" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Created", + "displayName": "Created Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"created\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Deleted", + "displayName": "Deleted Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"deleted\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Account_Lockouts", + "displayName": "Locked Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "result=\"lockout\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "change", + "account" + ] + }, + "objectName": "Accounts_Updated", + "displayName": "Updated Accounts", + "parentName": "Account_Management", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"updated\" OR action=\"modified\"" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Compute_Inventory.json b/deps/apps/Splunk_SA_CIM/default/data/models/Compute_Inventory.json new file mode 100644 index 000000000..c9809cbf5 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Compute_Inventory.json @@ -0,0 +1,1039 @@ +{ + "modelName": "Compute_Inventory", + "displayName": "Inventory", + "description": "Inventory Data Model", + "editable": false, + "objects": [ + { + "comment": { + "ta_relevant": false + }, + "objectName": "All_Inventory", + "displayName": "All Inventory", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The description of the inventory system." + }, + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the system where the data originated. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the system where the data originated, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the system where the data originated.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether the resource is enabled or disabled." + }, + "fieldName": "enabled", + "displayName": "enabled", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The product family of the resource, such as 686_64 or RISC." + }, + "fieldName": "family", + "displayName": "family", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The hypervisor identifier, if applicable." + }, + "fieldName": "hypervisor_id", + "displayName": "hypervisor_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The serial number of the resource." + }, + "fieldName": "serial", + "displayName": "serial", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The current reported state of the resource." + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The version of a computer resource, such as 2008r2 or 3.0.0." + }, + "fieldName": "version", + "displayName": "version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Inventory_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system where the data originated, the source of the event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Inventory_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the resource, such as Cisco Catalyst 3850. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Compute_Inventory_indexes`) tag=inventory (tag=cpu OR tag=memory OR tag=network OR tag=storage OR (tag=system tag=version) OR tag=user OR tag=virtual)" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "cpu" + ] + }, + "objectName": "CPU", + "displayName": "CPU", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The number of CPU cores reported by the resource (total, not per CPU).", + "recommended": true + }, + "fieldName": "cpu_cores", + "displayName": "cpu_cores", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of CPUs reported by the resource.", + "recommended": true + }, + "fieldName": "cpu_count", + "displayName": "cpu_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum speed of the CPU reported by the resource (in megahertz).", + "recommended": true + }, + "fieldName": "cpu_mhz", + "displayName": "cpu_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=cpu" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "memory" + ] + }, + "objectName": "Memory", + "displayName": "Memory", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The total amount of memory installed in or allocated to the resource, in megabytes.", + "recommended": true + }, + "fieldName": "mem", + "displayName": "mem", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=memory" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "network" + ] + }, + "objectName": "Network", + "displayName": "Network", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The domain name server for the resource.", + "recommended": true + }, + "fieldName": "dns", + "displayName": "dns", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network interfaces of the computing resource, such as eth0, eth1 or Wired Ethernet Connection, Teredo Tunneling Pseudo-Interface.", + "recommended": true + }, + "fieldName": "interface", + "displayName": "interface", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network addresses of the computing resource, such as 192.168.1.1 or E80:0000:0000:0000:0202:B3FF:FE1E:8329.", + "recommended": true + }, + "fieldName": "ip", + "displayName": "ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The IP address for the system that the data is going to." + }, + "fieldName": "dest_ip", + "displayName": "dest_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The IP address for the system from which the data originates." + }, + "fieldName": "src_ip", + "displayName": "src_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A MAC (media access control) address associated with the resource, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field and use colons instead of dashes, spaces, or no separator.", + "recommended": true + }, + "fieldName": "mac", + "displayName": "mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The load balancing method used by the computing resource such as method, round robin, or least weight." + }, + "fieldName": "lb_method", + "displayName": "lb_method", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Represents a node hit." + }, + "fieldName": "node", + "displayName": "node", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Identifies whether the resource is a network address translation pool." + }, + "fieldName": "inline_nat", + "displayName": "inline_nat", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The port number for the virtual IP address (VIP). A VIP allows multiple MACs to use one IP address. VIPs are often used by load balancers." + }, + "fieldName": "vip_port", + "displayName": "vip_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of the destination port on the server that you requested from." + }, + "fieldName": "node_port", + "displayName": "node_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A name field provided in some data sources.", + "recommended": true + }, + "fieldName": "name", + "displayName": "name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=network" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "storage" + ] + }, + "objectName": "Storage", + "displayName": "Storage", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The array that the storage resource is a member of, if applicable." + }, + "fieldName": "array", + "displayName": "array", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The block size used by the storage resource, in kilobytes." + }, + "fieldName": "blocksize", + "displayName": "blocksize", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The index cluster that the resource is a member of, if applicable." + }, + "fieldName": "cluster", + "displayName": "cluster", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of file descriptors available." + }, + "fieldName": "fd_max", + "displayName": "fd_max", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latency reported by the resource, in milliseconds." + }, + "fieldName": "latency", + "displayName": "latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The path at which a storage resource is mounted.", + "recommended": true + }, + "fieldName": "mount", + "displayName": "mount", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A higher level object that this resource is owned by, if applicable." + }, + "fieldName": "parent", + "displayName": "parent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum possible number of blocks read per second during a polling period." + }, + "fieldName": "read_blocks", + "displayName": "read_blocks", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "For a polling period, the average amount of time elapsed until a read request is filled by the host disks (in ms)." + }, + "fieldName": "read_latency", + "displayName": "read_latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of read operations in the polling period." + }, + "fieldName": "read_ops", + "displayName": "read_ops", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of storage capacity allocated to the resource, in megabytes.", + "recommended": true + }, + "fieldName": "storage", + "displayName": "storage", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum possible number of blocks written per second during a polling period." + }, + "fieldName": "write_blocks", + "displayName": "write_blocks", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "For a polling period, the average amount of time elapsed until a write request is filled by the host disks (in ms)." + }, + "fieldName": "write_latency", + "displayName": "write_latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of write operations in the polling period." + }, + "fieldName": "write_ops", + "displayName": "write_ops", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=storage" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "system", + "version" + ] + }, + "objectName": "OS", + "displayName": "OS", + "parentName": "All_Inventory", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "OS_os", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The operating system of the resource, such as Microsoft Windows Server 2008r2. This field is constructed from vendor_product and version fields.", + "recommended": true + }, + "fieldName": "os", + "displayName": "os", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(os) AND os!=\"\",replace(replace(os,\"(?:\\(R\\)|\\\\\\\\xA8)\",\"\"),\"^(?:MS)?\\s*Windows\",\"Microsoft Windows\"),\"unknown\")" + } + ], + "constraints": [ + { + "search": "tag=system tag=version" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "user" + ] + }, + "objectName": "User", + "displayName": "User", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "Indicates the shell program used by a locally defined account." + }, + "fieldName": "shell", + "displayName": "shell", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the locally-defined user account. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the system where the data originated, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user identification for a locally defined account." + }, + "fieldName": "user_id", + "displayName": "user_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of a locally-defined account.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "User_interactive", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Indicates whether a locally defined account on a resource can be interactively logged in.", + "recommended": true + }, + "fieldName": "interactive", + "displayName": "interactive", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(interactive) AND interactive!=\"\",interactive,tag=\"interactive\",\"true\",1=1,\"false\")" + }, + { + "calculationID": "User_password", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Displays the stored password(s) for a locally defined account, if it has any. For instance, an add-on may report the password column from \/etc\/passwd in this field.", + "recommended": true + }, + "fieldName": "password", + "displayName": "password", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if((password==\"*\" OR password==\"x\" OR password==\"\"),null(),password)" + }, + { + "calculationID": "User_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full name of a locally defined account.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + } + ], + "constraints": [ + { + "search": "tag=user" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "user" + ] + }, + "objectName": "Cleartext_Passwords", + "displayName": "Cleartext Passwords", + "parentName": "User", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "password=*" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "user", + "default" + ] + }, + "objectName": "Default_Accounts", + "displayName": "Default Accounts", + "parentName": "User", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=default" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "virtual" + ] + }, + "objectName": "Virtual_OS", + "displayName": "Virtual OS", + "parentName": "All_Inventory", + "fields": [ + { + "comment": { + "description": "The hypervisor parent of a virtual guest OS.", + "recommended": true + }, + "fieldName": "hypervisor", + "displayName": "hypervisor", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=virtual" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "virtual", + "snapshot" + ] + }, + "objectName": "Snapshot", + "displayName": "Snapshot", + "parentName": "Virtual_OS", + "fields": [ + { + "comment": { + "description": "The snapshot file size, in megabytes.", + "recommended": true + }, + "fieldName": "size", + "displayName": "size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of a snapshot file.", + "recommended": true + }, + "fieldName": "snapshot", + "displayName": "snapshot", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time at which the snapshot was taken." + }, + "fieldName": "time", + "displayName": "time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=snapshot" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "inventory", + "virtual", + "tools" + ] + }, + "objectName": "Tools", + "displayName": "Tools", + "parentName": "Virtual_OS", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=tools" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/DLP.json b/deps/apps/Splunk_SA_CIM/default/data/models/DLP.json new file mode 100644 index 000000000..cd92294df --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/DLP.json @@ -0,0 +1,591 @@ +{ + "modelName": "DLP", + "displayName": "Data Loss Prevention", + "description": "Data Loss Prevention Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "dlp", + "incident" + ] + }, + "objectName": "DLP_Incidents", + "displayName": "DLP Incidents", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The application involved in the event." + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP target. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The zone of the DLP target." + }, + "fieldName": "dest_zone", + "displayName": "dest_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_bunit", + "displayName": "dvc_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_category", + "displayName": "dvc_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP device. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_priority", + "displayName": "dvc_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The zone of the DLP device." + }, + "fieldName": "dvc_zone", + "displayName": "dvc_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The zone of the DLP source." + }, + "fieldName": "src_zone", + "displayName": "src_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP source user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the DLP user. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "DLP_Incidents_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action taken by the DLP device.", + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "DLP_Incidents_fillnull_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The category of the DLP event.", + "recommended": true + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "DLP_Incidents_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that reported the DLP event.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "DLP_incidents_fillnull_dlp_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of DLP system that generated the event.", + "recommended": true + }, + "fieldName": "dlp_type", + "displayName": "dlp_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dlp_type) OR dlp_type=\"\",\"unknown\",dlp_type)" + }, + { + "calculationID": "DLP_Incidents_fillnull_object", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the affected object.", + "recommended": true + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object) OR object=\"\",\"unknown\",object)" + }, + { + "calculationID": "DLP_Incidents_fillnull_object_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path of the affected object.", + "recommended": true + }, + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_path) OR object_path=\"\",\"unknown\",object_path)" + }, + { + "calculationID": "DLP_Incidents_fillnull_object_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The category of the affected object.", + "recommended": true + }, + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "DLP_Incidents_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the DLP event.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "DLP_Incidents_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the DLP event.", + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "DLP_Incidents_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source of the DLP event.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "DLP_Incidents_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source user of the DLP event.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR user=\"\",\"unknown\",src_user)" + }, + { + "calculationID": "DLP_Incidents_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The target of the DLP event.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "DLP_Incidents_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The target user of the DLP event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "DLP_Incidents_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the DLP system.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_DLP_indexes`) tag=dlp tag=incident" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Data_Access.json b/deps/apps/Splunk_SA_CIM/default/data/models/Data_Access.json new file mode 100644 index 000000000..82e418b35 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Data_Access.json @@ -0,0 +1,463 @@ +{ + "modelName": "Data_Access", + "displayName": "Data Access", + "description": "Data Access Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "data", + "access" + ] + }, + "objectName": "Data_Access", + "displayName": "Data Access", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Application ID of the user" + }, + "fieldName": "application_id", + "displayName": "application_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Name of the destination as defined by the Vendor." + }, + "fieldName": "dest_name", + "displayName": "dest_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Url of the product, application or object." + }, + "fieldName": "dest_url", + "displayName": "dest_url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The device that reported the data access event." + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The email address of the user involved in the event, or who initiated the event." + }, + "fieldName": "email", + "displayName": "email", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The path of the modified resource object, if applicable, such as a file, directory, or volume." + }, + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Resource owner." + }, + "fieldName": "owner", + "displayName": "owner", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "ID of the owner as defined by the vendor." + }, + "fieldName": "owner_id", + "displayName": "owner_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Email of the resource owner." + }, + "fieldName": "owner_email", + "displayName": "owner_email", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Parent of the object name on which the action was performed by a user." + }, + "fieldName": "parent_object", + "displayName": "parent_object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Object category of the parent object on which action was performed by a user." + }, + "fieldName": "parent_object_category", + "displayName": "parent_object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Object id of the parent object on which the action was performed by a user." + }, + "fieldName": "parent_object_id", + "displayName": "parent_object_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The user agent through which the request was made, such as Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) or aws-cli/2.0.0 Python/3.7.4 Darwin/18.7.0 botocore/2.0.0dev4." + }, + "fieldName": "user_agent", + "displayName": "user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The group of the user involved in the event, or who initiated the event." + }, + "fieldName": "user_group", + "displayName": "user_group", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The role of the user involved in the event, or who initiated the event." + }, + "fieldName": "user_role", + "displayName": "user_role", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The vendor and product name ID as defined by the vendor." + }, + "fieldName": "vendor_product_id", + "displayName": "vendor_product_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Data_Access_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The data access action taken by the user.", + "expected_values": [ + "copied", + "created", + "deleted", + "modified", + "read", + "stopped", + "updated", + "downloaded", + "uploaded", + "shared" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Data_Access_fillnull_app", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system, service, or application that generated the data access event. Examples include Onedrive, Sharepoint, drive, AzureActiveDirectory.", + "recommended": true + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(app) OR app=\"\",sourcetype,app)" + }, + { + "calculationID": "Data_Access_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination where the data resides or where it is being accessed, such as the product or application. You can alias this from more specific fields not included in this data model, such as dest_host, dest_ip, dest_url or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Data_Access_fillnull_object", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Resource object name on which the action was performed by a user.", + "recommended": true + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object) OR object=\"\",\"unknown\",object)" + }, + { + "calculationID": "Data_Access_fillnull_object_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Generic name for the class of the updated resource object. Expected values may be specific to an app.", + "expected_values": [ + "collaboration", + "file", + "folder", + "comment", + "task", + "note" + ], + "recommended": true + }, + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)" + }, + { + "calculationID": "Data_Access_fillnull_object_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unique updated resource object ID as presented to the system, if applicable. For example, a source_folder_id, doc_id.", + "recommended": true + }, + "fieldName": "object_id", + "displayName": "object_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_id) OR object_id=\"\",\"unknown\",object_id)" + }, + { + "calculationID": "Data_Access_fillnull_object_size", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The size of the modified resource object.", + "recommended": true + }, + "fieldName": "object_size", + "displayName": "object_size", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(object_size) OR object_size=\"\",\"unknown\",object_size)" + }, + { + "calculationID": "Data_Access_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint client host.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "Data_Access_fillnull_tenant_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Tenant ID in multi-tenant environments.", + "recommended": true + }, + "fieldName": "tenant_id", + "displayName": "tenant_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(tenant_id) OR tenant_id=\"\",\"unknown\",tenant_id)" + }, + { + "calculationID": "All_Changes_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user involved in the event, or who initiated the event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Data_Access_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the vendor.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Data_Access_indexes`) tag=data tag=access" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Databases.json b/deps/apps/Splunk_SA_CIM/default/data/models/Databases.json new file mode 100644 index 000000000..f2f17626d --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Databases.json @@ -0,0 +1,1139 @@ +{ + "modelName": "Databases", + "displayName": "Databases", + "description": "Data Model for all databases", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "database" + ] + }, + "objectName": "All_Databases", + "displayName": "All Databases", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The destination of the database event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the database event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the database object." + }, + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the database event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source of the database event. You can alias this from more specific fields, such as src_host, src_ip, or src_name." + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the source.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Name of the database process user." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category associated with the user.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Databases_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the database system. This field can be automatically populated by vendor and product fields in your data." + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Databases_indexes`) tag=database" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "instance" + ] + }, + "objectName": "Database_Instance", + "displayName": "Database Instance", + "parentName": "All_Databases", + "fields": [ + { + "comment": { + "description": "The name of the database instance." + }, + "fieldName": "instance_name", + "displayName": "instance_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The version of the database instance." + }, + "fieldName": "instance_version", + "displayName": "instance_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of sessions that the database instance can handle." + }, + "fieldName": "session_limit", + "displayName": "session_limit", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of processes that the database instance can handle." + }, + "fieldName": "process_limit", + "displayName": "process_limit", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=instance" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "instance", + "stats" + ] + }, + "objectName": "Instance_Stats", + "displayName": "Instance Stats", + "parentName": "Database_Instance", + "fields": [ + { + "comment": { + "description": "The total amount of uptime for the database instance." + }, + "fieldName": "start_time", + "displayName": "start_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the database server.", + "expected_values": [ + "Available", + "Not Available" + ] + }, + "fieldName": "availability", + "displayName": "availability", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of sessions currently in use for the database instance." + }, + "fieldName": "sessions", + "displayName": "sessions", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of processes currently running for the database instance." + }, + "fieldName": "processes", + "displayName": "processes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of the database dump area that has been used." + }, + "fieldName": "dump_area_used", + "displayName": "dump_area_used", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of tablespace used for the database instance, in bytes." + }, + "fieldName": "tablespace_used", + "displayName": "tablespace_used", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of users for the database instance." + }, + "fieldName": "number_of_users", + "displayName": "number_of_users", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The average number of executions for the database instance." + }, + "fieldName": "avg_executions", + "displayName": "avg_executions", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of reads for the database instance." + }, + "fieldName": "instance_reads", + "displayName": "instance_reads", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of writes for the database instance." + }, + "fieldName": "instance_writes", + "displayName": "instance_writes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the buffer cache for the database instance, in bytes." + }, + "fieldName": "sga_buffer_cache_size", + "displayName": "sga_buffer_cache_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the shared pool for this database instance, in bytes." + }, + "fieldName": "sga_shared_pool_size", + "displayName": "sga_shared_pool_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the redo log buffer for the database instance, in bytes." + }, + "fieldName": "sga_redo_log_buffer_size", + "displayName": "sga_redo_log_buffer_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total library cache size for the database instance, in bytes." + }, + "fieldName": "sga_library_cache_size", + "displayName": "sga_library_cache_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The size of the fixed area (also referred to as the fixed SGA) for the database instance, in bytes." + }, + "fieldName": "sga_fixed_area_size", + "displayName": "sga_fixed_area_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the SQL area for this database instance, in bytes." + }, + "fieldName": "sga_sql_area_size", + "displayName": "sga_sql_area_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of buffers that can be hit in the database instance without finding a free buffer." + }, + "fieldName": "sga_buffer_hit_limit", + "displayName": "sga_buffer_hit_limit", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The hit-to-miss ratio for the database instance's data dictionary." + }, + "fieldName": "sga_data_dict_hit_ratio", + "displayName": "sga_data_dict_hit_ratio", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of free memory in the database instance SGA, in bytes." + }, + "fieldName": "sga_free_memory", + "displayName": "sga_free_memory", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=stats" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "instance", + "session" + ] + }, + "objectName": "Session_Info", + "displayName": "Session Info", + "parentName": "Database_Instance", + "fields": [ + { + "comment": { + "description": "The unique id that identifies the session." + }, + "fieldName": "session_id", + "displayName": "session_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The current status of the session.", + "expected_values": [ + "Online", + "Offline" + ] + }, + "fieldName": "session_status", + "displayName": "session_status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the logical host associated with the database instance." + }, + "fieldName": "machine", + "displayName": "machine", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of time elapsed since the user started the session by logging into the database server, in seconds." + }, + "fieldName": "elapsed_time", + "displayName": "elapsed_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of CPU centiseconds used by the session. Divide this value by 100 to get the CPU seconds." + }, + "fieldName": "cpu_used", + "displayName": "cpu_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of memory sorts performed during the session." + }, + "fieldName": "memory_sorts", + "displayName": "memory_sorts", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of table scans performed during the session." + }, + "fieldName": "table_scans", + "displayName": "table_scans", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of physical reads performed during the session." + }, + "fieldName": "physical_reads", + "displayName": "physical_reads", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of consistent gets and database block gets performed during the session." + }, + "fieldName": "logical_reads", + "displayName": "logical_reads", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of commits per second performed by the user associated with the session." + }, + "fieldName": "commits", + "displayName": "commits", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of the cursor currently in use by the session." + }, + "fieldName": "cursor", + "displayName": "cursor", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The percentage of logical reads from the buffer during the session (1-physical reads\/session logical reads*100)." + }, + "fieldName": "buffer_cache_hit_ratio", + "displayName": "buffer_cache_hit_ratio", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Provides the current wait state for the session. Can indicate that the session is currently waiting or provide information about the session's last wait. WAITING indicates the session is currently waiting, WAITED UNKNOWN TIME indicates the duration of the last session wait is unknown, WAITED SHORT TIME indicates the last session wait was < 1\/100th of a second, WAITED KNOWN TIME indicates the wait_time is the duration of the last session wait.", + "expected_values": [ + "WAITING", + "WAITED UNKNOWN", + "WAITED SHORT TIME", + "WAITED KNOWN TIME" + ] + }, + "fieldName": "wait_state", + "displayName": "wait_state", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "When wait_time = 0, the session is waiting. When wait_time has a nonzero value, it is displaying the last wait time for the session." + }, + "fieldName": "wait_time", + "displayName": "wait_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The seconds_in_wait depends on the value of wait_time. If wait_time = 0, seconds_in_wait is the number of seconds spent in the current wait condition. If wait_time has a nonzero value, seconds_in_wait is the number of seconds that have elapsed since the start of the last wait. You can get the active seconds that have elapsed since the last wait ended by calculating seconds_in_wait - wait_time \/ 100." + }, + "fieldName": "seconds_in_wait", + "displayName": "seconds_in_wait", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=session" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "instance", + "lock" + ] + }, + "objectName": "Lock_Info", + "displayName": "Lock Info", + "parentName": "Database_Instance", + "fields": [ + { + "comment": { + "description": "The name of the locked object." + }, + "fieldName": "obj_name", + "displayName": "obj_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The session identifier of the locked object." + }, + "fieldName": "lock_session_id", + "displayName": "lock_session_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The serial number of the object." + }, + "fieldName": "serial_num", + "displayName": "serial_num", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The mode of the lock on the object." + }, + "fieldName": "lock_mode", + "displayName": "lock_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The process identifier for the operating system." + }, + "fieldName": "os_pid", + "displayName": "os_pid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Represents the amount of time elapsed since the session_status changed to its current status. The definition of this field depends on the session_status value. If session_status = ONLINE, the last_call_minute value represents the time elapsed since the session became active. If session_status = OFFLINE, the last_call_minute value represents the time elapsed since the session became inactive." + }, + "fieldName": "last_call_minute", + "displayName": "last_call_minute", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The database logon time for the session." + }, + "fieldName": "logon_time", + "displayName": "logon_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=lock" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "query" + ] + }, + "objectName": "Database_Query", + "displayName": "Database Query", + "parentName": "All_Databases", + "fields": [ + { + "comment": { + "description": "The full database query." + }, + "fieldName": "query", + "displayName": "query", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The identifier for the database query." + }, + "fieldName": "query_id", + "displayName": "query_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time the system initiated the database query." + }, + "fieldName": "query_time", + "displayName": "query_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of records affected by the database query." + }, + "fieldName": "records_affected", + "displayName": "records_affected", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=query" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "query", + "tablespace" + ] + }, + "objectName": "Tablespace", + "displayName": "Tablespace", + "parentName": "Database_Query", + "fields": [ + { + "comment": { + "description": "The name of the tablespace." + }, + "fieldName": "tablespace_name", + "displayName": "tablespace_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the tablespace.", + "expected_values": [ + "Offline", + "Online", + "Read Only" + ] + }, + "fieldName": "tablespace_status", + "displayName": "tablespace_status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of free space in the tablespace, in bytes." + }, + "fieldName": "free_bytes", + "displayName": "free_bytes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of tablespace reads carried out by the query." + }, + "fieldName": "tablespace_reads", + "displayName": "tablespace_reads", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of tablespace writes carried out by the query." + }, + "fieldName": "tablespace_writes", + "displayName": "tablespace_writes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=tablespace" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "database", + "query", + "stats" + ] + }, + "objectName": "Query_Stats", + "displayName": "Query Stats", + "parentName": "Database_Query", + "fields": [ + { + "comment": { + "description": "The names of the stored procedures called by the query." + }, + "fieldName": "stored_procedures_called", + "displayName": "stored_procedures_called", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The names of the tables hit by the query." + }, + "fieldName": "tables_hit", + "displayName": "tables_hit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The names of the indexes hit by the database query." + }, + "fieldName": "indexes_hit", + "displayName": "indexes_hit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the query plan hit by the query." + }, + "fieldName": "query_plan_hit", + "displayName": "query_plan_hit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=stats" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Email.json b/deps/apps/Splunk_SA_CIM/default/data/models/Email.json new file mode 100644 index 000000000..8997f5353 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Email.json @@ -0,0 +1,825 @@ +{ + "modelName": "Email", + "displayName": "Email", + "description": "Email Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "email" + ] + }, + "objectName": "All_Email", + "displayName": "All Email", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Total sending delay in milliseconds." + }, + "displayName": "delay", + "fieldName": "delay", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the endpoint system to which the message was delivered. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the endpoint system to which the message was delivered. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the endpoint system to which the message was delivered. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the messaging event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The hashes for the files attached to the message, if any exist." + }, + "displayName": "file_hash", + "fieldName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The names of the files attached to the message, if any exist." + }, + "displayName": "file_name", + "fieldName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The size of the files attached the message, in bytes." + }, + "displayName": "file_size", + "fieldName": "file_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Host-specific unique message identifier (such as aid in sendmail, IMI in Domino, Internal-Message-ID in Exchange, and MID in Ironport)." + }, + "displayName": "internal_message_id", + "fieldName": "internal_message_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally-unique message identifier." + }, + "displayName": "message_id", + "fieldName": "message_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Additional information about the message." + }, + "displayName": "message_info", + "fieldName": "message_info", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The original destination host of the message. The message destination host can change when a message is relayed or bounced." + }, + "displayName": "orig_dest", + "fieldName": "orig_dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The original recipient of the message. The message recipient can change when the original email address is an alias and has to be resolved to the actual recipient." + }, + "displayName": "orig_recipient", + "fieldName": "orig_recipient", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The original source of the message." + }, + "displayName": "orig_src", + "fieldName": "orig_src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The email protocol involved, such as SMTP or RPC.", + "expected_values": [ + "smtp", + "imap", + "pop3", + "mapi" + ] + }, + "displayName": "protocol", + "fieldName": "protocol", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the email executable that carries out the message transaction, such as sendmail, postfix, or the name of an email client." + }, + "fieldName": "process", + "displayName": "process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process invoked to send the message." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The recipient delivery status, if available." + }, + "displayName": "recipient_status", + "fieldName": "recipient_status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the messaging event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of times that the message was automatically resent because it was bounced back, or a similar transmission error condition." + }, + "displayName": "retries", + "fieldName": "retries", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The return address for the message." + }, + "displayName": "return_addr", + "fieldName": "return_addr", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The size of the message, in bytes." + }, + "displayName": "size", + "fieldName": "size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the system that sent the message. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the system that sent the message. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the system that sent the message. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the message sender. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the message sender. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the message sender. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status code associated with the message." + }, + "displayName": "status_code", + "fieldName": "status_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The subject of the message." + }, + "displayName": "subject", + "fieldName": "subject", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The URL associated with the message, if any." + }, + "displayName": "url", + "fieldName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The user context for the process. This is not the email address for the sender. For that, use the src_user field." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the user context for the process. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user context for the process. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user context for the process. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Extended delay information for the message transaction. May contain details of all the delays from all the servers in the message transmission chain." + }, + "displayName": "xdelay", + "fieldName": "xdelay", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "An external reference. Can contain message IDs or recipient addresses from related messages." + }, + "displayName": "xref", + "fieldName": "xref", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Email_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Action taken by the reporting device.", + "expected_values": [ + "delivered", + "blocked", + "quarantined", + "deleted" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Email_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint system to which the message was delivered. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Email_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system that sent the message. You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "0Email_fillnull_recipient", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The recipient email addresses.", + "recommended": true + }, + "fieldName": "recipient", + "displayName": "recipient", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(recipient) OR recipient=\"\",\"unknown\",recipient)" + }, + { + "calculationID": "1Email_recipient_domain", + "calculationType": "Rex", + "inputField": "recipient", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the recipient email addresses.", + "recommended": true + }, + "fieldName": "recipient_domain", + "displayName": "recipient_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^.*@(?.+)$" + }, + { + "calculationID": "2Email_recipient_count", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total number of intended message recipients.", + "ta_relevant": false + }, + "fieldName": "recipient_count", + "displayName": "recipient_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(recipient_count),recipient_count,isnotnull(recipient),mvcount(recipient),1=1,1)" + }, + { + "calculationID": "0Email_fillnull_src_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The email address of the message sender.", + "recommended": true + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)" + }, + { + "calculationID": "1Email_src_user_domain", + "calculationType": "Rex", + "inputField": "src_user", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the email address of the message sender.", + "recommended": true + }, + "fieldName": "src_user_domain", + "displayName": "src_user_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^.*@(?.+)$" + }, + { + "calculationID": "Email_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product of the email server used for the email transaction. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Email_indexes`) tag=email" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "email", + "delivery" + ] + }, + "objectName": "Delivery", + "displayName": "Email Delivery", + "parentName": "All_Email", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=delivery" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "email", + "content" + ] + }, + "objectName": "Content", + "displayName": "Email Content", + "parentName": "All_Email", + "fields": [ + + ], + "constraints": [ + { + "search": "tag=content" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "email", + "filter" + ] + }, + "objectName": "Filtering", + "displayName": "Email Filtering", + "parentName": "All_Email", + "fields": [ + { + "comment": { + "description": "The status produced by the filter, such as 'accepted', 'rejected', or 'dropped'." + }, + "displayName": "filter_action", + "fieldName": "filter_action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Numeric indicator assigned to specific emails by an email filter." + }, + "displayName": "filter_score", + "fieldName": "filter_score", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the filter applied.", + "recommended": true + }, + "displayName": "signature", + "fieldName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Any additional information about the filter." + }, + "displayName": "signature_extra", + "fieldName": "signature_extra", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The id associated with the filter name." + }, + "displayName": "signature_id", + "fieldName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=filter" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Endpoint.json b/deps/apps/Splunk_SA_CIM/default/data/models/Endpoint.json new file mode 100644 index 000000000..79226305b --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Endpoint.json @@ -0,0 +1,2269 @@ +{ + "modelName": "Endpoint", + "displayName": "Endpoint", + "description": "Endpoint Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "listening", + "port" + ] + }, + "objectName": "Ports", + "displayName": "Ports", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The time at which the network port started listening on the endpoint." + }, + "fieldName": "creation_time", + "displayName": "creation_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Network port listening on the endpoint, such as 53.", + "recommended": true + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_requires_av", + "displayName": "src_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_should_timesync", + "displayName": "src_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_should_update", + "displayName": "src_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the listening port, such as established, listening, etc." + }, + "fieldName": "state", + "displayName": "state", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The network transport protocol associated with the listening port, such as tcp, udp, etc.", + "recommended": true + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Calculated as transport\/dest_port, such as tcp\/53.", + "ta_relevant": false + }, + "fieldName": "transport_dest_port", + "displayName": "transport_dest_port", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Ports_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The \"remote\" system connected to the listening port (if applicable).", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "Endpoint_Ports_fillnull_src_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The \"remote\" port connected to the listening port (if applicable).", + "recommended": true + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(src_port),src_port,0)" + }, + { + "calculationID": "Endpoint_Ports_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint for which the port is listening on.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Ports_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account associated with the listening port.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Ports_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=listening tag=port | eval transport=if(isnull(transport) OR transport=\"\",\"unknown\",transport),dest_port=if(isnull(dest_port) OR dest_port=\"\",0,dest_port),transport_dest_port=mvzip(transport,dest_port,\"\/\") | mvexpand transport_dest_port", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "process", + "report" + ] + }, + "objectName": "Processes", + "displayName": "Processes", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The action taken by the endpoint." + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "CPU load consumed by the process (in percent)." + }, + "fieldName": "cpu_load_percent", + "displayName": "cpu_load_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_is_expected", + "displayName": "dest_is_expected", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Memory used by the process (in bytes)." + }, + "fieldName": "mem_used", + "displayName": "mem_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The operating system of the resource, such as Microsoft Windows Server 2008r2." + }, + "fieldName": "os", + "displayName": "os", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The executable name of the parent process." + }, + "fieldName": "parent_process_exec", + "displayName": "parent_process_exec", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the parent process assigned by the operating system." + }, + "fieldName": "parent_process_id", + "displayName": "parent_process_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the parent process assigned by the vendor_product." + }, + "fieldName": "parent_process_guid", + "displayName": "parent_process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The file path of the parent process, such as C:\\Windows\\System32\\notepad.exe." + }, + "fieldName": "parent_process_path", + "displayName": "parent_process_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The current working directory used to spawn the process." + }, + "fieldName": "process_current_directory", + "displayName": "process_current_directory", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The executable name of the process." + }, + "fieldName": "process_exec", + "displayName": "process_exec", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The digest(s) of the parent process, such as , , etc." + }, + "fieldName": "process_hash", + "displayName": "process_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The integrity level of the process.", + "expected_values": [ + "system", + "high", + "medium", + "low", + "untrusted" + ] + }, + "fieldName": "process_integrity_level", + "displayName": "process_integrity_level", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The file path of the process, such as C:\\Windows\\System32\\notepad.exe." + }, + "fieldName": "process_path", + "displayName": "process_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier of the user account which spawned the process." + }, + "fieldName": "user_id", + "displayName": "user_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Processes_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint for which the process was spawned.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Processes_fillnull_original_file_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Original name of the file not including path.", + "recommended": true + }, + "fieldName": "original_file_name", + "displayName": "original_file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(original_file_name) OR original_file_name=\"\",\"unknown\",original_file_name)" + }, + { + "calculationID": "Endpoint_Processes_fillnull_parent_process", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full command string of the parent process", + "recommended": true + }, + "fieldName": "parent_process", + "displayName": "parent_process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(parent_process) OR parent_process=\"\",\"unknown\",parent_process)" + }, + { + "calculationID": "Endpoint_Processes_fillnull_parent_process_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The friendly name of the parent process, such as notepad.exe.", + "recommended": true + }, + "fieldName": "parent_process_name", + "displayName": "parent_process_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(parent_process_name) AND parent_process_name!=\"\",parent_process_name,isnotnull(parent_process) AND parent_process!=\"\",replace(parent_process,\"^\\s*([^\\s]+).*\",\"\\1\"),1=1,\"unknown\")" + }, + { + "calculationID": "Endpoint_Processes_fillnull_process", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full command string of the spawned process. Such as C:\\WINDOWS\\system32\\cmd.exe \/c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"", + "recommended": true + }, + "fieldName": "process", + "displayName": "process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(process) OR process=\"\",\"unknown\",process)" + }, + { + "calculationID": "Endpoint_Processes_fillnull_process_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The friendly name of the process, such as notepad.exe.", + "recommended": true + }, + "fieldName": "process_name", + "displayName": "process_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(process_name) AND process_name!=\"\",process_name,isnotnull(process) AND process!=\"\",replace(process,\"^\\s*([^\\s]+).*\",\"\\1\"),1=1,\"unknown\")" + }, + { + "calculationID": "Endpoint_Processes_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account which spawned the process.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Processes_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=process tag=report | eval process_integrity_level=lower(process_integrity_level)", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "service", + "report" + ] + }, + "objectName": "Services", + "displayName": "Services", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The description of the service." + }, + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_is_expected", + "displayName": "dest_is_expected", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The dynamic link library associated with the service." + }, + "fieldName": "service_dll", + "displayName": "service_dll", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The file path to the dynamic link library assocatied with the service, such as C:\\Windows\\System32\\comdlg32.dll." + }, + "fieldName": "service_dll_path", + "displayName": "service_dll_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The digest(s) of the dynamic link library associated with the service, such as , , etc." + }, + "fieldName": "service_dll_hash", + "displayName": "service_dll_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Whether or not the dynamic link library associated with the service has a digitally signed signature." + }, + "fieldName": "service_dll_signature_exists", + "displayName": "service_dll_signature_exists", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Whether or not the dynamic link library associated with the service has had it's digitally signed signature verified." + }, + "fieldName": "service_dll_signature_verified", + "displayName": "service_dll_signature_verified", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The executable name of the service." + }, + "fieldName": "service_exec", + "displayName": "service_exec", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The digest(s) of the service, such as , , etc." + }, + "fieldName": "service_hash", + "displayName": "service_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The file path of the service, such as C:\\WINDOWS\\system32\\svchost.exe." + }, + "fieldName": "service_path", + "displayName": "service_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Whether or not the service has a digitally signed signature." + }, + "fieldName": "service_signature_exists", + "displayName": "service_signature_exists", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Whether or not the service has had it's digitally signed signature verified." + }, + "fieldName": "service_signature_verified", + "displayName": "service_signature_verified", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Services_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint for which the service is installed.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Services_fillnull_service", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full service name.", + "recommended": true + }, + "fieldName": "service", + "displayName": "service", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service) OR service=\"\",\"unknown\",service)" + }, + { + "calculationID": "Endpoint_Services_fillnull_service_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The friendly service name.", + "recommended": true + }, + "fieldName": "service_name", + "displayName": "service_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service_name) OR service_name=\"\",\"unknown\",service_name)" + }, + { + "calculationID": "Endpoint_Services_fillnull_service_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unique identifier of the service assigned by the operating system..", + "recommended": true + }, + "fieldName": "service_id", + "displayName": "service_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(service_id) OR service_id=\"\",\"unknown\",service_id)" + }, + { + "calculationID": "Endpoint_Services_fillnull_start_mode", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The start mode for the service.", + "expected_values": [ + "disabled", + "manual", + "auto" + ], + "recommended": true + }, + "fieldName": "start_mode", + "displayName": "start_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(start_mode) OR start_mode=\"\",\"unknown\",start_mode)" + }, + { + "calculationID": "Endpoint_Services_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The status of the service.", + "expected_values": [ + "critical", + "started", + "stopped", + "warning" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + }, + { + "calculationID": "Endpoint_Services_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account associated with the service.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Services_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=service tag=report", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "endpoint", + "filesystem" + ] + }, + "objectName": "Filesystem", + "displayName": "Filesystem", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time the file (the object of the event) was accessed.", + "recommended": true + }, + "fieldName": "file_access_time", + "displayName": "file_access_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time the file (the object of the event) was created.", + "recommended": true + }, + "fieldName": "file_create_time", + "displayName": "file_create_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time the file (the object of the event) was altered.", + "recommended": true + }, + "fieldName": "file_modify_time", + "displayName": "file_modify_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Filesystem_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action performed on the resource.", + "expected_values": [ + "acl_modified", + "created", + "deleted", + "modified", + "read" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Endpoint_Filesystem_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint pertaining to the filesystem activity.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_hash", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A cryptographic identifier assigned to the file object affected by the event.", + "recommended": true + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_hash) OR file_hash=\"\",\"unknown\",file_hash)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the file, such as notepad.exe.", + "recommended": true + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_name) OR file_name=\"\",\"unknown\",file_name)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path of the file, such as C:\\Windows\\System32\\notepad.exe.", + "recommended": true + }, + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_path) OR file_path=\"\",\"unknown\",file_path)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_acl", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Access controls associated with the file affected by the event.", + "recommended": true + }, + "fieldName": "file_acl", + "displayName": "file_acl", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(file_acl) OR file_acl=\"\",\"unknown\",file_acl)" + }, + { + "calculationID": "Endpoint_Filesystem_eval_file_size", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The size of the file that is the object of the event, in kilobytes.", + "recommended": true + }, + "fieldName": "file_size", + "displayName": "file_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(file_size),file_size,null())" + }, + { + "calculationID": "Endpoint_Filesystem_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account associated with the filesystem access.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Filesystem_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=endpoint tag=filesystem", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "endpoint", + "registry" + ] + }, + "objectName": "Registry", + "displayName": "Registry", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The globally unique identifier of the process assigned by the vendor_product." + }, + "fieldName": "process_guid", + "displayName": "process_guid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The logical grouping of registry keys, subkeys, and values.", + "expected_values": [ + "HKEY_CURRENT_CONFIG", + "HKEY_CURRENT_USER", + "HKEY_LOCAL_MACHINE\\SAM", + "HKEY_LOCAL_MACHINE\\Security", + "HKEY_LOCAL_MACHINE\\Software", + "HKEY_LOCAL_MACHINE\\System", + "HKEY_USERS\\.DEFAULT" + ], + "ta_relevant": false + }, + "fieldName": "registry_hive", + "displayName": "registry_hive", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The textual representation of registry_value_data (if applicable)." + }, + "fieldName": "registry_value_text", + "displayName": "registry_value_text", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The outcome of the registry action.", + "expected_values": [ + "failure", + "success" + ], + "ta_relevant": false + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Endpoint_Registry_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action performed on the resource.", + "expected_values": [ + "created", + "deleted", + "modified", + "read" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The endpoint pertaining to the registry events.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_path", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The path to the registry value, such as \\win\\directory\\directory2\\{676235CD-B656-42D5-B737-49856E97D072}\\PrinterDriverData.", + "recommended": true + }, + "fieldName": "registry_path", + "displayName": "registry_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_path) OR registry_path=\"\",\"unknown\",registry_path)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_key_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the registry key, such as PrinterDriverData.", + "recommended": true + }, + "fieldName": "registry_key_name", + "displayName": "registry_key_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_key_name) OR registry_key_name=\"\",\"unknown\",registry_key_name)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_value_data", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The unaltered registry value.", + "recommended": true + }, + "fieldName": "registry_value_data", + "displayName": "registry_value_data", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_value_data) OR registry_value_data=\"\",\"unknown\",registry_value_data)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_value_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the registry value.", + "recommended": true + }, + "fieldName": "registry_value_name", + "displayName": "registry_value_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_value_name) OR registry_value_name=\"\",\"unknown\",registry_value_name)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_registry_value_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of the registry value.", + "expected_values": [ + "REG_BINARY", + "REG_DWORD", + "REG_DWORD_LITTLE_ENDIAN", + "REG_DWORD_BIG_ENDIAN", + "REG_EXPAND_SZ", + "REG_LINK", + "REG_MULTI_SZ", + "REG_NONE", + "REG_QWORD", + "REG_QWORD_LITTLE_ENDIAN", + "REG_SZ" + ], + "recommended": true + }, + "fieldName": "registry_value_type", + "displayName": "registry_value_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(registry_value_type) OR registry_value_type=\"\",\"unknown\",registry_value_type)" + }, + { + "calculationID": "Endpoint_Registry_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user account associated with the registry access.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Endpoint_Registry_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the Endpoint solution that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Endpoint_indexes`) tag=endpoint tag=registry", + "children": [ + + ] + } + ] +} diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Event_Signatures.json b/deps/apps/Splunk_SA_CIM/default/data/models/Event_Signatures.json new file mode 100644 index 000000000..f455c4412 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Event_Signatures.json @@ -0,0 +1,136 @@ +{ + "modelName": "Event_Signatures", + "displayName": "Event Signatures", + "description": "Event Signatures Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "track_event_signatures" + ] + }, + "objectName": "Signatures", + "displayName": "Signatures", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "System affected by the signature." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The human readable event name." + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The event name identifier (as supplied by the vendor)." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Signatures_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the technology that reported the event, such as Carbon Black Cb Response. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Event_Signatures_indexes`) tag=track_event_signatures (signature=* OR signature_id=*)" + } + ], + "children": [] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Interprocess_Messaging.json b/deps/apps/Splunk_SA_CIM/default/data/models/Interprocess_Messaging.json new file mode 100644 index 000000000..4dc4fc9da --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Interprocess_Messaging.json @@ -0,0 +1,462 @@ +{ + "objectNameList": [ + + ], + "objectSummary": { + + }, + "displayName": "Interprocess Messaging", + "description": "", + "modelName": "Interprocess_Messaging", + "objects": [ + { + "comment": { + "tags": [ + "messaging" + ] + }, + "objectName": "All_Messaging", + "displayName": "All Interprocess Messaging", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of message destination.", + "expected_values": [ + "queue", + "topic" + ], + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of seconds from message call to message response. Can be derived by getting the difference between the request_sent_time and the message_received_time." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The endpoint that the message accessed during the RPC (remote procedure call) transaction." + }, + "fieldName": "endpoint", + "displayName": "endpoint", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The version of the endpoint accessed during the RPC (remote procedure call) transaction, such as 1.0 or 1.22." + }, + "fieldName": "endpoint_version", + "displayName": "endpoint_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The message identification." + }, + "fieldName": "message_id", + "displayName": "message_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A command or reference that an RPC (remote procedure call) reads or responds to." + }, + "fieldName": "message", + "displayName": "message", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the RPC (remote procedure call) read the message and was prepared to take some sort of action." + }, + "fieldName": "message_consumed_time", + "displayName": "message_consumed_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The message correlation identification value." + }, + "fieldName": "message_correlation_id", + "displayName": "message_correlation_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message producer sent the message." + }, + "fieldName": "message_delivered_time", + "displayName": "message_delivered_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The message delivery mode. Possible values depend on the type of message-oriented middleware (MOM) solution in use. They can be words like Transient (meaning the message is stored in memory and is lost if the server dies or restarts) or Persistent (meaning the message is stored both in memory and on disk and is preserved if the server dies or restarts). They can also be numbers like 1, 2, and so on." + }, + "fieldName": "message_delivery_mode", + "displayName": "message_delivery_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message expired." + }, + "fieldName": "message_expiration_time", + "displayName": "message_expiration_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the message. Important jobs that the message queue should answer no matter what receive a higher message_priority than other jobs, ensuring they are completed before the others." + }, + "fieldName": "message_priority", + "displayName": "message_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message was received by a message-oriented middleware (MOM) solution." + }, + "fieldName": "message_received_time", + "displayName": "message_received_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether or not the message was redelivered." + }, + "fieldName": "message_redelivered", + "displayName": "message_redelivered", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the destination for replies to the message." + }, + "fieldName": "message_reply_dest", + "displayName": "message_reply_dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of message, such as call or reply." + }, + "fieldName": "message_type", + "displayName": "message_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "An arbitrary list of message properties. The set of properties displayed depends on the message-oriented middleware (MOM) solution that you are using." + }, + "fieldName": "message_properties", + "displayName": "message_properties", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Arguments that have been passed to an endpoint by a REST call or something similar. A sample parameter could be something like foo=bar." + }, + "fieldName": "parameters", + "displayName": "parameters", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The message payload." + }, + "fieldName": "payload", + "displayName": "payload", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of payload in the message. The payload type can be text (such as json, xml, and raw) or binary (such as compressed, object, encrypted, and image)." + }, + "fieldName": "payload_type", + "displayName": "payload_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The content of the message request." + }, + "fieldName": "request_payload", + "displayName": "request_payload", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of payload in the message request. The payload type can be text (such as json, xml, and raw) or binary (such as compressed, object, encrypted, and image)." + }, + "fieldName": "request_payload_type", + "displayName": "request_payload_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message request was sent." + }, + "fieldName": "request_sent_time", + "displayName": "request_sent_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The response status code sent by the receiving server. Ranges between 200 and 404." + }, + "fieldName": "response_code", + "displayName": "response_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time that the message response was received." + }, + "fieldName": "response_received_time", + "displayName": "response_received_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of payload in the message response. The payload type can be text (such as json, xml, and raw) or binary (such as compressed, object, encrypted, and image)." + }, + "fieldName": "response_payload_type", + "displayName": "response_payload_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The response status message sent by the message server." + }, + "fieldName": "return_message", + "displayName": "return_message", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The protocol that the message server uses for remote procedure calls (RPC). Possible values include HTTP REST, SOAP, and EJB." + }, + "fieldName": "rpc_protocol", + "displayName": "rpc_protocol", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the message response.", + "expected_values": [ + "pass", + "fail" + ] + }, + "fieldName": "status", + "displayName": "status", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_interprocess_messaging_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the message. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + } + ], + "constraints": [ + { + "search": "(`cim_Interprocess_Messaging_indexes`) tag=messaging" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Intrusion_Detection.json b/deps/apps/Splunk_SA_CIM/default/data/models/Intrusion_Detection.json new file mode 100644 index 000000000..2bf0f00f8 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Intrusion_Detection.json @@ -0,0 +1,583 @@ +{ + "modelName": "Intrusion_Detection", + "displayName": "Intrusion Detection", + "description": "Intrusion Detection Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "ids", + "attack" + ] + }, + "objectName": "IDS_Attacks", + "displayName": "IDS Attacks", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The action taken by the intrusion detection system (IDS).", + "expected_values": [ + "allowed", + "blocked" + ] + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The destination port of the intrusion." + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_bunit", + "displayName": "dvc_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_category", + "displayName": "dvc_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_priority", + "displayName": "dvc_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A cryptographic identifier assigned to the file object affected by the event.", + "ta_relevant": false + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the file, such as notepad.exe.", + "ta_relevant": false + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The path of the file, such as C:\\Windows\\System32\\notepad.exe.", + "ta_relevant": false + }, + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The port number of the source." + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The OSI layer 4 (transport) protocol of the intrusion, in lower case." + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "IDS_Attacks_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that detected the intrusion event. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "IDS_Attacks_fillnull_ids_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of IDS that generated the event.", + "expected_values": [ + "network", + "host", + "application", + "wireless" + ], + "recommended": true + }, + "fieldName": "ids_type", + "displayName": "ids_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ids_type) OR ids_type=\"\",\"unknown\",ids_type)" + }, + { + "calculationID": "IDS_Attacks_fillnull_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor-provided category of the triggered signature, such as spyware. Note: This field is a string. Use a category_id field for category ID fields that are integer data types (category_id fields are optional, so they are not included in this table).", + "recommended": true + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(category) OR category=\"\",\"unknown\",category)" + }, + { + "calculationID": "IDS_Attacks_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the intrusion detected on the client (the src), such as PlugAndPlay_BO and JavaScript_Obfuscation_Fre. Note: This is a string value. Use signature_id for numeric indicators. The signature_id field is optional, so it is not included in the model.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "IDS_Attacks_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the network protection event. Note: This field is a string. Use severity_id for severity ID fields that are integer data types. The severity_id field is optional, so it is not included in the model. Also, specific values are required for this field. Use vendor_severity for the vendor's own human readable severity strings, such as Good, Bad, and Really Bad.", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational" + ], + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "IDS_Attacks_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source involved in the attack detected by the IDS. You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "IDS_Attacks_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the attack detected by the intrusion detection system (IDS). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "IDS_Attacks_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user involved with the intrusion detection event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "IDS_Attacks_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the IDS or IPS system that detected the vulnerability, such as HP Tipping Point. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Intrusion_Detection_indexes`) tag=ids tag=attack" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "ids", + "attack" + ] + }, + "objectName": "Application_IDS_Attacks", + "displayName": "Application Intrusion Detection", + "parentName": "IDS_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "ids_type=\"application\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "ids", + "attack" + ] + }, + "objectName": "Host_IDS_Attacks", + "displayName": "Host Intrusion Detection", + "parentName": "IDS_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "ids_type=\"host\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "ids", + "attack" + ] + }, + "objectName": "Network_IDS_Attacks", + "displayName": "Network Intrusion Detection", + "parentName": "IDS_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "ids_type=\"network\"" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/JVM.json b/deps/apps/Splunk_SA_CIM/default/data/models/JVM.json new file mode 100644 index 000000000..81c6b7674 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/JVM.json @@ -0,0 +1,824 @@ +{ + "modelName": "JVM", + "displayName": "JVM", + "description": "Java Virtual Machine Data Model", + "objects": [ + { + "comment": { + "tags": [ + "jvm" + ] + }, + "objectName": "JVM", + "displayName": "JVM", + "parentName": "BaseEvent", + "calculations": [ + + ], + "constraints": [ + { + "search": "(`cim_JVM_indexes`) tag=jvm" + } + ], + "fields": [ + { + "comment": { + "description": "A description field provided in some data sources." + }, + "fieldName": "jvm_description", + "displayName": "jvm_description", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "threading" + ] + }, + "objectName": "Threading", + "displayName": "Threading", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=threading" + } + ], + "fields": [ + { + "comment": { + "description": "The total number of threads started in the JVM." + }, + "fieldName": "threads_started", + "displayName": "threads_started", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether thread CPU time measurement is enabled.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cpu_time_enabled", + "displayName": "cpu_time_enabled", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The JVM's current thread count." + }, + "fieldName": "thread_count", + "displayName": "thread_count", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether the JVM supports thread contention monitoring.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cm_supported", + "displayName": "cm_supported", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether thread contention monitoring is enabled.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cm_enabled", + "displayName": "cm_enabled", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether the JVM supports monitoring of ownable synchronizer usage.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "synch_supported", + "displayName": "synch_supported", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The JVM's peak thread count." + }, + "fieldName": "peak_thread_count", + "displayName": "peak_thread_count", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether the JVM supports monitoring of object monitor usage.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "omu_supported", + "displayName": "omu_supported", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The JVM's current daemon count." + }, + "fieldName": "daemon_thread_count", + "displayName": "daemon_thread_count", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "User-space time taken by the JVM, in seconds." + }, + "fieldName": "current_user_time", + "displayName": "current_user_time", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Indicates whether the Java virtual machine supports CPU time measurement for the current thread.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cpu_time_supported", + "displayName": "cpu_time_supported", + "type": "boolean", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "CPU-space time taken by the JVM, in seconds." + }, + "fieldName": "current_cpu_time", + "displayName": "current_cpu_time", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "runtime" + ] + }, + "objectName": "Runtime", + "displayName": "Runtime", + "parentName": "JVM", + "constraints": [ + { + "search": "tag=runtime" + } + ], + "fields": [ + { + "comment": { + "description": "Version of the JVM." + }, + "fieldName": "version", + "displayName": "version", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Uptime of the JVM process, in seconds." + }, + "fieldName": "uptime", + "displayName": "uptime", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Start time of the JVM process." + }, + "fieldName": "start_time", + "displayName": "start_time", + "type": "timestamp", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Process name of the JVM process." + }, + "fieldName": "process_name", + "displayName": "process_name", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ], + "calculations": [ + { + "calculationID": "Runtime_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The JVM product or service. This field can be automatically populated by the the vendor and product fields in your raw data." + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "os" + ] + }, + "objectName": "OS", + "displayName": "OS", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=os" + } + ], + "fields": [ + { + "comment": { + "description": "OS version that the JVM is running on." + }, + "fieldName": "os_version", + "displayName": "os_version", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Swap memory space available to the OS that the JVM is running on, in bytes." + }, + "fieldName": "swap_space", + "displayName": "swap_space", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Physical memory available to the OS that the JVM is running on, in bytes." + }, + "fieldName": "physical_memory", + "displayName": "physical_memory", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "System load of the OS that the JVM is running on." + }, + "fieldName": "system_load", + "displayName": "system_load", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Amount of CPU time taken by the JVM, in seconds." + }, + "fieldName": "cpu_time", + "displayName": "cpu_time", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "OS that the JVM is running on." + }, + "fieldName": "os", + "displayName": "os", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Number of file descriptors opened by the JVM." + }, + "fieldName": "open_file_descriptors", + "displayName": "open_file_descriptors", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Maximum file descriptors available to the JVM." + }, + "fieldName": "max_file_descriptors", + "displayName": "max_file_descriptors", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Amount of free swap memory remaining to the JVM, in bytes." + }, + "fieldName": "free_swap", + "displayName": "free_swap", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Amount of free physical memory remaining to the JVM, in bytes." + }, + "fieldName": "free_physical_memory", + "displayName": "free_physical_memory", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Amount of memory committed to the JVM, in bytes." + }, + "fieldName": "committed_memory", + "displayName": "committed_memory", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Total processor cores available to the OS that the JVM is running on." + }, + "fieldName": "total_processors", + "displayName": "total_processors", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "OS architecture that the JVM is running on." + }, + "fieldName": "os_architecture", + "displayName": "os_architecture", + "type": "string", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "compilation" + ] + }, + "objectName": "Compilation", + "displayName": "Compilation", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=compilation" + } + ], + "fields": [ + { + "comment": { + "description": "Time taken by JIT compilation, in seconds." + }, + "fieldName": "compilation_time", + "displayName": "compilation_time", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "classloading" + ] + }, + "objectName": "Classloading", + "displayName": "Classloading", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=classloading" + } + ], + "fields": [ + { + "comment": { + "description": "The total count of classes loaded in the JVM." + }, + "fieldName": "total_loaded", + "displayName": "total_loaded", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The current count of classes loaded in the JVM." + }, + "fieldName": "current_loaded", + "displayName": "current_loaded", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "The total count of classes unloaded from the JVM." + }, + "fieldName": "total_unloaded", + "displayName": "total_unloaded", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + }, + { + "comment": { + "tags": [ + "jvm", + "memory" + ] + }, + "objectName": "Memory", + "displayName": "Memory", + "parentName": "JVM", + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=memory" + } + ], + "fields": [ + { + "comment": { + "description": "Non-heap memory used by the JVM, in bytes." + }, + "fieldName": "non_heap_used", + "displayName": "non_heap_used", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Maximum amount of non-heap memory used by the JVM, in bytes." + }, + "fieldName": "non_heap_max", + "displayName": "non_heap_max", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Initial amount of non-heap memory used by the JVM, in bytes." + }, + "fieldName": "non_heap_initial", + "displayName": "non_heap_initial", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Committed amount of non-heap memory used by the JVM, in bytes." + }, + "fieldName": "non_heap_committed", + "displayName": "non_heap_committed", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Heap memory used by the JVM, in bytes." + }, + "fieldName": "heap_used", + "displayName": "heap_used", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Maximum amount of heap memory used by the JVM, in bytes." + }, + "fieldName": "heap_max", + "displayName": "heap_max", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Initial amount of heap memory used by the JVM, in bytes." + }, + "fieldName": "heap_initial", + "displayName": "heap_initial", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Committed amount of heap memory used by the JVM, in bytes." + }, + "fieldName": "heap_committed", + "displayName": "heap_committed", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + }, + { + "comment": { + "description": "Number of objects pending in the JVM." + }, + "fieldName": "objects_pending", + "displayName": "objects_pending", + "type": "number", + "required": false, + "multivalue": false, + "hidden": false, + "constraints": [ + + ] + } + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Malware.json b/deps/apps/Splunk_SA_CIM/default/data/models/Malware.json new file mode 100644 index 000000000..8d1e12e2f --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Malware.json @@ -0,0 +1,723 @@ +{ + "modelName": "Malware", + "displayName": "Malware", + "description": "Malware Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "malware", + "attack" + ] + }, + "objectName": "Malware_Attacks", + "displayName": "Malware Attacks", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The hash of the file with suspected malware." + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the file with suspected malware." + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The full file path of the file with suspected malware." + }, + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source of the endpoint event, such as a DAT file relay server. You can alias this from more specific fields, such as src_host, src_ip, or src_name." + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the source.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The reported sender of an email-based attack." + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "A URL containing more information about the vulnerability." + }, + "fieldName": "url", + "displayName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Malware_Attacks_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action taken by the reporting device.", + "expected_values": [ + "allowed", + "blocked", + "deferred" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Malware_Attacks_fillnull_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The category of the malware event, such as keylogger or ad-supported program. Note: This is a string value. Use category_id for category ID fields that are integer data types. The category_id field is optional, so it is not included in the data model.", + "recommended": true + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(category) OR category=\"\",\"unknown\",category)" + }, + { + "calculationID": "Malware_Attacks_date", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The date of the malware event.", + "recommended": true + }, + "fieldName": "date", + "displayName": "date", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "strftime(_time, \"%m-%d-%Y\")" + }, + { + "calculationID": "Malware_Attacks_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system that was affected by the malware event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Malware_Attacks_fillnull_dest_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the destination, if applicable.", + "recommended": true + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)" + }, + { + "calculationID": "Malware_Attacks_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the network protection event. Note: This field is a string. Use severity_id for severity ID fields that are integer data types. The severity_id field is optional, so it is not included in the model. Also, specific values are required for this field. Use vendor_severity for the vendor's own human readable severity strings, such as Good, Bad, and Really Bad.", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational" + ], + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "Malware_Attacks_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the malware infection detected on the client (the dest), such as Trojan.Vundo, Spyware.Gaobot, and W32.Nimbda. Note: This is a string value. Use signature_id for signature ID fields that are integer data types. The signature_id field is optional, so it is not included in the data model.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "Malware_Attacks_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user involved in the malware event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Malware_Attacks_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product name of the endpoint protection system, such as Symantec AntiVirus. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Malware_indexes`) tag=malware tag=attack" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "malware", + "attack" + ] + }, + "objectName": "Allowed_Malware", + "displayName": "Allowed Malware", + "parentName": "Malware_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"allowed\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "malware", + "attack" + ] + }, + "objectName": "Blocked_Malware", + "displayName": "Blocked Malware", + "parentName": "Malware_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"blocked\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "malware", + "attack" + ] + }, + "objectName": "Deferred_Malware", + "displayName": "Quarantined Malware", + "parentName": "Malware_Attacks", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=\"deferred\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "malware", + "operations" + ] + }, + "objectName": "Malware_Operations", + "displayName": "Malware Operations", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The event timestamp expressed in Unix time.", + "ta_relevant": false + }, + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_requires_av", + "displayName": "dest_requires_av", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The product version of the malware operations product.", + "recommended": true + }, + "fieldName": "product_version", + "displayName": "product_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The version of the malware signature bundle in a signature update operations event.", + "recommended": true + }, + "fieldName": "signature_version", + "displayName": "signature_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Malware_Operations_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system where the malware operations event occurred.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Malware_Operations_fillnull_dest_nt_domain", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NT domain of the dest system, if applicable.", + "recommended": true + }, + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)" + }, + { + "calculationID": "Malware_Operations_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor product name of the malware operations product.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Malware_indexes`) tag=malware tag=operations | tags outputfield=tag", + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Network_Resolution.json b/deps/apps/Splunk_SA_CIM/default/data/models/Network_Resolution.json new file mode 100644 index 000000000..749524ff6 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Network_Resolution.json @@ -0,0 +1,506 @@ +{ + "modelName": "Network_Resolution", + "displayName": "Network Resolution (DNS)", + "description": "Network Resolution Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "network", + "resolution", + "dns" + ] + }, + "objectName": "DNS", + "displayName": "DNS", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Number of entries in the 'additional' section of the DNS message." + }, + "fieldName": "additional_answer_count", + "displayName": "additional_answer_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of entries in the 'authority' section of the DNS message." + }, + "fieldName": "authority_answer_count", + "displayName": "authority_answer_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the network resolution target, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The destination port number." + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination, if applicable.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time taken by the network resolution event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the DNS event." + }, + "fieldName": "name", + "displayName": "name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of entries that appear in the 'Questions' section of the DNS query.", + "expected_values": [ + "Query", + "IQuery", + "Status", + "Notify", + "Update", + "A", + "MX", + "NS", + "PTR" + ] + }, + "fieldName": "query_type", + "displayName": "query_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The DNS resource record type. For details, see the List of DNS record types on Wikipedia.", + "expected_values": [ + "A", + "DNAME", + "MX", + "NS", + "PTR" + ] + }, + "fieldName": "record_type", + "displayName": "record_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the network resolution event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source of the network resolution event. You can alias this from more specific fields, such as src_host, src_ip, or src_name." + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the source. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source, such as email_server or SOX-compliant. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The port number of the source." + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The transport protocol used by the network resolution event." + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique numerical transaction id of the network resolution event." + }, + "fieldName": "transaction_id", + "displayName": "transaction_id", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time-to-live of the network resolution event, in seconds." + }, + "fieldName": "ttl", + "displayName": "ttl", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "DNS_0fillnull_answer", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Resolved address for the query.", + "recommended": true + }, + "fieldName": "answer", + "displayName": "answer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(answer) OR answer=\"\",\"unknown\",answer)" + }, + { + "calculationID": "DNS_answer_count", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Number of entries in the answer section of the DNS message.", + "ta_relevant": false + }, + "fieldName": "answer_count", + "displayName": "answer_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(answer_count),answer_count,isnotnull(answer),mvcount(answer),1=1,1)" + }, + { + "calculationID": "DNS_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the network resolution event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "DNS_fillnull_message_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Type of DNS message.", + "expected_values": [ + "Query", + "Response" + ], + "recommended": true + }, + "fieldName": "message_type", + "displayName": "message_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(message_type) OR message_type=\"\",\"unknown\",message_type)" + }, + { + "calculationID": "DNS_0fillnull_query", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The domain which needs to be resolved. Applies to messages of type 'Query'.", + "recommended": true + }, + "fieldName": "query", + "displayName": "query", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnull(query) OR query=\"\",\"unknown\",query)" + }, + { + "calculationID": "DNS_query_count", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Number of entries that appear in the 'Questions' section of the DNS query.", + "ta_relevant": false + }, + "fieldName": "query_count", + "displayName": "query_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(query_count),query_count,isnotnull(query),mvcount(query),1=1,1)" + }, + { + "calculationID": "DNS_0fillnull_reply_code_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The numerical id or name of a return code. For details, see the Domain Name System Parameters on the Internet Assigned Numbers Authority (IANA) web site.", + "expected_values": [ + "0", + "NoError", + "1", + "FormErr", + "2", + "ServFail", + "3", + "NXDomain", + "etc." + ], + "recommended": true + }, + "fieldName": "reply_code_id", + "displayName": "reply_code_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(reply_code_id) AND reply_code_id!=\"\",reply_code_id,isnotnull(reply_code) AND reply_code!=\"\",reply_code,1=1,\"unknown\")" + }, + { + "calculationID": "DNS_reply_code", + "calculationType": "Lookup", + "lookupName": "cim_dns_reply_code_lookup", + "lookupInputs": [ + { + "inputField": "reply_code_id", + "lookupField": "reply_code_id" + } + ], + "outputFields": [ + { + "comment": { + "description": "The return code for the response. For details, see the Domain Name System Parameters on the Internet Assigned Numbers Authority (IANA) web site.", + "expected_values": [ + "No Error", + "Format Error", + "Server Failure", + "Non-Existent Domain", + "etc." + ], + "recommended": true + }, + "lookupOutputFieldName": "reply_code", + "fieldName": "reply_code", + "displayName": "reply_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ] + }, + { + "calculationID": "DNS_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor product name of the DNS server. The Splunk platform can derive this field from the fields vendor and product in the raw data, if they exist.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Network_Resolution_indexes`) tag=network tag=resolution tag=dns" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Network_Sessions.json b/deps/apps/Splunk_SA_CIM/default/data/models/Network_Sessions.json new file mode 100644 index 000000000..e07519527 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Network_Sessions.json @@ -0,0 +1,516 @@ +{ + "modelName": "Network_Sessions", + "displayName": "Network Sessions", + "description": "Network Sessions Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "network", + "session" + ] + }, + "objectName": "All_Sessions", + "displayName": "All Sessions", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The action taken by the reporting device." + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the network session event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the network session event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "An indication of the type of network session event." + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the source.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the source.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The external domain name of the client initializing a network session. Not applicable for DHCP events." + }, + "fieldName": "src_dns", + "displayName": "src_dns", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The IP address of the client initializing a network session. Not applicable for DHCP events." + }, + "fieldName": "src_ip", + "displayName": "src_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The MAC address of the client initializing a network session. Not applicable for DHCP events." + }, + "fieldName": "src_mac", + "displayName": "src_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NetBIOS name of the client initializing a network session. Not applicable for DHCP events." + }, + "fieldName": "src_nt_host", + "displayName": "src_nt_host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the user.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the user.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Sessions_fillnull_dest_ip", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The internal IP address allocated to the client initializing a network session. For DHCP and VPN events, this is the IP address leased to the client.", + "recommended": true + }, + "fieldName": "dest_ip", + "displayName": "dest_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(source LIKE \"stream%\" AND isnotnull(yiaddr) AND yiaddr!=\"\",yiaddr,isnull(dest_ip) OR dest_ip=\"\",\"unknown\",1=1,dest_ip)" + }, + { + "calculationID": "All_Sessions_fillnull_dest_mac", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The internal MAC address of the network session client. For DHCP events, this is the MAC address of the client acquiring an IP address lease. For VPN events, this is the MAC address of the client initializing a network session.", + "recommended": true + }, + "fieldName": "dest_mac", + "displayName": "dest_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(source LIKE \"stream%\" AND isnotnull(chaddr) AND chaddr!=\"\",chaddr,isnull(dest_mac) OR dest_mac=\"\",\"unknown\",1=1,dest_mac)" + }, + { + "calculationID": "All_Sessions_fillnull_dest_nt_host", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The NetBIOS name of the client initializing a network session.", + "recommended": true + }, + "fieldName": "dest_nt_host", + "displayName": "dest_nt_host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_nt_host) OR dest_nt_host=\"\",\"unknown\",dest_nt_host)" + }, + { + "calculationID": "All_Sessions_fillnull_dest_dns", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The domain name system address of the destination for a network session event.", + "recommended": true + }, + "fieldName": "dest_dns", + "displayName": "dest_dns", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest_dns) OR dest_dns=\"\",\"unknown\",dest_dns)" + }, + { + "calculationID": "All_Sessions_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user in a network session event, where applicable. For example, a VPN session or an authenticated DHCP event.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "All_Sessions_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The full name of the Dynamic Host Configuration Protocol (DHCP) or DNS server involved in this event including vendor and product name, such as Microsoft DHCP or ISC BIND. This field is generated by combining the values of the vendor and product fields.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Network_Sessions_indexes`) tag=network tag=session" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "session", + "start" + ] + }, + "objectName": "Session_Start", + "displayName": "Session Start", + "parentName": "All_Sessions", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=start" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "session", + "end" + ] + }, + "objectName": "Session_End", + "displayName": "Session End", + "parentName": "All_Sessions", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=end" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "session", + "dhcp" + ] + }, + "objectName": "DHCP", + "displayName": "DHCP", + "parentName": "All_Sessions", + "fields": [ + { + "comment": { + "description": "The duration of the Dynamic Host Configuration Protocol (DHCP) lease, in seconds." + }, + "fieldName": "lease_duration", + "displayName": "lease_duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The consecutive range of possible IP addresses that the Dynamic Host Configuration Protocol (DHCP) server can lease to clients on a subnet. A lease_scope typically defines a single physical subnet on your network to which DHCP services are offered." + }, + "fieldName": "lease_scope", + "displayName": "lease_scope", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=dhcp" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "session", + "vpn" + ] + }, + "objectName": "VPN", + "displayName": "VPN", + "parentName": "All_Sessions", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=vpn" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Network_Traffic.json b/deps/apps/Splunk_SA_CIM/default/data/models/Network_Traffic.json new file mode 100644 index 000000000..c1f53cfd1 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Network_Traffic.json @@ -0,0 +1,1026 @@ +{ + "modelName": "Network_Traffic", + "displayName": "Network Traffic", + "description": "Network Traffic Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "network", + "communicate" + ] + }, + "objectName": "All_Traffic", + "displayName": "All Traffic", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The application protocol of the traffic." + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The 802.11 channel used by a wireless network." + }, + "fieldName": "channel", + "displayName": "channel", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The interface that is listening remotely or receiving packets locally. Can also be referred to as the 'egress interface.'" + }, + "fieldName": "dest_interface", + "displayName": "dest_interface", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The IP address of the destination." + }, + "fieldName": "dest_ip", + "displayName": "dest_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The destination TCP\/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field and use colons instead of dashes, spaces, or no separator." + }, + "fieldName": "dest_mac", + "displayName": "dest_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The destination priority, if applicable.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NATed IPv4 or IPv6 address to which a packet has been sent." + }, + "fieldName": "dest_translated_ip", + "displayName": "dest_translated_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NATed port to which a packet has been sent. Note: Do not translate the values of this field to strings (tcp\/80 is 80, not http)." + }, + "fieldName": "dest_translated_port", + "displayName": "dest_translated_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network zone of the destination." + }, + "fieldName": "dest_zone", + "displayName": "dest_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The direction the packet is traveling.", + "expected_values": [ + "inbound", + "outbound" + ] + }, + "fieldName": "direction", + "displayName": "direction", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time for the completion of the network event, in seconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The ip address of the device." + }, + "fieldName": "dvc_ip", + "displayName": "dvc_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_bunit", + "displayName": "dvc_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_category", + "displayName": "dvc_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The device TCP\/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field and use colons instead of dashes, spaces, or no separator." + }, + "fieldName": "dvc_mac", + "displayName": "dvc_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_priority", + "displayName": "dvc_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network zone of the device." + }, + "fieldName": "dvc_zone", + "displayName": "dvc_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Unique identifier for this traffic stream, such as a netflow, jflow, or cflow." + }, + "fieldName": "flow_id", + "displayName": "flow_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The RFC 2780 or RFC 4443 human-readable code value of the traffic, such as Destination Unreachable or Parameter Problem . See the ICMP Type Numbers and the ICMPv6 Type Numbers." + }, + "fieldName": "icmp_code", + "displayName": "icmp_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The RFC 2780 or RFC 4443 numeric value of the traffic. See the ICMP Type Numbers and the ICMPv6 Type Numbers.", + "expected_values": [ + "0-254" + ] + }, + "fieldName": "icmp_type", + "displayName": "icmp_type", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric identifier of the process assigned by the operating system." + }, + "fieldName": "process_id", + "displayName": "process_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The OSI layer 3 (network) protocol of the traffic observed, in lower case. For example, ip, appletalk, ipx." + }, + "fieldName": "protocol", + "displayName": "protocol", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Version of the OSI layer 3 protocol." + }, + "fieldName": "protocol_version", + "displayName": "protocol_version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response in the network event, in seconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The session identifier. Multiple transactions build a session." + }, + "fieldName": "session_id", + "displayName": "session_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the network traffic source.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the network traffic source.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The interface that is listening locally or sending packets remotely. Can also be referred to as the 'ingress interface.'", + "ta_relevant": false + }, + "fieldName": "src_interface", + "displayName": "src_interface", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The ip address of the source." + }, + "fieldName": "src_ip", + "displayName": "src_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source TCP\/IP layer 2 Media Access Control (MAC) address of a packet's destination, such as 06:10:9f:eb:8f:14. Note: Always force lower case on this field and use colons instead of dashes, spaces, or no separator." + }, + "fieldName": "src_mac", + "displayName": "src_mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The priority of the source, if applicable.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NATed IPv4 or IPv6 address from which a packet has been sent." + }, + "fieldName": "src_translated_ip", + "displayName": "src_translated_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The NATed port from which a packet has been sent. Note: Do not translate the values of this field to strings (tcp\/80 is 80, not http)." + }, + "fieldName": "src_translated_port", + "displayName": "src_translated_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The network zone of the source." + }, + "fieldName": "src_zone", + "displayName": "src_zone", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The 802.11 service set identifier (ssid) assigned to a wireless session." + }, + "fieldName": "ssid", + "displayName": "ssid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The TCP flag or multiple flags specified in the event.", + "expected_values": [ + "SYN", + "ACK", + "FIN", + "RST", + "URG", + "PSH" + ] + }, + "fieldName": "tcp_flag", + "displayName": "tcp_flag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The combination of source and destination IP ToS (type of service) values in the event." + }, + "fieldName": "tos", + "displayName": "tos", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The 'time to live' of a packet or diagram, in seconds." + }, + "fieldName": "ttl", + "displayName": "ttl", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The virtual local area network (VLAN) specified in the record." + }, + "fieldName": "vlan", + "displayName": "vlan", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The wireless standard(s) in use, such as 802.11a, 802.11b, 802.11g, or 802.11n." + }, + "fieldName": "wifi", + "displayName": "wifi", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The account associated with the network traffic." + }, + "fieldName": "vendor_account", + "displayName": "vendor_account", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Traffic_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action taken by the network device.", + "expected_values": [ + "allowed", + "blocked", + "teardown" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "All_Traffic_bytes", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Total count of bytes handled by this device\/interface (bytes_in + bytes_out).", + "recommended": true + }, + "fieldName": "bytes", + "displayName": "bytes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes),bytes,isnum(bytes_in) AND isnum(bytes_out),bytes_in+bytes_out,1=1,null())" + }, + { + "calculationID": "All_Traffic_bytes_in", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "How many bytes this device\/interface received.", + "recommended": true + }, + "fieldName": "bytes_in", + "displayName": "bytes_in", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes_in),bytes_in,isnum(bytes) AND isnum(bytes_out),bytes-bytes_out,1=1,null())" + }, + { + "calculationID": "All_Traffic_bytes_out", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "How many bytes this device\/interface transmitted.", + "recommended": true + }, + "fieldName": "bytes_out", + "displayName": "bytes_out", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes_out),bytes_out,isnum(bytes) AND isnum(bytes_in),bytes-bytes_in,1=1,null())" + }, + { + "calculationID": "All_Traffic_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Traffic_fillnull_dest_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination port of the network traffic. Note: Do not translate the value of this field to a string (tcp\/80 is 80, not http). You can set up the corresponding string value in the dest_svc field.", + "recommended": true + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(dest_port),dest_port,0)" + }, + { + "calculationID": "All_Traffic_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The device that reported the traffic event. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "All_Traffic_packets", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total count of packets handled by this device\/interface (packets_in + packets_out)." + }, + "fieldName": "packets", + "displayName": "packets", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(packets),packets,isnum(packets_in) AND isnum(packets_out),packets_in+packets_out,1=1,null())" + }, + { + "calculationID": "All_Traffic_packets_in", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total count of packets received by this device\/interface." + }, + "fieldName": "packets_in", + "displayName": "packets_in", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(packets_in),packets_in,isnum(packets) AND isnum(packets_out),packets-packets_out,1=1,null())" + }, + { + "calculationID": "All_Traffic_packets_out", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total count of packets transmitted by this device\/interface." + }, + "fieldName": "packets_out", + "displayName": "packets_out", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(packets_out),packets_out,isnum(packets) AND isnum(packets_in),packets-packets_in,1=1,null())" + }, + { + "calculationID": "All_Traffic_fillnull_rule", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The rule which defines the action that was taken in the network event. Note: This is a string value. Use rule_id for rule fields that are integer data types. The rule_id field is optional, so it is not included in the data model.", + "recommended": true + }, + "fieldName": "rule", + "displayName": "rule", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(rule) OR rule=\"\",\"unknown\",rule)" + }, + { + "calculationID": "All_Traffic_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source of the network traffic (the client requesting the connection). You can alias this from more specific fields, such as src_host, src_ip, or src_name.", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)" + }, + { + "calculationID": "All_Traffic_fillnull_src_port", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source port of the network traffic. Note: Do not translate the value of this field to a string (tcp\/80 is 80, not http). You can set up the corresponding string value in the src_svc field.", + "recommended": true + }, + "fieldName": "src_port", + "displayName": "src_port", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnum(src_port),src_port,0)" + }, + { + "calculationID": "All_Traffic_fillnull_transport", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The OSI layer 4 (transport) protocol of the traffic observed, in lower case.", + "expected_values": [ + "tcp", + "udp", + "icmp" + ], + "recommended": true + }, + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(transport) OR transport=\"\",\"unknown\",lower(transport))" + }, + { + "calculationID": "All_Traffic_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user that requested the traffic flow.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "All_Traffic_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product of the device generating the network event. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Network_Traffic_indexes`) tag=network tag=communicate" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "communicate" + ] + }, + "objectName": "Traffic_By_Action", + "displayName": "Traffic By Action", + "parentName": "All_Traffic", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=*" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "communicate" + ] + }, + "objectName": "Allowed_Traffic", + "displayName": "Allowed Traffic", + "parentName": "Traffic_By_Action", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=allowed" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "network", + "communicate" + ] + }, + "objectName": "Blocked_Traffic", + "displayName": "Blocked Traffic", + "parentName": "Traffic_By_Action", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "action=blocked" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Performance.json b/deps/apps/Splunk_SA_CIM/default/data/models/Performance.json new file mode 100644 index 000000000..c45c0c003 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Performance.json @@ -0,0 +1,844 @@ +{ + "modelName": "Performance", + "displayName": "Performance", + "description": "Performance Data Model", + "editable": false, + "objects": [ + { + "comment": { + "ta_relevant": false + }, + "objectName": "All_Performance", + "displayName": "All Performance", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The business unit of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the system where the event occurred. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the system where the performance event occurred.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether or not the system where the performance event occurred should time sync. This field is automatically provided by Asset and Identity correlation features of applications like the Splunk App for Enterprise Security.", + "ta_relevant": false + }, + "fieldName": "dest_should_timesync", + "displayName": "dest_should_timesync", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether or not the system where the performance event occurred should update. This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The ID of the virtualization hypervisor." + }, + "fieldName": "hypervisor_id", + "displayName": "hypervisor_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The type of facilities resource involved in the performance event, such as a rack, room, or system." + }, + "fieldName": "resource_type", + "displayName": "resource_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Performance_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system where the event occurred, usually a facilities resource such as a rack or room. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + } + ], + "constraints": [ + { + "search": "(`cim_Performance_indexes`) tag=performance (tag=cpu OR tag=facilities OR tag=memory OR tag=storage OR tag=network OR (tag=os ((tag=time tag=synchronize) OR tag=uptime)))" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "cpu" + ] + }, + "objectName": "CPU", + "displayName": "CPU", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The amount of CPU load reported by the controller in megahertz." + }, + "fieldName": "cpu_load_mhz", + "displayName": "cpu_load_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of CPU load reported by the controller in percentage points.", + "recommended": true + }, + "fieldName": "cpu_load_percent", + "displayName": "cpu_load_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of CPU seconds consumed by processes." + }, + "fieldName": "cpu_time", + "displayName": "cpu_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Percentage of CPU user time consumed by processes." + }, + "fieldName": "cpu_user_percent", + "displayName": "cpu_user_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=cpu" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "facilities" + ] + }, + "objectName": "Facilities", + "displayName": "Facilities", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "Average temperature of the facilities resource, in degrees Celsius.", + "recommended": true + }, + "fieldName": "temperature", + "displayName": "temperature", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Amount of power consumed by the facilities resource, in Kw\/h." + }, + "fieldName": "power", + "displayName": "power", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The speed of the cooling fan in the facilities resource, in rotations per second." + }, + "fieldName": "fan_speed", + "displayName": "fan_speed", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=facilities" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "memory" + ] + }, + "objectName": "Memory", + "displayName": "Memory", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The total amount of memory capacity reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "mem", + "displayName": "mem", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The committed amount of memory reported by the resource, in megabytes." + }, + "fieldName": "mem_committed", + "displayName": "mem_committed", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The free amount of memory reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "mem_free", + "displayName": "mem_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The used amount of memory reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "mem_used", + "displayName": "mem_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total swap space size, in megabytes, if applicable." + }, + "fieldName": "swap", + "displayName": "swap", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The free swap space size, in megabytes, if applicable." + }, + "fieldName": "swap_free", + "displayName": "swap_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The used swap space size, in megabytes, if applicable." + }, + "fieldName": "swap_used", + "displayName": "swap_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=memory" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "storage" + ] + }, + "objectName": "Storage", + "displayName": "Storage", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The array that the resource is a member of, if applicable." + }, + "fieldName": "array", + "displayName": "array", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Block size used by the storage resource, in kilobytes." + }, + "fieldName": "blocksize", + "displayName": "blocksize", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The cluster that the resource is a member of, if applicable." + }, + "fieldName": "cluster", + "displayName": "cluster", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum number of available file descriptors." + }, + "fieldName": "fd_max", + "displayName": "fd_max", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The current number of open file descriptors." + }, + "fieldName": "fd_used", + "displayName": "fd_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latency reported by the resource, in milliseconds." + }, + "fieldName": "latency", + "displayName": "latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The mount point of a storage resource." + }, + "fieldName": "mount", + "displayName": "mount", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A generic indicator of hierarchy. For instance, a disk event might include the array id here." + }, + "fieldName": "parent", + "displayName": "parent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of blocks read." + }, + "fieldName": "read_blocks", + "displayName": "read_blocks", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latency of read operations, in milliseconds." + }, + "fieldName": "read_latency", + "displayName": "read_latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Number of read operations." + }, + "fieldName": "read_ops", + "displayName": "read_ops", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total amount of storage capacity reported by the resource, in megabytes." + }, + "fieldName": "storage", + "displayName": "storage", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The free amount of storage capacity reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "storage_free", + "displayName": "storage_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The percentage of storage capacity reported by the resource that is free.", + "recommended": true + }, + "fieldName": "storage_free_percent", + "displayName": "storage_free_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The used amount of storage capacity reported by the resource, in megabytes.", + "recommended": true + }, + "fieldName": "storage_used", + "displayName": "storage_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The percentage of storage capacity reported by the resource that is used.", + "recommended": true + }, + "fieldName": "storage_used_percent", + "displayName": "storage_used_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of blocks written by the resource." + }, + "fieldName": "write_blocks", + "displayName": "write_blocks", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latency of write operations, in milliseconds." + }, + "fieldName": "write_latency", + "displayName": "write_latency", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total number of write operations processed by the resource." + }, + "fieldName": "write_ops", + "displayName": "write_ops", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=storage" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "network" + ] + }, + "objectName": "Network", + "displayName": "Network", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The current throughput reported by the service, in bytes.", + "recommended": true + }, + "fieldName": "thruput", + "displayName": "thruput", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The maximum possible throughput reported by the service, in bytes." + }, + "fieldName": "thruput_max", + "displayName": "thruput_max", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=network" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "os" + ] + }, + "objectName": "OS", + "displayName": "OS", + "parentName": "All_Performance", + "fields": [ + { + "comment": { + "description": "The event description signature, if available.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=os" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "os", + "time", + "synchronize" + ] + }, + "objectName": "Timesync", + "displayName": "Time Synchronization", + "parentName": "OS", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Timesync_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The result of a time sync event.", + "expected_values": [ + "success", + "failure" + ], + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(action) AND action!=\"\",action,tag=\"success\",\"success\",tag=\"failure\",\"failure\",1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "tag=time tag=synchronize" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "performance", + "os", + "uptime" + ] + }, + "objectName": "Uptime", + "displayName": "System Uptime", + "parentName": "OS", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Uptime_fillnull_uptime", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The uptime of the compute resource, in seconds.", + "recommended": true + }, + "fieldName": "uptime", + "displayName": "uptime", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(uptime) OR uptime=\"\",\"unknown\",uptime)" + } + ], + "constraints": [ + { + "search": "tag=uptime" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Splunk_Audit.json b/deps/apps/Splunk_SA_CIM/default/data/models/Splunk_Audit.json new file mode 100644 index 000000000..2b85da7d5 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Splunk_Audit.json @@ -0,0 +1,1303 @@ +{ + "modelName": "Splunk_Audit", + "displayName": "Splunk Audit Logs", + "description": "Splunk Audit Logs Data Model", + "editable": false, + "objects": [ + { + "objectName": "Datamodel_Acceleration", + "displayName": "Data Model Acceleration", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The number of times the data model summary has been accessed since it was created.", + "ta_relevant": false + }, + "fieldName": "access_count", + "displayName": "access_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The timestamp of the most recent access of the data model summary.", + "ta_relevant": false + }, + "fieldName": "access_time", + "displayName": "access_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The application context in which the data model summary was accessed.", + "ta_relevant": false + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The number of index buckets spanned by the data model acceleration summary.", + "ta_relevant": false + }, + "fieldName": "buckets", + "displayName": "buckets", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total size of the buckets spanned by the data model acceleration summary.", + "ta_relevant": false + }, + "fieldName": "buckets_size", + "displayName": "buckets_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The cron expression used to accelerate the data model.", + "ta_relevant": false + }, + "fieldName": "cron", + "displayName": "cron", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The percentage of the data model summary that is currently complete.", + "ta_relevant": false + }, + "fieldName": "complete", + "displayName": "complete", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the data model accelerated.", + "ta_relevant": false + }, + "fieldName": "datamodel", + "displayName": "datamodel", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "A hash of the current data model contents.", + "ta_relevant": false + }, + "fieldName": "digest", + "displayName": "digest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The earliest time that the data model summary was accessed.", + "ta_relevant": false + }, + "fieldName": "earliest", + "displayName": "earliest", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether the data model acceleration is currently in progress.", + "expected_values": [ + "true", + "false", + "1", + "0" + ], + "ta_relevant": false + }, + "fieldName": "is_inprogress", + "displayName": "is_inprogress", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The text of the last error reported during the data model acceleration.", + "ta_relevant": false + }, + "fieldName": "last_error", + "displayName": "last_error", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The search id of the last acceleration attempt.", + "ta_relevant": false + }, + "fieldName": "last_sid", + "displayName": "last_sid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The most recent acceleration timestamp of the data model.", + "ta_relevant": false + }, + "fieldName": "latest", + "displayName": "latest", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The timestamp of the most recent modification to the data model acceleration.", + "ta_relevant": false + }, + "fieldName": "mod_time", + "displayName": "mod_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The length of time that data model accelerations are retained, in seconds.", + "ta_relevant": false + }, + "fieldName": "retention", + "displayName": "retention", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of storage space the data model's acceleration summary takes up, in bytes.", + "ta_relevant": false + }, + "fieldName": "size", + "displayName": "size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique id of the data model acceleration summary.", + "ta_relevant": false + }, + "fieldName": "summary_id", + "displayName": "summary_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + + ], + "baseSearch": "| `cim_datamodelinfo`", + "children": [ + + ] + }, + { + "comment": { + "ta_relevant": false + }, + "objectName": "Search_Activity", + "displayName": "Search Activity", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The action of the search (granted, completed, cancelled, failed)." + }, + "fieldName": "info", + "displayName": "info", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The earliest time of the search." + }, + "fieldName": "search_et", + "displayName": "search_et", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The latest time of the search." + }, + "fieldName": "search_lt", + "displayName": "search_lt", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The total run time of the search." + }, + "fieldName": "total_run_time", + "displayName": "total_run_time", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "0Search_Activity_user", + "calculationType": "Rex", + "inputField": "_raw", + "outputFields": [ + { + "comment": { + "description": "The name of the user who ran the search." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "user=(?[^,]+), action" + }, + { + "calculationID": "1Search_Activity_datamodel", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the datamodel (for datamodel acceleration searches)." + }, + "fieldName": "datamodel", + "displayName": "datamodel", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(match(savedsearch_name, \"_ACCELERATE_DM_.*\"), replace(savedsearch_name, \"_ACCELERATE_DM_(.*)_ACCELERATE_\", \"\\1\"), match(search, \"'?(\\|\\s+)?summarize.*?id=DM_\"), replace(search, \"'?(?:\\|\\s)?summarize.*?id=DM_([^\\s]+).*\", \"\\1\"), 1=1, null())" + }, + { + "calculationID": "2Search_Activity_search_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The ID of the search." + }, + "fieldName": "search_id", + "displayName": "search_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "trim(search_id, \"'\")" + }, + { + "calculationID": "3Search_Activity_savedsearch_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the saved search." + }, + "fieldName": "savedsearch_name", + "displayName": "savedsearch_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(savedsearch_name=\"\",null(),savedsearch_name)" + }, + { + "calculationID": "4Search_Activity_search", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The SPL search syntax." + }, + "fieldName": "search", + "displayName": "search", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(search) OR search=\"\",null(),search)" + }, + { + "calculationID": "5Search_Activity_search_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The type of search." + }, + "fieldName": "search_type", + "displayName": "search_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(search_type) AND NOT search_type LIKE \"case(%\",search_type,savedsearch_name LIKE \"_ACCELERATE_DM%\", \"dm_acceleration\", search_id LIKE \"scheduler%\", \"scheduled\", search_id LIKE \"rt%\", \"realtime\", search_id LIKE \"subsearch%\", \"subsearch\", (search_id LIKE \"SummaryDirector%\" OR search_id LIKE \"summarize_SummaryDirector%\"), \"summary_director\", 1=1, \"adhoc\")" + }, + { + "calculationID": "6Search_Activity_search_alias", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Short description of the type of search being run, such as the name of the search or the name of the data model being accelerated." + }, + "fieldName": "search_alias", + "displayName": "search_alias", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(datamodel) AND search_id LIKE \"SummaryDirector%\",datamodel.\" Data Model Summary Director\",isnotnull(datamodel),datamodel.\" Data Model Acceleration\",isnotnull(savedsearch_name),savedsearch_name,1=1,null())" + } + ], + "constraints": [ + { + "search": "index=_audit action=search search_id=*" + } + ], + "children": [ + + ] + }, + { + "objectName": "Acceleration_Jobs", + "displayName": "Acceleration Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"dm_acceleration\" OR search_type=\"summary_director\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Adhoc_Jobs", + "displayName": "Adhoc Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"adhoc\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Failed_Jobs", + "displayName": "Failed Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "info=\"failed\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Realtime_Jobs", + "displayName": "Real-time Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"realtime\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Scheduled_Jobs", + "displayName": "Scheduled Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"scheduled\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Subsearch_Jobs", + "displayName": "Subsearch Jobs", + "parentName": "Search_Activity", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "search_type=\"subsearch\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Scheduler_Activity", + "displayName": "Scheduler Activity", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The event timestamp expressed in Unix time.", + "ta_relevant": false + }, + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The app context in which the scheduled search was run.", + "ta_relevant": false + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The host on which the scheduled search was run.", + "ta_relevant": false + }, + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the saved search.", + "ta_relevant": false + }, + "fieldName": "savedsearch_name", + "displayName": "savedsearch_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The search id.", + "ta_relevant": false + }, + "fieldName": "sid", + "displayName": "sid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source associated with the scheduled search.", + "ta_relevant": false + }, + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source type associated with the scheduled search.", + "ta_relevant": false + }, + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The Splunk Server on which the scheduled search runs.", + "ta_relevant": false + }, + "fieldName": "splunk_server", + "displayName": "splunk_server", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the scheduled search.", + "ta_relevant": false + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The user who scheduled the search.", + "ta_relevant": false + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + + ], + "baseSearch": "index=_internal sourcetype=scheduler", + "children": [ + + ] + }, + { + "objectName": "View_Activity", + "displayName": "View Activity", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The app name which contains the view.", + "ta_relevant": false + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": true, + "multivalue": false, + "hidden": false + }, { + "comment": { + "description": "The amount of time spent loading the view (in milliseconds).", + "ta_relevant": false + }, + "fieldName": "spent", + "displayName": "spent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The uniform resource identifier of the view activity.", + "ta_relevant": false + }, + "fieldName": "uri", + "displayName": "uri", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The username of the user who accessed the view.", + "ta_relevant": false + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the view.", + "ta_relevant": false + }, + "fieldName": "view", + "displayName": "view", + "type": "string", + "fieldSearch": "", + "required": true, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "index=_internal sourcetype=splunk_web_access method=GET status=200" + } + ], + "children": [ + + ] + }, + { + "objectName": "Web_Service_Errors", + "displayName": "Web Service Errors", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The event timestamp expressed in Unix time.", + "ta_relevant": false + }, + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The host on which the web service error occurred.", + "ta_relevant": false + }, + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source where the web service error occurred.", + "ta_relevant": false + }, + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source type associated with the web service error.", + "ta_relevant": false + }, + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + + ], + "baseSearch": "index=_internal sourcetype=splunk_web_service tag=error", + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "modaction" + ] + }, + "objectName": "Modular_Actions", + "displayName": "Modular Actions", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The app ID of the app or add-on that owns the action.", + "ta_relevant": false + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Specifies whether the action was executed as an ad hoc action or from a saved search, based on whether a search_name exists.", + "expected_values": [ + "saved", + "adhoc" + ], + "ta_relevant": false + }, + "fieldName": "action_mode", + "displayName": "action_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The status of the action. For example, 'success' or 'failure'.", + "ta_relevant": false + }, + "fieldName": "action_status", + "displayName": "action_status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The component of the modular action script involved in the event. Often used in conjunction with duration.", + "ta_relevant": false + }, + "fieldName": "component", + "displayName": "component", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "How long the action took to complete, in milliseconds.", + "ta_relevant": false + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The id associated with the result of a specific sid. By default, this is the row number of the search, starting with 0.", + "ta_relevant": false + }, + "fieldName": "rid", + "displayName": "rid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The original sid value of a source action, automatically added to an event if it is the product of a previously executed action.", + "ta_relevant": false + }, + "fieldName": "orig_sid", + "displayName": "orig_sid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The rid value of a source action result, automatically added to an event if it is the product of a previously executed action.", + "ta_relevant": false + }, + "fieldName": "orig_rid", + "displayName": "orig_rid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the correlation search that triggered the action. Blank for ad hoc actions.", + "ta_relevant": false + }, + "fieldName": "search_name", + "displayName": "search_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Modular_Actions_fillnull_action_name", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the action.", + "ta_relevant": false + }, + "fieldName": "action_name", + "displayName": "action_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(action_name) AND action_name!=\"\",action_name,sourcetype=\"splunkd\" AND isnotnull(action) AND action!=\"\",action,1=1,\"unknown\")" + }, + { + "calculationID": "Modular_Actions_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The logging string associated with alert action introspection events.", + "ta_relevant": false + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "Modular_Actions_fillnull_sid", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The search id, automatically assigned by splunkd.", + "ta_relevant": false + }, + "fieldName": "sid", + "displayName": "sid", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(sid) OR sid=\"\",\"unknown\",sid)" + }, + { + "calculationID": "Modular_Actions_user_or_owner", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user who triggered an ad hoc alert. Not relevant for actions triggered by searches.", + "ta_relevant": false + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(user) AND user!=\"\",user,owner)" + }, + { + "calculationID": "Modular_Actions_worker", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The worker performing the action.", + "ta_relevant": false + }, + "fieldName": "worker", + "displayName": "worker", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnotnull(worker) AND worker!=\"\",\"unknown\",worker)" + } + ], + "constraints": [ + { + "search": "tag=modaction" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "modaction", + "invocation" + ] + }, + "objectName": "Modular_Action_Invocations", + "displayName": "Modular Action Invocations", + "parentName": "Modular_Actions", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=invocation" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Splunk_CIM_Validation.json b/deps/apps/Splunk_SA_CIM/default/data/models/Splunk_CIM_Validation.json new file mode 100644 index 000000000..c7ca2649e --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Splunk_CIM_Validation.json @@ -0,0 +1,3648 @@ +{ + "modelName": "Splunk_CIM_Validation", + "displayName": "CIM Validation (S.o.S.)", + "description": "This data model is to help check adoption into the CIM. It provides useful objects for making sure things are tagged appropriately and verify key fields for the different models are not missing.", + "editable": false, + "objects": [ + { + "objectName": "Alerts", + "displayName": "Alerts", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Alerts Alerts search", + "children": [ + + ] + }, + { + "objectName": "Application_State", + "displayName": "Application State", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Application_State All_Application_State search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Ports", + "displayName": "Missing Extractions - Ports", + "parentName": "Application_State", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Application_State.is_Ports=1 AND (dest=\"unknown\" OR dest_port=0 OR transport=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Processes", + "displayName": "Missing Extractions - Processes", + "parentName": "Application_State", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "process", + "displayName": "process", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Application_State.is_Processes=1 AND (dest=\"unknown\" OR process=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Services", + "displayName": "Missing Extractions - Services", + "parentName": "Application_State", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "service", + "displayName": "service", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "start_mode", + "displayName": "start_mode", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Application_State.is_Services=1 AND (dest=\"unknown\" OR service=\"unknown\" OR start_mode=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Authentication", + "displayName": "Authentication", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Authentication Authentication search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Authentication", + "displayName": "Missing Extractions Authentication", + "parentName": "Authentication", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR app=\"unknown\" OR src=\"unknown\" OR dest=\"unknown\" OR user=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Certificates", + "displayName": "Certificates", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Certificates All_Certificates search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Certificates", + "displayName": "Missing Extractions Certificates", + "parentName": "Certificates", + "fields": [ + { + "fieldName": "ssl_hash", + "displayName": "ssl_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ssl_issuer", + "displayName": "ssl_issuer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ssl_subject", + "displayName": "ssl_subject", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "ssl_hash=\"unknown\" OR ssl_issuer=\"unknown\" OR ssl_subject=\"unknown\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Change_Analysis", + "displayName": "Change Analysis", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Change_Analysis All_Changes search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Account_Management", + "displayName": "Missing Extractions - Account Management", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Account_Management=1 AND (action=\"unknown\" OR command=\"unknown\" OR dest=\"unknown\" OR object_category=\"unknown\" OR src=\"unknown\" OR user=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Endpoint_Changes", + "displayName": "Missing Extractions - Endpoint Changes", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Endpoint_Changes=1 AND (action=\"unknown\" OR dest=\"unknown\" OR object=\"unknown\" OR object_category=\"unknown\" OR object_path=\"unknown\" OR status=\"unknown\" OR user=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Filesystem_Changes", + "displayName": "Missing Extractions - Filesystem Changes", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object", + "displayName": "object", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_category", + "displayName": "object_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "object_path", + "displayName": "object_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_access_time", + "displayName": "file_access_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_create_time", + "displayName": "file_create_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_modify_time", + "displayName": "file_modify_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_path", + "displayName": "file_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_acl", + "displayName": "file_acl", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "file_size", + "displayName": "file_size", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Endpoint_Changes=1 AND (object_category=file OR object_category=directory) AND (action=\"unknown\" OR dest=\"unknown\" OR object=\"unknown\" OR object_category=\"unknown\" OR object_path=\"unknown\" OR status=\"unknown\" OR user=\"unknown\" OR file_access_time=0 OR file_create_time=0 OR file_hash=\"unknown\" OR file_modify_time=0 OR file_name=\"unknown\" OR file_path=\"unknown\" OR file_acl=\"unknown\" OR file_size=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Network_Changes", + "displayName": "Missing Extractions - Network Changes", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Network_Changes=1 AND (action=\"unknown\" OR command=\"unknown\" OR dvc=\"unknown\" OR user=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Restarts", + "displayName": "Missing Extractions - Restarts", + "parentName": "Change_Analysis", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "command", + "displayName": "command", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Changes.is_Network_Changes=1 AND (action=\"unknown\" OR change_type=\"unknown\") AND (reboot* OR restart*) sourcetype!=stash" + } + ], + "children": [ + + ] + }, + { + "objectName": "Compute_Inventory", + "displayName": "Inventory", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Compute_Inventory All_Inventory search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_CPU", + "displayName": "Missing Extractions - CPU", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_cores", + "displayName": "cpu_cores", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_count", + "displayName": "cpu_count", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_mhz", + "displayName": "cpu_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_CPU=1 AND (dest=\"unknown\" OR NOT (cpu_cores=* OR cpu_count=* OR cpu_mhz=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Memory", + "displayName": "Missing Extractions - Memory", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mem", + "displayName": "mem", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_Memory=1 AND (dest=\"unknown\" OR NOT (mem=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Network", + "displayName": "Missing Extractions - Network", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "interface", + "displayName": "interface", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ip", + "displayName": "ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mac", + "displayName": "mac", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "name", + "displayName": "name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dns", + "displayName": "dns", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_Network=1 AND (dest=\"unknown\" OR NOT (interface=* OR ip=* OR mac=* OR name=* OR dns=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Storage", + "displayName": "Missing Extractions - Storage", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mount", + "displayName": "mount", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage", + "displayName": "storage", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_Storage=1 AND (dest=\"unknown\" OR NOT (mount=* OR storage=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_OS", + "displayName": "Missing Extractions - OS", + "parentName": "Compute_Inventory", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "os", + "displayName": "os", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "version", + "displayName": "version", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Inventory.is_OS=1 AND (dest=\"unknown\" OR NOT (os=* OR version=*))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Databases", + "displayName": "Databases", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Databases All_Databases search", + "children": [ + + ] + }, + { + "objectName": "Email", + "displayName": "Email", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Email All_Email search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_All_Email", + "displayName": "Missing Extractions - All Email", + "parentName": "Email", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR dest=\"unknown\" OR src=\"unknown\" OR src_user=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Interprocess_Messaging", + "displayName": "Interprocess Messaging", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Interprocess_Messaging All_Messaging search", + "children": [ + + ] + }, + { + "objectName": "Intrusion_Detection", + "displayName": "Intrusion Detection", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Intrusion_Detection IDS_Attacks search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_IDS", + "displayName": "Missing Extractions - IDS", + "parentName": "Intrusion_Detection", + "fields": [ + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ids_type", + "displayName": "ids_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(dvc=\"unknown\" OR ids_type=\"unknown\" OR category=\"unknown\" OR signature=\"unknown\" OR severity=\"unknown\" OR src=\"unknown\" OR dest=\"unknown\" OR user=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "JVM", + "displayName": "JVM", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel JVM JVM search", + "children": [ + + ] + }, + { + "objectName": "Malware", + "displayName": "Malware", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Malware Malware_Attacks search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Malware_Attacks", + "displayName": "Missing Extractions - Malware Attacks", + "parentName": "Malware", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR category=\"unknown\" OR signature=\"unknown\" OR dest=\"unknown\" OR dest_nt_domain=\"unknown\" OR user=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Malware_Operations", + "displayName": "Missing Extractions - Malware Operations", + "parentName": "Malware", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest_nt_domain", + "displayName": "dest_nt_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor", + "displayName": "vendor", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "product", + "displayName": "product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "dest=\"unknown\" OR dest_nt_domain=\"unknown\" OR product=\"unknown\" OR (NOT (product_version=* OR signature_version=*)) OR vendor=\"unknown\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Network_Resolution", + "displayName": "Network Resolution", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Network_Resolution DNS search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_DNS", + "displayName": "Missing Extractions - DNS", + "parentName": "Network_Resolution", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "answer", + "displayName": "answer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "query", + "displayName": "query", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "message_type", + "displayName": "message_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "reply_code", + "displayName": "reply_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "src=\"unknown\" OR dest=\"unknown\" OR answer=\"unknown\" OR query=\"unknown\" OR message_type=\"unknown\" OR reply_code=\"unknown\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Network_Sessions", + "displayName": "Network Sessions", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Network_Sessions All_Sessions search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Network_Sessions", + "displayName": "Missing Extractions - Network Sessions", + "parentName": "Network_Sessions", + "fields": [ + { + "fieldName": "dest_ip", + "displayName": "dest_ip", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(dest_ip=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Network_Traffic", + "displayName": "Network Traffic", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Network_Traffic All_Traffic search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Network_Traffic", + "displayName": "Missing Extractions - Network Traffic", + "parentName": "Network_Traffic", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "rule", + "displayName": "rule", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "transport", + "displayName": "transport", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src_port", + "displayName": "src_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR dvc=\"unknown\" OR rule=\"unknown\" OR transport=\"unknown\" OR src=\"unknown\" OR src_port=0 OR dest=\"unknown\" OR dest_port=0 OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Performance", + "displayName": "Performance", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Performance All_Performance search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_CPU", + "displayName": "Missing Extractions - CPU", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_load_mhz", + "displayName": "cpu_load_mhz", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_load_percent", + "displayName": "cpu_load_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_time", + "displayName": "cpu_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "cpu_user_percent", + "displayName": "cpu_user_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_CPU=1 AND ((dest=\"unknown\" OR NOT (cpu_load_mhz=* OR cpu_load_percent=* OR cpu_time=* OR cpu_user_percent=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Facilities", + "displayName": "Missing Extractions - Facilities", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "temperature", + "displayName": "temperature", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "power", + "displayName": "power", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "fan_speed", + "displayName": "fan_speed", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_Facilities=1 AND ((dest=\"unknown\" OR NOT (temperature=* OR power=* OR fan_speed=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Memory", + "displayName": "Missing Extractions - Memory", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mem", + "displayName": "mem", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mem_free", + "displayName": "mem_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mem_used", + "displayName": "mem_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_Memory=1 AND ((dest=\"unknown\" OR NOT (mem=* OR mem_committed=* OR mem_free=* OR mem_used=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Storage", + "displayName": "Missing Extractions - Storage", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "mount", + "displayName": "mount", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage", + "displayName": "storage", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage_free", + "displayName": "storage_free", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage_used", + "displayName": "storage_used", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage_free_percent", + "displayName": "storage_free_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "storage_used_percent", + "displayName": "storage_used_percent", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_Storage=1 AND ((dest=\"unknown\" OR NOT (mount=* OR storage=* OR storage_free=* OR storage_used=* OR storage_free_percent=* OR storage_used_percent=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Network", + "displayName": "Missing Extractions - Network", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "thruput", + "displayName": "thruput", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "thruput_max", + "displayName": "thruput_max", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_Network=1 AND ((dest=\"unknown\" OR NOT (thruput=* OR thruput_max=*)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Timesync", + "displayName": "Missing Time Synchronization Extractions", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_OS=1 AND (tag=time tag=synchronize (dest=\"unknown\" OR action=\"unknown\"))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Perf_Uptime", + "displayName": "Missing Extractions - Uptime", + "parentName": "Performance", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Performance.is_OS=1 AND (tag=uptime (dest=\"unknown\" OR uptime=\"unknown\"))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Splunk_Audit", + "displayName": "Splunk Audit", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Splunk_Audit View_Activity search", + "children": [ + + ] + }, + { + "objectName": "Ticket_Management", + "displayName": "Ticket Management", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Ticket_Management All_Ticket_Management search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_All_Ticket_Managment", + "displayName": "Missing Extractions - All Ticket Management", + "parentName": "Ticket_Management", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "ticket_id", + "displayName": "ticket_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "dest=\"unknown\" OR ticket_id=\"unknown\"" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Incident", + "displayName": "Missing Extractions - Incident", + "parentName": "Ticket_Management", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "incident", + "displayName": "incident", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Ticket_Management.is_Incident=1 AND (dest=\"unknown\" OR incident=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Problem", + "displayName": "Missing Extractions - Problem", + "parentName": "Ticket_Management", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "problem", + "displayName": "problem", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Ticket_Management.is_Problem=1 AND (dest=\"unknown\" OR problem=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Change", + "displayName": "Missing Extractions - Change(S.o.S)", + "parentName": "Ticket_Management", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "change", + "displayName": "change", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "All_Ticket_Management.is_Change=1 AND (dest=\"unknown\" OR NOT change=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Updates", + "displayName": "Updates", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Updates Updates search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Updates", + "displayName": "Missing Extractions", + "parentName": "Updates", + "fields": [ + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(dest=\"unknown\" OR signature=\"unknown\" OR signature_id=\"unknown\" OR status=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Vulnerabilities", + "displayName": "Vulnerabilities", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Vulnerabilities Vulnerabilities search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Vulnerabilities", + "displayName": "Missing Extractions - Vulnerabilities", + "parentName": "Vulnerabilities", + "fields": [ + { + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(dvc=\"unknown\" OR category=\"unknown\" OR signature=\"unknown\" OR severity=\"unknown\" OR dest=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Web", + "displayName": "Web", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "| datamodel Web Web search", + "children": [ + + ] + }, + { + "objectName": "Missing_Extractions_Web", + "displayName": "Missing Extractions - Web", + "parentName": "Web", + "fields": [ + { + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "http_content_type", + "displayName": "http_content_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "http_method", + "displayName": "http_method", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "http_referrer", + "displayName": "http_referrer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "http_user_agent", + "displayName": "http_user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "url", + "displayName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(action=\"unknown\" OR dest=\"unknown\" OR http_content_type=\"unknown\" OR http_method=\"unknown\" OR http_referrer=\"unknown\" OR http_user_agent=\"unknown\" OR src=\"unknown\" OR status=\"unknown\" OR url=\"unknown\" OR user=\"unknown\" OR vendor_product=\"unknown\")" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Events", + "displayName": "Untagged Events", + "parentName": "BaseSearch", + "fields": [ + { + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "baseSearch": "*", + "children": [ + + ] + }, + { + "objectName": "Untagged_Ports", + "displayName": "Untagged Port Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(listen OR listening OR open) (port OR ports) sourcetype!=stash NOT (tag=listening tag=port)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Processes", + "displayName": "Untagged Process Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(process) sourcetype!=stash NOT (tag=process tag=report)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Services", + "displayName": "Untagged Service Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(running OR stopped OR runlevel* OR service) sourcetype!=stash NOT (tag=service tag=report)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Authentication", + "displayName": "Untagged Authentication", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(login OR \"log in\" OR authenticated) sourcetype!=stash NOT tag=authentication" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Changes", + "displayName": "Untagged Changes", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(change OR changed OR modify OR modified OR restart* OR reboot*) sourcetype!=stash NOT tag=change" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Email", + "displayName": "Untagged Email", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(postfix OR sendmail OR rcpts OR nrcpts OR recipients OR msgid OR message-id) sourcetype!=stash NOT tag=email" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_IDS", + "displayName": "Untagged Intrusion Detection", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(sourcetype=*idp* OR sourcetype=*ids* OR intrusion OR hip) sourcetype!=stash NOT (tag=ids tag=attack)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Malware_Attacks", + "displayName": "Untagged Malware Attacks", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(virus OR malware OR infection OR infected) sourcetype!=stash NOT (tag=malware tag=attack)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Network_Resolution", + "displayName": "Untagged Network Resolution", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(BIND) sourcetype!=stash NOT (tag=network tag=resolution)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Network_Sessions", + "displayName": "Untagged Network Sessions", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(*dhcp* OR *vpn) sourcetype!=stash NOT (tag=network tag=session)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Network_Traffic", + "displayName": "Untagged Network Traffic", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(accept OR drop) sourcetype!=stash NOT (tag=network tag=communicate)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Perf_CPU", + "displayName": "Untagged CPU Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(cpu OR cputime OR mhz OR ghz) sourcetype!=stash NOT (tag=performance tag=cpu)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Facilities", + "displayName": "Untagged Facilities Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(power OR temperature) sourcetype!=stash NOT (tag=performance tag=facilities)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Memory", + "displayName": "Untagged Process Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(mem OR memory) sourcetype!=stash NOT (tag=performance tag=memory)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Storage", + "displayName": "Untagged Storage Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(mount OR disk OR df) sourcetype!=stash NOT (tag=performance tag=storage)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Network", + "displayName": "Untagged Network Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(net OR network) sourcetype!=stash NOT (tag=performance tag=network)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_OS", + "displayName": "Untagged OS Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "sourcetype!=stash (((uptime OR systemuptime) NOT (tag=performance tag=os tag=uptime)) OR (time sync* NOT (tag=performance tag=os tag=time tag=synchronize)))" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Updates", + "displayName": "Untagged Updates", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(update OR updates OR installed OR \"restart required\" OR available OR patch) sourcetype!=stash NOT (tag=update tag=status)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Vulnerabilities", + "displayName": "Untagged Vulnerabilities", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(sourcetype=*vuln* OR \"vulnerability detected\" OR CVE) sourcetype!=stash NOT (tag=vulnerability tag=report)" + } + ], + "children": [ + + ] + }, + { + "objectName": "Untagged_Web", + "displayName": "Untagged Web Data", + "parentName": "Untagged_Events", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "http sourcetype!=stash NOT (tag=web)" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Ticket_Management.json b/deps/apps/Splunk_SA_CIM/default/data/models/Ticket_Management.json new file mode 100644 index 000000000..775aaa4c0 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Ticket_Management.json @@ -0,0 +1,462 @@ +{ + "modelName": "Ticket_Management", + "displayName": "Ticket Management", + "description": "Ticket Management Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "ticketing" + ] + }, + "objectName": "All_Ticket_Management", + "displayName": "All Ticket Management", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Destinations affected by the service request." + }, + "fieldName": "affect_dest", + "displayName": "affect_dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "Comments about the service request." + }, + "fieldName": "comments", + "displayName": "comments", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The description of the service request." + }, + "fieldName": "description", + "displayName": "description", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the destination.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The relative priority of the service request." + }, + "fieldName": "priority", + "displayName": "priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The relative severity of the service request." + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier of the service request as it pertains to Splunk. For example, 14DA67E8-6084-4FA8-9568-48D05969C522@@_internal@@0533eff241db0d892509be46cd3126e30e0f6046." + }, + "fieldName": "splunk_id", + "displayName": "splunk_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The Splunk application or use case associated with the unique identifier (splunk_id). For example, es_notable." + }, + "fieldName": "splunk_realm", + "displayName": "splunk_realm", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The user or entity that created or triggered the service request, if applicable." + }, + "fieldName": "src_user", + "displayName": "src_user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the user or entity that triggered the service request.", + "ta_relevant": false + }, + "fieldName": "src_user_bunit", + "displayName": "src_user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category associated with the user or entity that triggered the service request.", + "ta_relevant": false + }, + "fieldName": "src_user_category", + "displayName": "src_user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority associated with the user or entity that triggered the service request.", + "ta_relevant": false + }, + "fieldName": "src_user_priority", + "displayName": "src_user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The relative status of the service request." + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The time that the src_user submitted the service request." + }, + "fieldName": "time_submitted", + "displayName": "time_submitted", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the user or entity that is assigned to carry out the service request, if applicable." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The business unit associated with the user or entity that is assigned to carry out the service request, if applicable.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category associated with the user or entity that is assigned to carry out the service request, if applicable.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The priority of the user or entity that is assigned to carry out the service request, if applicable.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "All_Ticket_Management_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the service request. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name." + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "All_Ticket_Management_fillnull_ticket_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "An identification name, code, or number for the service request." + }, + "fieldName": "ticket_id", + "displayName": "ticket_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(ticket_id) OR ticket_id=\"\",\"unknown\",ticket_id)" + } + ], + "constraints": [ + { + "search": "(`cim_Ticket_Management_indexes`) tag=ticketing" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "ticketing", + "change" + ] + }, + "objectName": "Change", + "displayName": "Change", + "parentName": "All_Ticket_Management", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Change_fillnull_change", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Designation for a request for change (RFC) that is raised to modify an IT service to resolve an incident or problem." + }, + "fieldName": "change", + "displayName": "change", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(change) OR change=\"\",\"unknown\",change)" + } + ], + "constraints": [ + { + "search": "tag=change" + } + ] + }, + { + "comment": { + "tags": [ + "ticketing", + "incident" + ] + }, + "objectName": "Incident", + "displayName": "Incident", + "parentName": "All_Ticket_Management", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Incident_fillnull_incident", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The incident that triggered the service request. Can be a rare occurrence, or something that happens more frequently An incident that occurs on a frequent basis can also be classified as a problem." + }, + "fieldName": "incident", + "displayName": "incident", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(incident) OR incident=\"\",\"unknown\",incident)" + } + ], + "constraints": [ + { + "search": "tag=incident" + } + ] + }, + { + "comment": { + "tags": [ + "ticketing", + "problem" + ] + }, + "objectName": "Problem", + "displayName": "Problem", + "parentName": "All_Ticket_Management", + "fields": [ + + ], + "calculations": [ + { + "calculationID": "Problem_fillnull_problem", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "When multiple occurrences of related incidents are observed, they are collectively designated with a single problem value. Problem management differs from the process of managing an isolated incident. Often problems are managed by a specific set of staff and through a problem management process." + }, + "fieldName": "problem", + "displayName": "problem", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(problem) OR problem=\"\",\"unknown\",problem)" + } + ], + "constraints": [ + { + "search": "tag=problem" + } + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Updates.json b/deps/apps/Splunk_SA_CIM/default/data/models/Updates.json new file mode 100644 index 000000000..e304a78a5 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Updates.json @@ -0,0 +1,419 @@ +{ + "modelName": "Updates", + "displayName": "Updates", + "description": "Updates Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "update", + "status" + ] + }, + "objectName": "Updates", + "displayName": "Updates", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_should_update", + "displayName": "dest_should_update", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The device that detected the patch event, such as a patching or configuration management server. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name." + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The name of the patch package that was installed or attempted." + }, + "fieldName": "file_name", + "displayName": "file_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The checksum of the patch package that was installed or attempted." + }, + "fieldName": "file_hash", + "displayName": "file_hash", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The severity associated with the patch event.", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational" + ] + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Updates_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system that is affected by the patch change. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Updates_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the patch requirement detected on the client (the dest), such as MS08-067 or RHBA-2013:0739. Note: This is a string value. Use signature_id for numeric or non-human-readable indicators.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "case(isnotnull(signature) AND signature!=\"\",signature,isnotnull(signature_id) AND signature_id!=\"\" AND signature_id!=\"unknown\",signature_id,1=1,\"unknown\")" + }, + { + "calculationID": "Updates_fillnull_signature_id", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The ID of the patch requirement detected on the client (the src). Note: Use signature for human-readable signature names.", + "recommended": true + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "case(isnotnull(signature_id) AND signature_id!=\"\",signature_id,isnotnull(signature) AND signature!=\"\" AND signature!=\"unknown\",signature,1=1,\"unknown\")" + }, + { + "calculationID": "Updates_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "Indicates the status of a given patch requirement.", + "expected_values": [ + "available", + "installed", + "invalid", + "restart required" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)" + }, + { + "calculationID": "Updates_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product of the patch monitoring product, such as Lumension Patch Manager. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Updates_indexes`) tag=update tag=status" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "update", + "status" + ] + }, + "objectName": "Available_Updates", + "displayName": "Available Updates", + "parentName": "Updates", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "status=\"available\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "update", + "status" + ] + }, + "objectName": "Installed_Updates", + "displayName": "Installed Updates", + "parentName": "Updates", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "status=\"installed\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "update", + "status" + ] + }, + "objectName": "Restart_Required_Updates", + "displayName": "Updates Requiring Restart", + "parentName": "Updates", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "status=\"restart_required\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "update", + "error" + ] + }, + "objectName": "Update_Errors", + "displayName": "Update Errors", + "parentName": "BaseSearch", + "fields": [ + { + "comment": { + "description": "The event timestamp expressed in Unix time.", + "ta_relevant": false + }, + "fieldName": "_time", + "displayName": "_time", + "type": "timestamp", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The host associated with the search.", + "ta_relevant": false + }, + "fieldName": "host", + "displayName": "host", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source associated with the search.", + "ta_relevant": false + }, + "fieldName": "source", + "displayName": "source", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The source type associated with the search.", + "ta_relevant": false + }, + "fieldName": "sourcetype", + "displayName": "sourcetype", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + + ], + "baseSearch": "(`cim_Updates_indexes`) tag=update tag=error", + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Vulnerabilities.json b/deps/apps/Splunk_SA_CIM/default/data/models/Vulnerabilities.json new file mode 100644 index 000000000..9c0bb67f9 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Vulnerabilities.json @@ -0,0 +1,538 @@ +{ + "modelName": "Vulnerabilities", + "displayName": "Vulnerabilities", + "description": "Vulnerabilities Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "vulnerability", + "report" + ] + }, + "objectName": "Vulnerabilities", + "displayName": "Vulnerabilities", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "Numeric indicator of the common vulnerability scoring system." + }, + "fieldName": "cvss", + "displayName": "cvss", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_bunit", + "displayName": "dvc_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_category", + "displayName": "dvc_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dvc_priority", + "displayName": "dvc_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The numeric or vendor specific severity indicator corresponding to the event severity." + }, + "fieldName": "severity_id", + "displayName": "severity_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The unique identifier or event code of the event signature." + }, + "fieldName": "signature_id", + "displayName": "signature_id", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The URL involved in the discovered vulnerability." + }, + "fieldName": "url", + "displayName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The user involved in the discovered vulnerability." + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Vulnerabilities_lower_bugtraq", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The identifier in the vulnerability database provided by the Security Focus website (searchable at http:\/\/www.securityfocus.com\/)." + }, + "fieldName": "bugtraq", + "displayName": "bugtraq", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(bugtraq) AND bugtraq!=\"\",lower(bugtraq),null())" + }, + { + "calculationID": "Vulnerabilities_fillnull_category", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The category of the discovered vulnerability, such as DoS. Note: This field is a string. Use category_id for numeric values. The category_id field is optional and thus is not included in the data model.", + "recommended": true + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(category) OR category=\"\",\"unknown\",category)" + }, + { + "calculationID": "Vulnerabilities_lower_cert", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The identifier in the vulnerability database provided by the US Computer Emergency Readiness Team (US-CERT, searchable at http:\/\/www.kb.cert.org\/vuls\/)." + }, + "fieldName": "cert", + "displayName": "cert", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(cert) AND cert!=\"\",lower(cert),null())" + }, + { + "calculationID": "Vulnerabilities_lower_cve", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The identifier provided in the Common Vulnerabilities and Exposures index (searchable at http:\/\/cve.mitre.org).", + "recommended": true + }, + "fieldName": "cve", + "displayName": "cve", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(cve) AND cve!=\"\",lower(cve),null())" + }, + { + "calculationID": "Vulnerabilities_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The host with the discovered vulnerability. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)" + }, + { + "calculationID": "Vulnerabilities_fillnull_dvc", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The system that discovered the vulnerability. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.", + "recommended": true + }, + "fieldName": "dvc", + "displayName": "dvc", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)" + }, + { + "calculationID": "Vulnerabilities_lower_msft", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The Microsoft Security Advisory number (http:\/\/technet.microsoft.com\/en-us\/security\/advisory\/)." + }, + "fieldName": "msft", + "displayName": "msft", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(msft) AND msft!=\"\",lower(msft),null())" + }, + { + "calculationID": "Vulnerabilities_lower_mskb", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The Microsoft Knowledge Base article number (http:\/\/support.microsoft.com\/kb\/)." + }, + "fieldName": "mskb", + "displayName": "mskb", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(mskb) AND mskb!=\"\",lower(mskb),null())" + }, + { + "calculationID": "Vulnerabilities_fillnull_severity", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The severity of the vulnerability detection event. Specific values are required. Use vendor_severity for the vendor's own human readable strings (such as Good, Bad, and Really Bad). Note: This field is a string. Use severity_id for numeric data types. The severity_id field is optional and not included in the data model.", + "expected_values": [ + "critical", + "high", + "medium", + "low", + "informational" + ], + "recommended": true + }, + "fieldName": "severity", + "displayName": "severity", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(severity) OR severity=\"\",\"unknown\",severity)" + }, + { + "calculationID": "Vulnerabilities_fillnull_signature", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The name of the vulnerability detected on the host, such as HPSBMU02785 SSRT100526 rev.2 - HP LoadRunner Running on Windows, Remote Execution of Arbitrary Code, Denial of Service (DoS). Note: This field has a string value. Use signature_id for numeric indicators. The signature_id field is optional and thus is not included in the data model.", + "recommended": true + }, + "fieldName": "signature", + "displayName": "signature", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(signature) OR signature=\"\",\"unknown\",signature)" + }, + { + "calculationID": "Vulnerabilities_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product that detected the vulnerability. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + }, + { + "calculationID": "Vulnerabilities_lower_xref", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "A cross-reference identifier associated with the vulnerability. In most cases, the xref field contains both the short name of the database being cross-referenced and the unique identifier used in the external database." + }, + "fieldName": "xref", + "displayName": "xref", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + } + ], + "expression": "if(isnotnull(xref) AND xref!=\"\",lower(xref),null())" + } + ], + "constraints": [ + { + "search": "(`cim_Vulnerabilities_indexes`) tag=vulnerability tag=report" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "vulnerability", + "report" + ] + }, + "objectName": "High_Critical_Vulnerabilities", + "displayName": "High Or Critical Vulnerabilities", + "parentName": "Vulnerabilities", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(severity=\"high\" OR severity=\"critical\")" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "vulnerability", + "report" + ] + }, + "objectName": "Medium_Vulnerabilities", + "displayName": "Medium Vulnerabilities", + "parentName": "Vulnerabilities", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "severity=\"medium\"" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "vulnerability", + "report" + ] + }, + "objectName": "Low_Informational_Vulnerabilities", + "displayName": "Low Or Informational Vulnerabilities", + "parentName": "Vulnerabilities", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "(severity=\"low\" OR severity=\"informational\")" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/models/Web.json b/deps/apps/Splunk_SA_CIM/default/data/models/Web.json new file mode 100644 index 000000000..9b44b6749 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/models/Web.json @@ -0,0 +1,806 @@ +{ + "modelName": "Web", + "displayName": "Web", + "description": "Web Data Model", + "editable": false, + "objects": [ + { + "comment": { + "tags": [ + "web" + ] + }, + "objectName": "Web", + "displayName": "Web", + "parentName": "BaseEvent", + "fields": [ + { + "comment": { + "description": "The application detected or hosted by the server/site such as wordpress, splunk, or facebook." + }, + "fieldName": "app", + "displayName": "app", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "Indicates whether the event data is cached or not.", + "expected_values": [ + "true", + "false", + "1", + "0" + ] + }, + "fieldName": "cached", + "displayName": "cached", + "type": "boolean", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The category of traffic, such as may be provided by a proxy server." + }, + "fieldName": "category", + "displayName": "category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The cookie file recorded in the event." + }, + "fieldName": "cookie", + "displayName": "cookie", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_bunit", + "displayName": "dest_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_category", + "displayName": "dest_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The destination port of the web traffic." + }, + "fieldName": "dest_port", + "displayName": "dest_port", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "dest_priority", + "displayName": "dest_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The time taken by the proxy event, in milliseconds." + }, + "fieldName": "duration", + "displayName": "duration", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The amount of time it took to receive a response, if applicable, in milliseconds." + }, + "fieldName": "response_time", + "displayName": "response_time", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The virtual site which services the request, if applicable." + }, + "fieldName": "site", + "displayName": "site", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_bunit", + "displayName": "src_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_category", + "displayName": "src_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "src_priority", + "displayName": "src_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.", + "ta_relevant": false + }, + "fieldName": "tag", + "displayName": "tag", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "The path of the resource served by the webserver or proxy." + }, + "fieldName": "uri_path", + "displayName": "uri_path", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The path of the resource requested by the client." + }, + "fieldName": "uri_query", + "displayName": "uri_query", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_bunit", + "displayName": "user_bunit", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_category", + "displayName": "user_category", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": true, + "hidden": false + }, + { + "comment": { + "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.", + "ta_relevant": false + }, + "fieldName": "user_priority", + "displayName": "user_priority", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + { + "calculationID": "Web_fillnull_action", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The action taken by the server or proxy.", + "recommended": true + }, + "fieldName": "action", + "displayName": "action", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)" + }, + { + "calculationID": "Web_bytes", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The total number of bytes transferred (bytes_in + bytes_out).", + "recommended": true + }, + "fieldName": "bytes", + "displayName": "bytes", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes),bytes,isnum(bytes_in) AND isnum(bytes_out),bytes_in+bytes_out,1=1,null())" + }, + { + "calculationID": "Web_bytes_in", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The number of inbound bytes transferred.", + "recommended": true + }, + "fieldName": "bytes_in", + "displayName": "bytes_in", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes_in),bytes_in,isnum(bytes) AND isnum(bytes_out),bytes-bytes_out,1=1,null())" + }, + { + "calculationID": "Web_bytes_out", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The number of outbound bytes transferred.", + "recommended": true + }, + "fieldName": "bytes_out", + "displayName": "bytes_out", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnum(bytes_out),bytes_out,isnum(bytes) AND isnum(bytes_in),bytes-bytes_in,1=1,null())" + }, + { + "calculationID": "Web_fillnull_dest", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.", + "recommended": true + }, + "fieldName": "dest", + "displayName": "dest", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(dest) OR dest=\"\" OR dest=\"-\",\"unknown\",dest)" + }, + { + "calculationID": "Web_fillnull_http_content_type", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The content-type of the requested HTTP resource.", + "recommended": true + }, + "fieldName": "http_content_type", + "displayName": "http_content_type", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(http_content_type) OR http_content_type=\"\" OR http_content_type=\"-\",\"unknown\",http_content_type)" + }, + { + "calculationID": "Web_fillnull_http_method", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The HTTP method used in the request.", + "expected_values": [ + "GET", + "PUT", + "POST", + "DELETE", + "HEAD", + "OPTIONS", + "CONNECT", + "TRACE" + ], + "recommended": true + }, + "fieldName": "http_method", + "displayName": "http_method", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(http_method) OR http_method=\"\" OR http_method=\"-\",\"unknown\",http_method)" + }, + { + "calculationID": "0Web_fillnull_http_referrer", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The HTTP referrer used in the request. The W3C specification and many implementations misspell this as http_referer. Use a FIELDALIAS to handle both key names.", + "recommended": true + }, + "fieldName": "http_referrer", + "displayName": "http_referrer", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(http_referrer) OR http_referrer=\"\" OR http_referrer=\"-\",\"unknown\",http_referrer)" + }, + { + "calculationID": "1Web_http_referrer_domain", + "calculationType": "Rex", + "inputField": "http_referrer", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the HTTP referrer used in the request.", + "recommended": true + }, + "fieldName": "http_referrer_domain", + "displayName": "http_referrer_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^(?:http|https|ftp):\\\/\\\/(?:[a-zA-Z0-9\\.\\-]+(?::[a-zA-Z0-9]+)?@)?(?[^\\\/:]+)(?::[0-9]+)?" + }, + { + "calculationID": "Web_fillnull_http_user_agent", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user agent used in the request.", + "recommended": true + }, + "fieldName": "http_user_agent", + "displayName": "http_user_agent", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(http_user_agent) OR http_user_agent=\"\" OR http_user_agent=\"-\",\"unknown\",http_user_agent)" + }, + { + "calculationID": "Web_http_user_agent_length", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The length of the user agent used in the request.", + "ta_relevant": false + }, + "fieldName": "http_user_agent_length", + "displayName": "http_user_agent_length", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "len(http_user_agent)" + }, + { + "calculationID": "Web_fillnull_src", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The source of the network traffic (the client requesting the connection).", + "recommended": true + }, + "fieldName": "src", + "displayName": "src", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(src) OR src=\"\" OR src=\"-\",\"unknown\",src)" + }, + { + "calculationID": "Web_fillnull_status", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The HTTP response code indicating the status of the proxy request.", + "expected_values": [ + "100", + "101", + "102", + "200", + "201", + "202", + "203", + "204", + "205", + "206", + "207", + "208", + "226", + "300", + "301", + "302", + "303", + "304", + "305", + "306", + "307", + "308", + "400", + "401", + "402", + "403", + "404", + "405", + "406", + "407", + "408", + "409", + "410", + "411", + "412", + "413", + "414", + "415", + "416", + "417", + "422", + "423", + "424", + "426", + "428", + "429", + "431", + "500", + "501", + "502", + "503", + "504", + "505", + "506", + "507", + "508", + "510", + "511" + ], + "recommended": true + }, + "fieldName": "status", + "displayName": "status", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(status) OR status=\"\" OR status=\"-\",\"unknown\",status)" + }, + { + "calculationID": "0Web_fillnull_url", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The URL of the requested HTTP resource.", + "recommended": true + }, + "fieldName": "url", + "displayName": "url", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(url) OR url=\"\" OR url=\"-\",\"unknown\",url)" + }, + { + "calculationID": "1Web_url_domain", + "calculationType": "Rex", + "inputField": "url", + "outputFields": [ + { + "comment": { + "description": "The domain name contained within the URL of the requested HTTP resource.", + "recommended": true + }, + "fieldName": "url_domain", + "displayName": "url_domain", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "^(?:http|https|ftp):\\\/\\\/(?:[a-zA-Z0-9\\.\\-]+(?::[a-zA-Z0-9]+)?@)?(?[^\\\/:]+)(?::[0-9]+)?" + }, + { + "calculationID": "2Web_url_length", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The length of the URL.", + "ta_relevant": false + }, + "fieldName": "url_length", + "displayName": "url_length", + "type": "number", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "len(url)" + }, + { + "calculationID": "Web_fillnull_user", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The user that requested the HTTP resource.", + "recommended": true + }, + "fieldName": "user", + "displayName": "user", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)" + }, + { + "calculationID": "Web_vendor_product", + "calculationType": "Eval", + "outputFields": [ + { + "comment": { + "description": "The vendor and product of the proxy server, such as Squid Proxy Server. This field can be automatically populated by vendor and product fields in your data.", + "recommended": true + }, + "fieldName": "vendor_product", + "displayName": "vendor_product", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")" + } + ], + "constraints": [ + { + "search": "(`cim_Web_indexes`) tag=web" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "web", + "proxy" + ] + }, + "objectName": "Proxy", + "displayName": "Proxy", + "parentName": "Web", + "fields": [ + + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=proxy" + } + ], + "children": [ + + ] + }, + { + "comment": { + "tags": [ + "web", + "storage" + ] + }, + "objectName": "Storage", + "displayName": "Storage", + "parentName": "Web", + "fields": [ + { + "comment": { + "description": "The name of the bucket or storage account.", + "ta_relevant": false + }, + "fieldName": "storage_name", + "displayName": "storage_name", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The operation performed on the storage account.", + "ta_relevant": false + }, + "fieldName": "operation", + "displayName": "operation", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + }, + { + "comment": { + "description": "The error code that occurred while accessing the storage account.", + "ta_relevant": false + }, + "fieldName": "error_code", + "displayName": "error_code", + "type": "string", + "fieldSearch": "", + "required": false, + "multivalue": false, + "hidden": false + } + ], + "calculations": [ + + ], + "constraints": [ + { + "search": "tag=storage" + } + ], + "children": [ + + ] + } + ] +} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/ui/manager/relaymodaction.xml b/deps/apps/Splunk_SA_CIM/default/data/ui/manager/relaymodaction.xml new file mode 100644 index 000000000..6ac2b5a9c --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/ui/manager/relaymodaction.xml @@ -0,0 +1,67 @@ + +
Relay Modular Action
+ + datainputstats + Relay Modular Action + + + + + + Input name. + + + + + + Remote splunk instance management URI. + + + + + + Description for the remote Splunk instance. + + + + + Label for your API key, must be unique. + + + + + Need to verify certificates between worker and Search Head? + + + + + Filename of client certificate for verification. + + + + + + showonly + NONE + ALL + + + + + + + + + + + + + + Number of seconds to wait before running the command again, or a valid cron + schedule. (leave empty to run this script once) + + + + + + diff --git a/deps/apps/Splunk_SA_CIM/default/data/ui/views/cim_setup.xml b/deps/apps/Splunk_SA_CIM/default/data/ui/views/cim_setup.xml new file mode 100644 index 000000000..cad1b1023 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/ui/views/cim_setup.xml @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/ui/views/datamodel_audit.xml b/deps/apps/Splunk_SA_CIM/default/data/ui/views/datamodel_audit.xml new file mode 100644 index 000000000..c22bdc0a4 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/ui/views/datamodel_audit.xml @@ -0,0 +1,43 @@ + + + + + + + + Top Accelerations By Size + + + sort 18 - size | table datamodel,size(MB) + + + + + + + + + + Top Accelerations By Run Duration + + + sort 18 - runDuration | table datamodel,runDuration + + + + + + + + + + + Acceleration Details + + sort 100 + datamodel | fieldformat earliest=strftime(earliest, "%m/%d/%Y %H:%M:%S") | fieldformat latest=strftime(latest, "%m/%d/%Y %H:%M:%S") | table datamodel,app,cron,retention(days),earliest,latest,is_inprogress,complete(%),size(MB),runDuration(s),last_error + + + +
+ + diff --git a/deps/apps/Splunk_SA_CIM/default/data/ui/views/eventtype_tag_center.xml b/deps/apps/Splunk_SA_CIM/default/data/ui/views/eventtype_tag_center.xml new file mode 100644 index 000000000..a0acc03bf --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/ui/views/eventtype_tag_center.xml @@ -0,0 +1,8 @@ +
+ + + +

This view has been deprecated.

+ + +
\ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/data/ui/views/modaction_api_key.xml b/deps/apps/Splunk_SA_CIM/default/data/ui/views/modaction_api_key.xml new file mode 100644 index 000000000..ed543f08c --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/data/ui/views/modaction_api_key.xml @@ -0,0 +1,10 @@ + + + + + +
+ + + + diff --git a/deps/apps/Splunk_SA_CIM/default/datamodels.conf b/deps/apps/Splunk_SA_CIM/default/datamodels.conf new file mode 100644 index 000000000..570c021f2 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/datamodels.conf @@ -0,0 +1,329 @@ + +## per SPL-66827: data models and their acceleration params (datamodels.conf) must live in the same app + +##################### +## Alerts +##################### +[Alerts] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,cloud + + +##################### +## Application State (Deprecated) +##################### +[Application_State] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 3-58/5 * * * * +acceleration.earliest_time = -1mon +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,listening,port,process,report,service,time,synchronize,update + + +##################### +## Authentication +##################### +[Authentication] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 3-58/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,default,insecure,cleartext,privileged,multifactor,cloud + + +##################### +## Certificates +##################### +[Certificates] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 3-58/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,ssl,tls,network,communicate,cloud + + +##################### +## Change +##################### +[Change] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 2-57/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,account,audit,endpoint,network,delete,cloud + +## This datamodel has been deprecated +[Change_Analysis] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 2-57/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,account,audit,endpoint,network,delete + + +########################## +## Compute Inventory +########################## +[Compute_Inventory] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,cpu,default,interactive,memory,network,snapshot,storage,system,version,tools,user,virtual,cloud + + +########################## +## Databases +########################## +[Databases] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,instance,lock,query,session,stats,tablespace,cloud + + +########################## +## DLP +########################## +[DLP] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 2-57/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,cloud + +########################## +## Data Access +########################## +[Data_Access] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 2-57/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,data,access + + +##################### +## Endpoint +##################### +[Endpoint] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 3-58/5 * * * * +acceleration.earliest_time = -1mon +acceleration.manual_rebuilds = true +acceleration.max_concurrent = 1 +acceleration.schedule_priority = highest +tags_whitelist = pci,change,listening,port,process,report,service,time,synchronize,update,cloud + + +##################### +## Event Signatures +##################### +[Event_Signatures] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 4-59/5 * * * * +acceleration.earliest_time = -1mon +acceleration.manual_rebuilds = true +acceleration.max_concurrent = 1 +acceleration.schedule_priority = highest +tags_whitelist = + + +##################### +## Email +##################### +[Email] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 3-58/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,delivery,content,filter,cloud + + +########################## +## Interprocess Messaging +########################## +[Interprocess_Messaging] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 4-59/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,cloud + + +########################## +## Intrusion Detection +########################## +[Intrusion_Detection] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 4-59/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,misconfiguration,pii,rogue,unauthorized-device,unencrypted,wireless,cloud + + +########################## +## JVM +########################## +[JVM] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,classloading,compilation,memory,os,runtime,threading,cloud + + +########################## +## Malware +########################## +[Malware] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 1-56/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,cloud + + +########################## +## Network Resolution +########################## +[Network_Resolution] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 2-57/5 * * * * +acceleration.earliest_time = -3mon +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,cloud + + +########################## +## Network Sessions +########################## +[Network_Sessions] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 2-57/5 * * * * +acceleration.earliest_time = -3mon +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,start,end,dhcp,vpn,cloud + + +########################## +## Network Traffic +########################## +[Network_Traffic] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 1-56/5 * * * * +acceleration.earliest_time = -3mon +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,cloud + + +########################## +## Performance +########################## +[Performance] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 4-59/5 * * * * +acceleration.earliest_time = -1mon +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = cpu,facilities,failure,memory,network,storage,success,os,time,synchronize,uptime,cloud + + +########################## +## Splunk Audit +########################## +[Splunk_Audit] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = */5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,invocation,cloud + + +########################## +## Ticket Management +########################## +[Ticket_Management] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = */5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,change,incident,problem,cloud + + +########################## +## Updates +########################## +[Updates] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 2-57/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,system,cloud + + +########################## +## Vulnerabilities +########################## +[Vulnerabilities] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = 1-56/5 * * * * +acceleration.earliest_time = -1y +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,misconfiguration,cloud + + +########################## +## Web +########################## +[Web] +acceleration = false +acceleration.allow_old_summaries = true +acceleration.cron_schedule = */5 * * * * +acceleration.earliest_time = -3mon +acceleration.manual_rebuilds = true +acceleration.schedule_priority = highest +tags_whitelist = pci,proxy,web_watchlist,cloud diff --git a/deps/apps/Splunk_SA_CIM/default/eventtypes.conf b/deps/apps/Splunk_SA_CIM/default/eventtypes.conf new file mode 100644 index 000000000..02227b281 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/eventtypes.conf @@ -0,0 +1,34 @@ + +[err0r] +search = NOT sourcetype=stash (error OR failure OR fail OR failed OR fatal) NOT "not an error" +#tag = error + + +###### Common Action Model ###### +[cim_modaction] +search = index=cim_modactions (source=*_modalert.log* OR source=*_modworkflow.log*) sendmodaction +#tags = modaction + +[cim_modaction_invocation] +search = index=cim_modactions (source=*_modalert.log* OR source=*_modworkflow.log*) sendmodaction "signature=\"Invoking modular action\"" +#tags = invocation + + +###### Splunk Internal Eventtypes ###### + +## Splunk Access +[splunk_access] +search = index=_audit "action=login attempt" NOT "action=search" +#tags = application authentication + +## Splunk Endpoint Changes +[splunk_endpoint_change] +search = index=_audit action path isdir NOT "action=search" +#tags = endpoint filesystem + +## Splunk Modular Actions +[splunk_modalert] +search = index=_internal sourcetype=splunkd component=sendmodalert + +[splunk_modalert_invocation] +search = index=_internal sourcetype=splunkd component=sendmodalert "Invoking modular alert action" diff --git a/deps/apps/Splunk_SA_CIM/default/fields.conf b/deps/apps/Splunk_SA_CIM/default/fields.conf new file mode 100644 index 000000000..53e131ee6 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/fields.conf @@ -0,0 +1,9 @@ + +[orig_action_name] +INDEXED_VALUE = false + +[orig_sid] +INDEXED_VALUE = false + +[orig_rid] +INDEXED_VALUE = false \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/indexes.conf b/deps/apps/Splunk_SA_CIM/default/indexes.conf new file mode 100644 index 000000000..8083891b9 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/indexes.conf @@ -0,0 +1,6 @@ + +## Common Action Model Index +[cim_modactions] +homePath = $SPLUNK_DB/cim_modactionsdb/db +coldPath = $SPLUNK_DB/cim_modactionsdb/colddb +thawedPath = $SPLUNK_DB/cim_modactionsdb/thaweddb diff --git a/deps/apps/Splunk_SA_CIM/default/inputs.conf b/deps/apps/Splunk_SA_CIM/default/inputs.conf new file mode 100644 index 000000000..be0cecb64 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/inputs.conf @@ -0,0 +1,20 @@ + +[batch://$SPLUNK_HOME/var/spool/splunk/...stash_common_action_model] +queue = stashparsing +sourcetype = stash_common_action_model +move_policy = sinkhole +crcSalt = + +[batch://$SPLUNK_HOME\var\spool\splunk\...stash_common_action_model] +queue = stashparsing +sourcetype = stash_common_action_model +move_policy = sinkhole +crcSalt = + +[relaymodaction] +interval = 120 +description = Remote Search Head +username = +verify = True +client_cert = +python.version = python3 diff --git a/deps/apps/Splunk_SA_CIM/default/macros.conf b/deps/apps/Splunk_SA_CIM/default/macros.conf new file mode 100644 index 000000000..001d3d0a2 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/macros.conf @@ -0,0 +1,339 @@ + +##################### +## Global +##################### +[get_signature(1)] +args = value +definition = (signature="*$value$*" OR signature_id="*$value$*") + +[make_subject(1)] +args = subjectField +definition = eval "$subjectField$"=case(isnotnull('$subjectField$'), '$subjectField$', isnotnull('$subjectField$_dns'), '$subjectField$_dns', isnotnull('$subjectField$_nt_host'), '$subjectField$_nt_host', isnotnull('$subjectField$_mac'), '$subjectField$_mac', isnotnull('$subjectField$_ip'), '$subjectField$_ip') +errormsg = subject field (arg1) must be one of: host, orig_host, src, dest, or dvc +iseval = 0 +validation = subjectField=="host" OR subjectField=="orig_host" OR subjectField=="src" OR subjectField=="dest" OR subjectField=="dvc" + + +## This macro allows seamless searching of all CIM fields for a given subject (host/orig_host/src/dest/dvc) +## Useful when performing drilldowns/drillacross +## For example, `get_subject(src, 1.2.3.4)` produces (src="1.2.3.4" OR src_ip="1.2.3.4" OR src_mac="1.2.3.4" OR src_nt_host="1.2.3.4" OR src_dns="1.2.3.4") +[get_subject(2)] +args = subjectField, bestmatch +definition = ($subjectField$="$bestmatch$" OR $subjectField$_ip="$bestmatch$" OR $subjectField$_mac="$bestmatch$" OR $subjectField$_nt_host="$bestmatch$" OR $subjectField$_dns="$bestmatch$") +errormsg = subject field (arg1) must be one of: host, orig_host, src, dest, or dvc +iseval = 0 +validation = subjectField=="host" OR subjectField=="orig_host" OR subjectField=="src" OR subjectField=="dest" OR subjectField=="dvc" + + +## This macro allows seamless searching of all CIM fields for a given user (src_user/user) +## This macro also performs inference by searching the $user$_identity fields +[get_user(1)] +args = user +definition = (`get_src_user_only($user$)` OR `get_user_only($user$)`) + +[get_src_user_only(1)] +args = src_user +definition = (src_user="$src_user$" OR src_user_identity="$src_user$") + +[get_user_only(1)] +args = user +definition = (user="$user$" OR user_identity="$user$") + + +## Swap two fields conditionally based on a tag in the event. +# +# The tag must be of the form "swap__" AND +# be in the field named "tagField". +[swap_if_tagged(3)] +args = first, second, tagField +definition = eval swapTmp='$second$' | eval "$second$"=if('$tagField$'="swap_$first$_$second$", '$first$', '$second$') | eval "$first$"=if('$tagField$'="swap_$first$_$second$", swapTmp, '$first$') | fields - swapTmp + + +## Remap fields to account for deficiencies in source data that cannot be +## handled at the TA level. +# +# Rationale: +# +# In some cases IDS systems use the CIM field "src" as the field of interest. +# This is often the case for wireless attacks where the target is a broadcast domain. +# In this case, we want to map "src" into "dest" so it will show up +# in the IDS tracker, but ONLY for certain events. This macro does that and +# is used in many of the base-level macros such as "authentication" to apply such +# transformations globally. +[remap_subjects] +definition = tags outputfield=evtTags | `swap_if_tagged(src, dest, evtTags)` | fields - evtTags + +## vendor_product +[get_vendor_product] +definition = eval vendor_product=case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!="unknown" AND isnotnull(product) AND product!="unknown",vendor." ".product,isnotnull(vendor) AND vendor!="unknown" AND (isnull(product) OR product="unknown"),vendor." unknown",(isnull(vendor) OR vendor="unknown") AND isnotnull(product) AND product!="unknown","unknown ".product,isnotnull(sourcetype),sourcetype,1=1,"unknown") + + +##################### +## Common Action Model +##################### +[modular_action_invocations(2)] +args = sid,rid +definition = tstats summariesonly=false latest(Modular_Actions.action_status) as action_status from datamodel=Splunk_Audit.Modular_Actions where Modular_Actions.action_name!="unknown" (Modular_Actions.sid=$sid$ Modular_Actions.rid=$rid$) OR (Modular_Actions.orig_sid=$sid$ Modular_Actions.orig_rid=$rid$) by _time,nodename,Modular_Actions.action_name,Modular_Actions.sid,Modular_Actions.rid,Modular_Actions.action_mode,Modular_Actions.user span=1s | `drop_dm_object_name("Modular_Actions")` | eventstats latest(action_status) as action_status by action_name,sid,rid | search nodename="Modular_Actions.Modular_Action_Invocations" | sort 0 -_time | join type=outer action_name [| rest splunk_server=local count=0 /services/alerts/alert_actions | spath input=param._cam path=drilldown_uri output=action_drilldown_uri | rename title as action_name,label as action_label | fields action_name,action_label,action_drilldown_uri] | eval action_label=if(isnotnull(action_label),action_label,action_name),epoch_time=_time | fields _time,epoch_time,action_status,action_name,action_label,action_mode,action_drilldown_uri,sid,rid,user + +## Lookups +[cam_action_modes] +definition = inputlookup append=T cam_action_mode_lookup | eval action_mode=lower(action_mode) | dedup action_mode | sort + action_mode + +[cam_action_statuses] +definition = inputlookup append=T cam_action_status_lookup | eval action_status=lower(action_status) | dedup action_status | sort + action_status + +[cam_categories] +definition = inputlookup append=T cam_category_lookup | dedup category | sort + category + +[cam_tasks] +definition = inputlookup append=T cam_task_lookup | eval task=lower(task) | dedup task | sort + task + +[cam_subjects] +definition = inputlookup append=T cam_subject_lookup | eval subject=lower(subject) | dedup subject | sort + subject + +[cam_workers] +definition = inputlookup append=T cam_worker_lookup | append[| makeresults | eval worker_set="local",cam_workers="[\"local\"]"] | dedup worker_set | spath input=cam_workers | where isnotnull('{}') | table worker_set,cam_workers | sort + worker_set + + +##################### +## CIM Filters +##################### +[cim_filter_known_scanners] +definition = NOT (host_category="known_scanner" OR orig_host_category="known_scanner" OR dvc_category="known_scanner" OR src_category="known_scanner" OR dest_category="known_scanner") + +[cim_filter_known_scanners(1)] +args = object +definition = NOT ($object$.host_category="known_scanner" OR $object$.orig_host_category="known_scanner" OR $object$.dvc_category="known_scanner" OR $object$.src_category="known_scanner" OR $object$.dest_category="known_scanner") + +[cim_filter_vuln_severity] +definition = (severity!="informational" AND severity!="low") + +[cim_filter_vuln_severity(1)] +args = object +definition = ($object$.severity!="informational" AND $object$.severity!="low") + +[cim_filter_unknown_values(1)] +args = field +definition = ($field$!="-" $field$!="n/a" $field$!="unknown") + + +##################### +## CIM Lookups +##################### + +###### Access Protection ###### +[cim_access_actions] +definition = inputlookup append=T cim_access_action_lookup | eval action=lower(action) | dedup action + +###### Change Analysis ##### +[cim_endpoint_actions] +definition = inputlookup append=T cim_endpoint_action_lookup | eval action=lower(action) | dedup action | sort + action + +[cim_endpoint_object_categories] +definition = inputlookup append=T cim_endpoint_object_category_lookup | eval object_category=lower(object_category) | dedup object_category | sort + object_category + +## no sort here (severity order dictated by order in file) +[cim_endpoint_severities] +definition = inputlookup append=T cim_endpoint_severity_lookup | eval severity=lower(severity) | dedup severity + +[cim_endpoint_statuses] +definition = inputlookup append=T cim_endpoint_status_lookup | eval status=lower(status) | dedup status | sort + status + +[cim_endpoint_user_types] +definition = inputlookup append=T cim_endpoint_user_type_lookup | eval user_type=lower(user_type) | dedup user_type | sort + user_type + +###### Cloud ###### +[cloud_domains] +definition = inputlookup append=T cim_cloud_domain_lookup + +[cloud_domain_search(1)] +args = field +definition = [| `cloud_domains` | rename domain as $field$ | fields $field$ | format | fields search] + +[cloud_email_search(1)] +args = field +definition = [| `cloud_domains` | search is_email=true | rename domain as $field$ | fields $field$ | format | fields search] + +[cloud_storage_search(1)] +args = field +definition = [| `cloud_domains` | search is_storage=true | rename domain as $field$ | fields $field$ | format | fields search] + +###### Data Loss Prevention ###### +[cim_dlp_actions] +definition = inputlookup append=T cim_dlp_action_lookup | eval action=lower(action) | dedup action | sort + action + +[cim_dlp_object_categories] +definition = inputlookup append=T cim_dlp_object_category_lookup | eval object_category=lower(object_category) | dedup object_category | sort + object_category + +[cim_dlp_types] +definition = inputlookup append=T cim_dlp_type_lookup | eval dlp_type=lower(dlp_type) | dedup dlp_type | sort + dlp_type + +###### DNS ###### +[cim_dns_reply_codes] +definition = inputlookup append=T cim_dns_reply_code_lookup | dedup reply_code | sort + reply_code + +###### Email ###### +[cim_email_protocols] +definition = inputlookup append=T cim_email_protocol_lookup | sort + protocol + +[cim_corporate_email_domains] +definition = inputlookup append=T cim_corporate_email_domain_lookup + +[cim_corporate_email_domain_search(1)] +args = field +definition = [| `cim_corporate_email_domains` | rename domain as $field$ | format | fields search] + +###### IDS ###### + +## no sort here (severity order dictated by order in file) +[cim_ids_severities] +definition = inputlookup append=T cim_ids_severity_lookup | eval severity=lower(severity) | dedup severity + +[cim_ids_types] +definition = inputlookup append=T cim_ids_type_lookup | eval ids_type=lower(ids_type) | dedup ids_type | sort + ids_type + +###### Malware ###### +[cim_malware_actions] +definition = inputlookup append=T cim_malware_action_lookup | eval action=lower(action) | dedup action | sort + action + +###### Traffic ###### +[cim_traffic_actions] +definition = inputlookup append=T cim_traffic_action_lookup | eval action=lower(action) | dedup action | sort + action + +[cim_transport_protocols] +definition = inputlookup append=T cim_transport_protocol_lookup | eval transport=lower(transport) | dedup transport | sort + transport + +###### Proxy ###### +[cim_http_methods] +definition = inputlookup append=T cim_http_method_lookup | eval http_method=lower(http_method) | dedup http_method + +[cim_http_statuses] +definition = inputlookup append=T cim_http_status_lookup + +###### System Updates ###### +[cim_update_statii] +definition = inputlookup append=T cim_update_status_lookup | eval status=lower(status) | dedup status | sort + status + +###### Vendor Product Tracker ###### +[cim_vendor_product_tracker] +definition = inputlookup append=T cim_vendor_product_tracker + +[vendor_product_tracker(1)] +args = model +definition = inputlookup append=T cim_vendor_product_tracker | search model="$model$" + +###### Vulnerabilities ###### +## no sort here (severity order dictated by order in file) +[cim_vuln_severities] +definition = inputlookup append=T cim_vuln_severity_lookup | eval severity=lower(severity) | dedup severity + +##### Web ##### +[cim_corporate_web_domains] +definition = inputlookup append=T cim_corporate_web_domain_lookup + +[cim_corporate_web_domain_search(1)] +args = field +definition = [| `cim_corporate_web_domains` | rename domain as $field$ | format | fields search] + + +##################### +## Data Models +##################### +[add_dm_object_name(1)] +args = object +definition = rename * as "$object$.*" + +## DEPRECATED. +[drop_dm_object_name(1)] +args = object +definition = rename "$object$.*" as * + +## DEPRECATED in favor of | from command. +[datamodel(2)] +args = model,object +definition = datamodel $model$ $object$ search + +[recommended_datamodel_attributes(2)] +args = model,object +definition = datamodel "$model$" "$object$" | spath output=calcs path=calculations{} | spath output=fields path=fields{} | eval outfields=mvappend(fields,NULL,calcs) | mvexpand outfields | spath output=fields input=outfields path=outputFields{} | eval fields=if(isnull(fields),outfields,fields) | mvexpand fields | spath output=field input=fields path=fieldName | spath output=recommended input=fields path=comment.recommended | search recommended="true" | table field | sort field + +## Datamodel index filters +[cim_Alerts_indexes] +definition = () + +## This macro has been deprecated +[cim_Application_State_indexes] +definition = () + +[cim_Authentication_indexes] +definition = () + +[cim_Certificates_indexes] +definition = () + +## This macro has been deprecated +[cim_Change_Analysis_indexes] +definition = () + +[cim_Change_indexes] +definition = () + +[cim_Compute_Inventory_indexes] +definition = () + +[cim_DLP_indexes] +definition = () + +[cim_Databases_indexes] +definition = () + +[cim_Data_Access_indexes] +definition = () + +[cim_Email_indexes] +definition = () + +[cim_Endpoint_indexes] +definition = () + +[cim_Event_Signatures_indexes] +definition = () + +[cim_Interprocess_Messaging_indexes] +definition = () + +[cim_Intrusion_Detection_indexes] +definition = () + +[cim_JVM_indexes] +definition = () + +[cim_Malware_indexes] +definition = () + +[cim_Network_Resolution_indexes] +definition = () + +[cim_Network_Sessions_indexes] +definition = () + +[cim_Network_Traffic_indexes] +definition = () + +[cim_Performance_indexes] +definition = () + +[cim_Ticket_Management_indexes] +definition = () + +[cim_Updates_indexes] +definition = () + +[cim_Vulnerabilities_indexes] +definition = () + +[cim_Web_indexes] +definition = () + +[cim_datamodelinfo] +definition = rest /services/admin/summarization by_tstats=t splunk_server=local count=0 | eval key=replace('title',"tstats:DM_".'eai:acl.app'."_",""),datamodel=replace('summary.id',"DM_".'eai:acl.app'."_","") | join type=left key [| rest /services/data/models splunk_server=local count=0 | table title acceleration.cron_schedule eai:digest | rename title as key | rename acceleration.cron_schedule AS cron] | table datamodel eai:acl.app summary.access_time summary.is_inprogress summary.size summary.latest_time summary.complete summary.buckets_size summary.buckets cron summary.last_error summary.time_range summary.id summary.mod_time eai:digest summary.earliest_time summary.last_sid summary.access_count | rename summary.id AS summary_id, summary.time_range AS retention, summary.earliest_time as earliest, summary.latest_time as latest, eai:digest as digest | rename summary.* AS *, eai:acl.* AS * | sort datamodel diff --git a/deps/apps/Splunk_SA_CIM/default/managed_configurations.conf b/deps/apps/Splunk_SA_CIM/default/managed_configurations.conf new file mode 100644 index 000000000..4a53c0b0f --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/managed_configurations.conf @@ -0,0 +1,39 @@ + +###### Lookups ###### +[lookup:cim_cloud_domain_lookup] +endpoint = /services/data/transforms/lookups/cim_cloud_domain_lookup +label = Cloud Domains +description = List of cloud domains +lookup_type = adhoc + +[lookup:cim_corporate_email_domain_lookup] +endpoint = /services/data/transforms/lookups/cim_corporate_email_domain_lookup +label = Corporate Email Domains +description = List of corporate email domains +lookup_type = adhoc + +[lookup:cim_corporate_web_domain_lookup] +endpoint = /services/data/transforms/lookups/cim_corporate_web_domain_lookup +label = Corporate Web Domains +description = List of corporate web domains +lookup_type = adhoc + +[lookup:cim_vendor_product_tracker] +endpoint = /services/data/transforms/lookups/cim_vendor_product_tracker +label = Vendor/Product Tracker +description = Maintains a list of vendor_product values and the first and list time they have been seen +editable = 0 +lookup_type = search +savedsearch = CIM - Vendor Product Tracker - Lookup Gen + +[lookup:cam_category_lookup] +endpoint = /services/data/transforms/lookups/cam_category_lookup +label = Modular Action Categories +description = List of Modular Action Categories +lookup_type = adhoc + +[lookup:cam_worker_lookup] +endpoint = /services/data/transforms/lookups/cam_worker_lookup +label = Modular Action Workers +description = List of Modular Action Workers +lookup_type = adhoc \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/default/props.conf b/deps/apps/Splunk_SA_CIM/default/props.conf new file mode 100644 index 000000000..102a0a694 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/props.conf @@ -0,0 +1,85 @@ + + +###### Common Action Model Properties ###### +[source::..._mod(alert|workflow).log] +TRANSFORMS-force_index-sourcetype_for_modactions = force_index_cim_modactions,force_sourcetype_cim_modactions + +[source::...modaction_adhoc_rest_handler.log] +sourcetype = modaction:adhoc_rest_handler + +[source::...modaction_invocations_rest_handler.log] +sourcetype = modaction:invocations_rest_handler + +[source::...modaction_queue_handler.log] +sourcetype = modaction:queue_handler + +[source::...relaymodaction.log] +sourcetype = relaymodaction + +[stash_common_action_model] +TRUNCATE = 0 +# only look for ***SPLUNK*** on the first line +HEADER_MODE = firstline +# we can summary index past data, but rarely future data +MAX_DAYS_HENCE = 2 +MAX_DAYS_AGO = 10000 +# 5 years difference between two events +MAX_DIFF_SECS_AGO = 155520000 +MAX_DIFF_SECS_HENCE = 155520000 +TIME_PREFIX = (?m)^\*{3}Common\sAction\sModel\*{3}.*$ +MAX_TIMESTAMP_LOOKAHEAD = 25 +LEARN_MODEL = false +# break .stash_new custom format into events +SHOULD_LINEMERGE = false +BREAK_ONLY_BEFORE_DATE = false +LINE_BREAKER = (\r?\n==##~~##~~ 1E8N3D4E6V5E7N2T9 ~~##~~##==\r?\n) + +TRANSFORMS-0parse_cam_header = orig_action_name_for_stash_cam,orig_sid_for_stash_cam,orig_rid_for_stash_cam,sourcetype_for_stash_cam +TRANSFORMS-1sinkhole_cam_header = sinkhole_cam_header + +###### Data Model Properties ###### +[source::...datamodelsimple.log] +sourcetype = datamodelsimple + +###### Splunk Internal Properties ###### +[audittrail] + +EVAL-action = case(match(_raw,"action\=login\sattempt") AND match(_raw,"info\=succeeded"),"success",match(_raw,"action\=login\sattempt") AND match(_raw,"info\=failed"),"failure",match(_raw,"action\=add"),"created",match(_raw,"action\=delete"),"deleted",match(_raw,"action\=update"),"modified",1=1,action) +EVAL-app = if(match(_raw,"action\=login\sattempt"),"splunk",app) + +FIELDALIAS-dest_for_splunk_access = host as dest + +## eventtype: splunk_endpoint_change +## Required fields: action,dest,object,object_category,status,user +REPORT-1vendor_object_category-vendor_status_for_splunk_endpoint_change = vendor_object_category-vendor_status-for_splunk_endpoint_change +REPORT-2vendor_object-vendor_object_path_for_splunk_endpoint_change = vendor_object-vendor_object_path-for_splunk_endpoint_change +EVAL-vendor_status = if(isdir==0 OR isdir==1, "success", vendor_status) +# CIM-940: map hash to file_hash +EVAL-file_hash=if(isnull(file_hash),hash,file_hash) + +LOOKUP-object_category_for_splunk_access = splunk_object_category_lookup vendor_object_category OUTPUT object_category +LOOKUP-src_for_splunk_access = splunk_src_lookup app OUTPUTNEW src + +FIELDALIAS-object_for_splunk_endpoint_change = vendor_object as object +FIELDALIAS-object_path_for_splunk_endpoint_change = vendor_object_path as object_path +FIELDALIAS-object_attrs_for_splunk_endpoint_change = chgs as object_attrs +# CIM-680: alias uid->user_id +FIELDALIAS-user_id_for_splunk_endpoint_change = uid as user_id +# CIM-680: calculate user based on user_id if user is weak +EVAL-user = if(isnull(user) OR user="n/a" OR user="",user_id,user) +FIELDALIAS-status_for_splunk_endpoint_change = vendor_status as status + +# Field aliases for conformance to Change_Analysis::Filesystem_Changes object +FIELDALIAS-file_acl_for_splunk_filesystem_change = mode as file_acl +FIELDALIAS-file_size_for_splunk_filesystem_change = size as file_size +EVAL-file_modify_time = strptime(modtime, "%a %b %d %H:%M:%S %Y") +FIELDALIAS-file_name_for_splunk_filesystem_change = vendor_object as file_name +FIELDALIAS-file_path_for_splunk_filesystem_change = vendor_object_path as file_path + +REPORT-search_for_audittrail = search_for_audittrail + +[splunkd] +REPORT-signature_for_sendmodalert = signature_for_sendmodalert + +[splunk_web_access] +REPORT-app-view_for_splunk_web_access = app-view_for_splunk_web_access diff --git a/deps/apps/Splunk_SA_CIM/default/restmap.conf b/deps/apps/Splunk_SA_CIM/default/restmap.conf new file mode 100644 index 000000000..2249946db --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/restmap.conf @@ -0,0 +1,74 @@ + +###### Modular Actions: Adhoc Execution Handler ###### +[script:modaction_adhoc_rest_handler] +match = /alerts/modaction_adhoc +#capability = +script = modaction_adhoc_rest_handler.py +scripttype = persist +handler = modaction_adhoc_rest_handler.ModularActionAdhocRestHandler +requireAuthentication = true +output_modes = json +python.version = python3 + +###### Modular Actions: Invocations Search Handler (Deprecated) ###### + +## This script handler is marked for DEPRECATION +[script:modaction_invocations] +match = alerts/modaction_invocations +script = modaction_invocations_rest_handler.py +scripttype = persist +handler = modaction_invocations_rest_handler.ModularActionInvocationsRestHandler +requireAuthentication = true +output_modes = json +python.version = python3 + + +###### Modular Actions: Queue Handler ###### + +[script:modaction_queue_key_handler] +match = /alerts/modaction_queue/key +script = modaction_queue_key_handler.py +scripttype = persist +handler = modaction_queue_key_handler.ModularActionQueueKeyHandler +script.param = {"debug": false} +requireAuthentication = false +output_modes = json +python.version = python3 + +[script:modaction_queue_peek_handler] +match = /alerts/modaction_queue/peek +script = modaction_queue_peek_handler.py +scripttype = persist +handler = modaction_queue_peek_handler.ModularActionQueuePeekHandler +script.param = {"debug": false} +passSystemAuth = true +requireAuthentication = false +output_modes = json +passHttpHeaders = true +python.version = python3 + +[script:modaction_queue_handler] +match = /alerts/modaction_queue/queue +script = modaction_queue_handler.py +scripttype = persist +handler = modaction_queue_handler.ModularActionQueueHandler +script.param = {"debug": false, "max_items": 10} +passPayload = true +passSystemAuth = true +requireAuthentication = true +capability = edit_cam_queue +output_modes = json +python.version = python3 + +[script:modaction_dequeue_handler] +match = /alerts/modaction_queue/dequeue +script = modaction_dequeue_handler.py +scripttype = persist +handler = modaction_dequeue_handler.ModularActionDeQueueHandler +script.param = {"debug": false} +passPayload = true +passSystemAuth = true +requireAuthentication = false +output_modes = json +passHttpHeaders = true +python.version = python3 diff --git a/deps/apps/Splunk_SA_CIM/default/savedsearches.conf b/deps/apps/Splunk_SA_CIM/default/savedsearches.conf new file mode 100644 index 000000000..50989572d --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/savedsearches.conf @@ -0,0 +1,82 @@ + +###### Lookup Generating Searches ###### + +## CIM - Vendor Product Tracker - Lookup Gen Breakdown +## 1 - get vendor_product values from Malware data model +## 2 - field renaming +## 3 - set model="Malware" +## 4 - get vendor_product values from Network_Traffic data model +## 5 - field renaming +## 6 - set model="Network_Traffic" +## 7 - get vendor_product values from Intrusion_Detection data model +## 8 - field renaming +## 9 - set model="Intrusion_Detection" +## 10 - get vendor_product values from Vulnerability namespace +## 11 - field renaming +## 12 - set model="Vulnerabilities" +## 13 - consolidate vendor_product values +## 14 - input existing values +## 15 - consolidate vendor_product values for the second time +## 16 - write lookup +## 17 - purge results +[CIM - Vendor Product Tracker - Lookup Gen] +action.email.sendresults = 0 +cron_schedule = 5,20,35,50 * * * * +description = Maintains a list of vendor_product values and the first and list time they have been seen +dispatch.earliest_time = -30m@m +dispatch.latest_time = +0s +enableSched = 0 +is_visible = false +search = | tstats prestats=true summariesonly=true min(_time),max(_time) from datamodel=Malware.Malware_Attacks by Malware_Attacks.vendor_product | `drop_dm_object_name("Malware_Attacks")` | eval model="Malware" | tstats prestats=true summariesonly=true append=true min(_time),max(_time) from datamodel=Network_Traffic.All_Traffic by All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` | eval model=if(isnull(model),"Network_Traffic",model) | tstats prestats=true summariesonly=true append=true min(_time),max(_time) from datamodel=Intrusion_Detection.IDS_Attacks by IDS_Attacks.vendor_product | `drop_dm_object_name("IDS_Attacks")` | eval model=if(isnull(model),"Intrusion_Detection",model) | tstats prestats=true summariesonly=true append=true min(_time),max(_time) from datamodel=Vulnerabilities.Vulnerabilities by Vulnerabilities.vendor_product | `drop_dm_object_name("Vulnerabilities")` | eval model=if(isnull(model),"Vulnerabilities",model) | stats min(_time) as firstTime,max(_time) as lastTime by vendor_product,model | inputlookup append=true cim_vendor_product_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by vendor_product,model | outputlookup override_if_empty=false cim_vendor_product_tracker | stats count + + +###### Report Searches ###### +[CIM - Top Data Model Accelerations] +description = Maintains a data cube of DMA statistics for use in Datamodel Audit view +dispatchAs = user +dispatch.latest_time = now +is_visible = false +search = | `datamodel("Splunk_Audit", "Datamodel_Acceleration")` | `drop_dm_object_name("Datamodel_Acceleration")` | join type=outer last_sid [| rest splunk_server=local count=0 /services/search/jobs reportSearch=summarize* | rename sid as last_sid | fields last_sid,runDuration] | eval "size(MB)"=round(size/1048576,1), "retention(days)"=if(retention==0,"unlimited",round(retention/86400,1)), "complete(%)"=round(complete*100,1), "runDuration(s)"=round(runDuration,1) + +[CIM - Top Data Model Accelerations By Size] +action.email.reportServerEnabled = 0 +alert.track = 0 +dispatch.latest_time = now +display.general.enablePreview = 1 +display.general.timeRangePicker.show = false +display.general.type = visualizations +display.statistics.rowNumbers = 0 +display.statistics.wrap = 0 +display.visualizations.charting.chart = bar +display.visualizations.charting.drilldown = all +display.visualizations.chartHeight = 350 +display.visualizations.show = 1 +search = | `datamodel("Splunk_Audit", "Datamodel_Acceleration")` | `drop_dm_object_name("Datamodel_Acceleration")` | eval size(MB)=size/1048576 | sort 100 - size | table datamodel,size(MB) + +[CIM - Top Data Model Accelerations By Run Duration] +action.email.reportServerEnabled = 0 +alert.track = 0 +dispatch.latest_time = now +display.general.enablePreview = 1 +display.general.timeRangePicker.show = false +display.general.type = visualizations +display.statistics.rowNumbers = 0 +display.statistics.wrap = 0 +display.visualizations.charting.chart = bar +display.visualizations.charting.drilldown = all +display.visualizations.chartHeight = 350 +display.visualizations.show = 1 +search = | `datamodel("Splunk_Audit", "Datamodel_Acceleration")` | `drop_dm_object_name("Datamodel_Acceleration")` | join type=outer last_sid [| rest splunk_server=local count=0 /services/search/jobs reportSearch=summarize* | rename sid as last_sid | fields last_sid,runDuration] | sort 100 - runDuration | table datamodel,runDuration + +[CIM - Data Model Acceleration Details] +action.email.reportServerEnabled = 0 +alert.track = 0 +dispatch.latest_time = now +display.general.enablePreview = 1 +display.general.timeRangePicker.show = false +display.general.type = statistics +display.statistics.drilldown = row +display.statistics.rowNumbers = 0 +display.statistics.wrap = 0 +display.visualizations.show = 0 +search = | `datamodel("Splunk_Audit", "Datamodel_Acceleration")` | `drop_dm_object_name("Datamodel_Acceleration")` | eval size(MB)=round(size/1048576,1) | eval retention(days)=retention/86400 | eval complete(%)=round(complete*100,1) | sort 100 + datamodel | fieldformat earliest=strftime(earliest, "%m/%d/%Y %H:%M:%S") | fieldformat latest=strftime(latest, "%m/%d/%Y %H:%M:%S") | fields datamodel,app,cron,retention(days),earliest,latest,is_inprogress,complete(%),size(MB),last_error diff --git a/deps/apps/Splunk_SA_CIM/default/searchbnf.conf b/deps/apps/Splunk_SA_CIM/default/searchbnf.conf new file mode 100644 index 000000000..0d7f0250c --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/searchbnf.conf @@ -0,0 +1,42 @@ + +###### datamodelsimple ###### +[datamodelsimple-command] +syntax = datamodelsimple +shortdesc = Returns lists of models, objects, and attributes +description = Depending on the type specified, return lists of datamodels,\ + objects, or attributes.\p\\ + Options:\i\\ + o type - one of models, objects, or attributes\i\\ + o datamodel - The datamodel name. Required for type=objects and type=attributes.\i\\ + o object - The datamodel object name. Required for type=attributes.\i\\ + o nodename - The datamodel object name including lineage. Required for type=attributes in lieu of object. +maintainer = dhazekamp +example1 = | datamodelsimple type=models +comment1 = List data models +example2 = | datamodelsimple type=attributes datamodel=Authentication nodename=Authentication.Failed_Authentication +comment2 = List attributes for the Failed_Authentication object in the Authentication datamodel +generating = true +usage = public +tags = +category = results::generate +related = datamodel, metadata + +[datamodelsimple-options] +syntax = type= +description = Optional parameters for datamodelsimple command. + +[datamodelsimple-option-type] +syntax = models|objects|attributes +description = The list that will be returned. + +[datamodelsimple-option-datamodel] +syntax = datamodel= +description = The datamodel name. Required for type=objects and type=attributes. + +[datamodelsimple-option-object] +syntax = object= +description = The datamodel object name. Required for type=attributes. + +[datamodelsimple-option-nodename] +syntax = nodename= +description = The datamodel object name including lineage. Required for type=attributes in lieu of object. diff --git a/deps/apps/Splunk_SA_CIM/default/tags.conf b/deps/apps/Splunk_SA_CIM/default/tags.conf new file mode 100644 index 000000000..b9fed65cf --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/tags.conf @@ -0,0 +1,84 @@ + +## action +[action=failure] +failure = enabled + +[action=success] +success = enabled + +## default +[is_default=true] +default = enabled + +[src_user_category=default] +default = enabled + +[user_category=default] +default = enabled + +## error +[eventtype=err0r] +error = enabled + +## local +[is_local=true] +local = enabled + +## privileged +[is_privileged=true] +privileged = enabled + +[src_user_category=privileged] +privileged = enabled + +[user_category=privileged] +privileged = enabled + +## remote +[is_remote=true] +remote = enabled + + +###### Common Action Model ###### +[eventtype=cim_modaction] +modaction = enabled + +[eventtype=cim_modaction_invocation] +invocation = enabled + + +###### Endpoint.Filesystem ###### +[object_category=file] +filesystem = enabled + +[object_category=directory] +filesystem = enabled + + +###### Endpoint.Registry ###### +[object_category=registry] +registry = enabled + + +###### Splunk Internal Tags ###### +[eventtype=splunk_access] +application = enabled + +## SPL-30315 - Error with eventtypes on multiple indexes +## Workaround is disabling authentication tag to prevent it from being picked up in tag based searches +#authentication = disabled + +## 4.3.1+ +authentication = enabled + +[eventtype=splunk_endpoint_change] +endpoint = enabled +filesystem = enabled + +## Splunk Modular Actions +## CIM-785: we do not want these polluting tag=modaction/tag=invocation +[eventtype=splunk_modalert] +modaction = disabled + +[eventtype=splunk_modalert_invocation] +invocation = disabled diff --git a/deps/apps/Splunk_SA_CIM/default/transforms.conf b/deps/apps/Splunk_SA_CIM/default/transforms.conf new file mode 100644 index 000000000..c989d9a1c --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/transforms.conf @@ -0,0 +1,375 @@ + +###### Access Protection Transforms ###### +[cim_access_action_lookup] +filename = cim_access_actions.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +###### Common Action Model Transforms ###### +[force_index_cim_modactions] +DEST_KEY = _MetaData:Index +REGEX = . +FORMAT = cim_modactions + +[force_sourcetype_cim_modactions] +SOURCE_KEY = MetaData:Source +DEST_KEY = MetaData:Sourcetype +REGEX = ^.*[\\/](.+)_mod(?:alert|workflow).log$ +FORMAT = sourcetype::modular_alerts:$1 + +[orig_action_name_for_stash_cam] +REGEX = \*{3}Common\sAction\sModel\*{3}.*orig_action_name=\"([^"]+) +FORMAT = $0 orig_action_name::$1 +DEST_KEY = _meta + +[orig_sid_for_stash_cam] +REGEX = \*{3}Common\sAction\sModel\*{3}.*orig_sid=\"([^"]+) +FORMAT = $0 orig_sid::$1 +DEST_KEY = _meta + +[orig_rid_for_stash_cam] +REGEX = \*{3}Common\sAction\sModel\*{3}.*orig_rid=\"([^"]+) +FORMAT = $0 orig_rid::$1 +DEST_KEY = _meta + +[sourcetype_for_stash_cam] +REGEX = \*{3}Common\sAction\sModel\*{3}.*sourcetype=\"([^"]+) +FORMAT = sourcetype::$1 +DEST_KEY = MetaData:Sourcetype + +[sinkhole_cam_header] +REGEX = (?s)^\*{3}Common\sAction\sModel\*{3}[^\n]+\n(.*) +FORMAT = $1 +DEST_KEY = _raw +## Do not truncate _raw to 4096! +LOOKAHEAD = -1 + +[cam_action_mode_lookup] +filename = cam_action_modes.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cam_action_status_lookup] +filename = cam_action_statuses.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cam_category_lookup] +filename = cam_categories.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cam_task_lookup] +filename = cam_tasks.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cam_subject_lookup] +filename = cam_subjects.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cam_worker_lookup] +filename = cam_workers.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + + +###### Data Loss Prevention Transforms ###### +[cim_dlp_action_lookup] +filename = cim_dlp_actions.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_dlp_object_category_lookup] +filename = cim_dlp_object_categories.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_dlp_type_lookup] +filename = cim_dlp_types.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +###### Endpoint Protection Transforms ###### +[cim_malware_action_lookup] +filename = cim_malware_actions.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_update_status_lookup] +filename = cim_update_statii.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +## Endpoint Change Analysis +[cim_endpoint_action_lookup] +filename = cim_endpoint_actions.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_endpoint_object_category_lookup] +filename = cim_endpoint_object_categories.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_endpoint_severity_lookup] +filename = cim_endpoint_severities.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_endpoint_status_lookup] +filename = cim_endpoint_statuses.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_endpoint_user_type_lookup] +filename = cim_endpoint_user_types.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +###### Network Protection ###### +[cim_traffic_action_lookup] +filename = cim_traffic_actions.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_transport_protocol_lookup] +filename = cim_transport_protocols.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +## Cloud +[cim_cloud_domain_lookup] +filename = cim_cloud_domains.csv +match_type = WILDCARD(domain) +max_matches = 1 +reverse_lookup_honor_case_sensitive_match = false + +## DNS +[cim_dns_reply_code_lookup] +filename = cim_dns_reply_codes2.csv +min_matches = 1 +default_match = unknown +case_sensitive_match = false +reverse_lookup_honor_case_sensitive_match = false + +## Email +[cim_email_protocol_lookup] +filename = cim_email_protocols.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_corporate_email_domain_lookup] +filename = cim_corporate_email_domains.csv +match_type = WILDCARD(domain) +max_matches = 1 +reverse_lookup_honor_case_sensitive_match = false + +[cim_src_user_domain] +SOURCE_KEY = src_user +REGEX = .*@(.+) +FORMAT = src_user_domain::$1 + +[cim_email_domain] +SOURCE_KEY = email +REGEX = .*@(.+) +FORMAT = email_domain::$1 + +[cim_recipient_domain] +SOURCE_KEY = recipient +REGEX = .*@(.+) +FORMAT = recipient_domain::$1 + +## IDS +[cim_ids_severity_lookup] +filename = cim_ids_severities.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_ids_type_lookup] +filename = cim_ids_types.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +## Proxy +[cim_http_method_lookup] +filename = cim_http_methods.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +[cim_http_status_lookup] +filename = cim_http_statuses.csv +min_matches = 1 +default_match = unknown +match_type = WILDCARD(status) +reverse_lookup_honor_case_sensitive_match = false + +[cim_http_tld_lookup] +filename = cim_http_tld.csv +case_sensitive_match = false +max_matches = 1 +reverse_lookup_honor_case_sensitive_match = false + +## SSL + +## issuer - https://www.ietf.org/rfc/rfc2253.txt +[cim_ssl_issuer_common_name] +SOURCE_KEY = ssl_issuer +REGEX = CN\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_issuer_common_name::$1 + +[cim_ssl_issuer_country] +SOURCE_KEY = ssl_issuer +REGEX = C\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_issuer_country::$1 + +[cim_ssl_issuer_email] +SOURCE_KEY = ssl_issuer +REGEX = (?:E|emailAddress)\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_issuer_email::$1 + +[cim_ssl_issuer_locality] +SOURCE_KEY = ssl_issuer +REGEX = L\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_issuer_locality::$1 + +[cim_ssl_issuer_organization] +SOURCE_KEY = ssl_issuer +REGEX = O\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_issuer_organization::$1 + +[cim_ssl_issuer_state] +REGEX = ST\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_issuer_state::$1 + +[cim_ssl_issuer_street] +SOURCE_KEY = ssl_issuer +REGEX = STREET\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_issuer_street::$1 + +[cim_ssl_issuer_unit] +SOURCE_KEY = ssl_issuer +REGEX = OU\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_issuer_unit::$1 + +## subject - https://www.ietf.org/rfc/rfc2253.txt +[cim_ssl_subject_common_name] +SOURCE_KEY = ssl_subject +REGEX = CN\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_subject_common_name::$1 + +[cim_ssl_subject_country] +SOURCE_KEY = ssl_subject +REGEX = C\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_subject_country::$1 + +[cim_ssl_subject_email] +SOURCE_KEY = ssl_subject +REGEX = (?:E|emailAddress)\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_subject_email::$1 + +[cim_ssl_subject_locality] +SOURCE_KEY = ssl_subject +REGEX = L\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_subject_locality::$1 + +[cim_ssl_subject_organization] +SOURCE_KEY = ssl_subject +REGEX = O\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_subject_organization::$1 + +[cim_ssl_subject_state] +SOURCE_KEY = ssl_subject +REGEX = ST\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_subject_state::$1 + +[cim_ssl_subject_street] +SOURCE_KEY = ssl_subject +REGEX = STREET\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_subject_street::$1 + +[cim_ssl_subject_unit] +SOURCE_KEY = ssl_subject +REGEX = OU\s*=(.*?)(?=[,;/]\s*(?:[A-Z]+|emailAddress)\s*=|$) +FORMAT = ssl_subject_unit::$1 + +## Vendor Product Tracker +[cim_vendor_product_tracker] +filename = cim_vendor_product_tracker.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +## Vuln +[cim_vuln_severity_lookup] +filename = cim_vuln_severities.csv +reverse_lookup_honor_case_sensitive_match = false +## max_matches=1 unneeded + +## Web +[cim_corporate_web_domain_lookup] +filename = cim_corporate_web_domains.csv +match_type = WILDCARD(domain) +max_matches = 1 +reverse_lookup_honor_case_sensitive_match = false + + +###### Splunk Internal Transforms ###### + +## search activity + +## This transform has been deprecated +[datamodel_for_audittrail] +REGEX = (?:_ACCELERATE_|id=)DM_[^_]+_(.*?)(?:_ACCELERATE|\s) +FORMAT = datamodel::$1 + +## This transform has been deprecated +[savedsearch_name_for_audittrail] +REGEX = savedsearch_name=\"([^\"]+) +FORMAT = savedsearch_name::$1 + +## This transform has been deprecated +[user_for_audittrail] +REGEX = user\=([^,]+) +FORMAT = user::$1 + +## audittrail +[search_for_audittrail] +REGEX = (?s)\,\s*search=\'(.*?)\',\s*autojoin +FORMAT = search::$1 + +[splunk_action_lookup] +filename = splunk_actions.csv +max_matches = 1 +reverse_lookup_honor_case_sensitive_match = false + +[splunk_object_category_lookup] +filename = splunk_object_category.csv +max_matches = 1 +reverse_lookup_honor_case_sensitive_match = false + +[splunk_src_lookup] +filename = splunk_src.csv +max_matches = 1 +reverse_lookup_honor_case_sensitive_match = false + +# The next transform also sets status to "success" by default for +# fschange inputs (i.e., we assume "isdir=(0|1)" means a successful +# filesystem change. +[vendor_object_category-vendor_status-for_splunk_endpoint_change] +REGEX = isdir=(\d) +FORMAT = vendor_object_category::$1 + +[vendor_object-vendor_object_path-for_splunk_endpoint_change] +REGEX = path="(\S+)/(\S+)" +FORMAT = vendor_object_path::$1 vendor_object::$2 + +## splunkd +[signature_for_sendmodalert] +REGEX = sendmodalert.*(Alert\saction\sscript\scompleted|Invoking\smodular\salert\saction) +FORMAT = signature::$1 + +## splunk_web_access +[app-view_for_splunk_web_access] +REGEX = GET (?:/[^/]+){1,2}/app/([^/ ?]+)/([^/ ?]+) +FORMAT = app::$1 view::$2 diff --git a/deps/apps/Splunk_SA_CIM/default/web.conf b/deps/apps/Splunk_SA_CIM/default/web.conf new file mode 100644 index 000000000..f4154eb1a --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/web.conf @@ -0,0 +1,28 @@ + +###### Active Response ##### +[expose:modaction_adhoc] +pattern = alerts/modaction_adhoc +methods = POST + +[expose:modaction_invocations] +pattern = alerts/modaction_invocations +methods = GET + +[expose:modaction_queue_key] +pattern = alerts/modaction_queue/key +methods = GET + +###### CIM Setup ####### +[expose:admin_macros] +pattern = admin/macros + +[expose:admin_macros_ELEMENT] +pattern = admin/macros/* +methods = GET,POST + +[expose:data_models] +pattern = data/models + +[expose:data_models_ELEMENT] +pattern = data/models/* +methods = GET,POST diff --git a/deps/apps/Splunk_SA_CIM/default/workflow_actions.conf b/deps/apps/Splunk_SA_CIM/default/workflow_actions.conf new file mode 100644 index 000000000..1cb818639 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/default/workflow_actions.conf @@ -0,0 +1,20 @@ + +[modaction_invocations] +display_location = event_menu +fields = orig_sid,orig_rid +label = View Adaptive Response Invocations +search.preserve_timerange = true +search.search_string = tag=modaction ((sid=$orig_sid$ rid=$orig_rid$) OR (orig_sid=$orig_sid$ orig_rid=$orig_rid$)) +search.target = blank +search.view = search +type = search + +[modaction_results] +display_location = event_menu +fields = orig_sid,orig_rid +label = View Adaptive Response Results +search.preserve_timerange = true +search.search_string = tag=modaction_result orig_sid=$orig_sid$ orig_rid=$orig_rid$ +search.target = blank +search.view = search +type = search \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lib/__init__.py b/deps/apps/Splunk_SA_CIM/lib/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/deps/apps/Splunk_SA_CIM/lib/cim_actions.py b/deps/apps/Splunk_SA_CIM/lib/cim_actions.py new file mode 100644 index 000000000..1fced420b --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lib/cim_actions.py @@ -0,0 +1,996 @@ +import base64 +import codecs +import collections +import csv + +try: + import http.client as http_client +except ImportError: + import httplib as http_client # noqa +import json +import logging +import logging.handlers +import os +import random +import re +import splunk.rest as rest +import sys +import time + +from timeit import default_timer as timer + +from splunk.clilib.cli_common import getConfKeyValue +from splunk.clilib.bundle_paths import make_splunkhome_path +from splunk.util import mktimegm, normalizeBoolean + +# Python 2+3 basestring +try: + basestring +except NameError: + basestring = str + +# set the maximum allowable CSV field size +# +# The default of the csv module is 128KB; upping to 10MB. See SPL-12117 for +# the background on issues surrounding field sizes. +# (this method is new in python 2.5) +csv.field_size_limit(10485760) + + +def truthy_strint_from_dict(d, k): + return ( + True + if isinstance(d.get(k, None), (basestring, int)) and (d[k] or d[k] == 0) + else False + ) + + +def default_dropexp(x): + """The purpose of this method is to determine whether or not + a key should be dropped. + """ + return ( + (x.startswith("_") and x not in ["_bkt", "_cd", "_raw", "_time"]) + or x.startswith("date_") + or x in ["punct", "sid", "rid", "orig_sid", "orig_rid"] + ) + + +def default_mapexp(x): + """The purpose of this method is to determine whether or not + a key should be mapped to orig_key. + """ + return x.startswith("tag::") or x in [ + "_bkt", + "_cd", + "_time", + "_raw", + "splunk_server", + "index", + "source", + "sourcetype", + "host", + "linecount", + "timestartpos", + "timeendpos", + "eventtype", + "tag", + "search_name", + "event_hash", + "event_id", + ] + + +def parse_mv(mvstr): + grab = False + escape_idx = None + vals = [] + + for c, char in enumerate(mvstr): + if char == "$": + # literal + if c - 1 == escape_idx: + escape_idx = None + elif grab: + nchar = mvstr[c + 1] if len(mvstr) - 1 > c else None + # escape + if nchar == "$": + escape_idx = c + continue + # stop + else: + grab = False + escape_idx = None + continue + # start + else: + grab = True + vals.append("") + continue + + if grab: + vals[-1] += char + + return vals + + +def encode_mv(arr): + # takes list of strs and returns encoded str in __mv_* multivalue format for splunkd + escaped_vals = [i.replace("$", "$$") for i in arr] + return "${}$".format(("$;$").join(escaped_vals)) + + +class InvalidResultID(Exception): + pass + + +class ModularActionFormatter(logging.Formatter): + """An extension to the logging.Formatter base class + Hardcodes "+0000" into default datefmt + Use in conjunction with ModularActionFormatter.converter = time.gmtime + """ + + def formatTime(self, record, datefmt=None): + """ + Return the creation time of the specified LogRecord as formatted text. + + This method should be called from format() by a formatter which + wants to make use of a formatted time. This method can be overridden + in formatters to provide for any specific requirement, but the + basic behaviour is as follows: if datefmt (a string) is specified, + it is used with time.strftime() to format the creation time of the + record. Otherwise, the ISO8601 format is used. The resulting + string is returned. This function assumes time.gmtime() as the + 'converter' attribute in the Formatter class. + """ + ct = self.converter(record.created) + if datefmt: + s = time.strftime(datefmt, ct) + else: + t = time.strftime("%Y-%m-%d %H:%M:%S", ct) + s = "%s,%03d+0000" % (t, record.msecs) + return s + + +class ModularAction(object): + DEFAULT_MSGFIELDS = [ + "worker", + "signature", + "action_name", + "search_name", + "sid", + "orig_sid", + "rid", + "orig_rid", + "app", + "user", + "digest_mode", + "action_mode", + "action_status", + ] + DEFAULT_MESSAGE = "sendmodaction - {0}".format( + " ".join(['{i}="{{d[{i}]}}"'.format(i=i) for i in DEFAULT_MSGFIELDS]) + ) + # The above yields a string.format() compatible format string: + # + # 'sendmodaction - signature="{d[signature]}" action_name="{d[action_name]}" + # search_name="{d[search_name]}" sid="{d[sid]}" orig_sid="{d[orig_sid]}" + # rid="{d[rid]}" orig_rid="{d[orig_rid]}" app="{d[app]}" user="{d[user]}" + # action_mode="{d[action_mode]}" action_status="{d[action_status]}"' + # {0} - index, {1} - host, {2} - source + + DEFAULT_HEADER = "***SPLUNK*** %s %s %s" + DEFAULT_BREAKER = "==##~~##~~ 1E8N3D4E6V5E7N2T9 ~~##~~##==\n" + # {0} - orig_action-name, {1} - orig_sid, {2} - orig_rid, {3} - sourcetype + DEFAULT_IDLINE = "***Common Action Model*** %s %s %s %s" + DEFAULT_INDEX = "summary" + DEFAULT_CHUNK = 50000 + + SHORT_FORMAT = "%(asctime)s %(levelname)s %(message)s" + + CAM_QUEUE_URI = "/servicesNS/nobody/Splunk_SA_CIM/alerts/modaction_queue/queue" + + PRA_RID_RE = re.compile(r"^tmp_(\d+)\..*") + + def __init__(self, settings, logger, action_name="unknown"): + """Initialize ModularAction class. + + @param settings: A modular action payload in JSON format. + @param logger: A logging instance. + Recommend using ModularAction.setup_logger. + @param action_name: The action name. + action_name in payload will take precedence. + """ + # used to compute duration + self.start_timer = timer() + + # worker + try: + self.worker = getConfKeyValue("server", "general", "serverName") + except Exception: + self.worker = "" + + # settings + self.settings = json.loads(settings) + + # configuration + self.configuration = self.settings.get("configuration", {}) + if not isinstance(self.configuration, dict): + self.configuration = {} + + # logger + self.logger = logger + # set loglevel to DEBUG if verbose + verbose = normalizeBoolean(self.configuration.get("verbose", False)) + if verbose is True: + self.logger.setLevel(logging.DEBUG) + self.logger.debug("Log level set to DEBUG") + + # replay mode + replay_mode = normalizeBoolean(self.settings.get("_cam_replay", False)) + if replay_mode is True: + self.replay_mode = replay_mode + self.logger.info("Replay mode detected") + else: + self.replay_mode = False + + # session key + self.session_key = self.settings.get("session_key") + + # search id + self.sid = self.settings.get("sid") + self.sid_snapshot = "" + # if sid contains rt_scheduler with snapshot-sid; drop snapshot-sid + # sometimes self.sid may be an integer (1465593470.1228) + try: + rtsid = re.match(r"^(rt_scheduler.*)\.(\d+)(_?.*)$", self.sid) + if rtsid: + self.sid = rtsid.group(1) + self.sid_snapshot = rtsid.group(2) + # CIM-665: SHC realtime alerts have _guidval appended + if rtsid.group(3): + self.sid += rtsid.group(3) + except Exception: + pass + # rid_ntuple is a named tuple that represents + # the three variables that change on a per-result basis + self.rid_ntuple = collections.namedtuple("ID", ["orig_sid", "rid", "orig_rid"]) + # rids is a list of rid_ntuple values + # automatically maintained by update() calls + self.rids = [] + # current orig_sid based on update() + # aka self.rids[-1].orig_sid + self.orig_sid = "" + # current rid based on update() + # aka self.rids[-1].rid + self.rid = "" + # current orig_rid based on update() + # aka self.rids[-1].orig_rid + self.orig_rid = "" + + # results_file + self.results_file = self.settings.get("results_file") + # results_path + results_path = "" + if self.results_file: + results_path = os.path.dirname(self.results_file) + + # digest_mode (per-result alerting) + self.digest_mode = 1 + # per SPL-172319 - splunkd to provide result_id for per-result-alerting + if truthy_strint_from_dict(self.settings, "result_id"): + self.digest_mode = 0 + # pre SPL-172319 behavior + elif results_path.split(os.sep)[-1] == "per_result_alert": + self.digest_mode = 0 + + # info/job + self.info = {} + self.info_file = None + if self.results_file: + # handle per-result alerting + if self.digest_mode == 0: + self.info_file = os.path.join(os.path.dirname(results_path), "info.csv") + else: + self.info_file = os.path.join(results_path, "info.csv") + self.job = {} + + self.search_name = self.settings.get("search_name") + self.app = self.settings.get("app") + self.user = self.settings.get("user") or self.settings.get("owner") + + # use | sendalert param.action_name=$action_name$ + self.action_name = self.configuration.get("action_name") or action_name + + # use sid to determine action_mode + if isinstance(self.sid, basestring) and "scheduler" in self.sid: + self.action_mode = "saved" + else: + self.action_mode = "adhoc" + + self.action_status = "" + + # Since we don't use the result object we get from settings it will be purged + try: + del self.settings["result"] + except Exception: + pass + + # events + self.events = [] + + def addinfo(self): + """The purpose of this method is to populate the + modular action info variable with the contents of info.csv. + """ + info_data = None + + if self.info_file: + try: + # read-binary usage intentional here + with open(self.info_file, "rb") as fh: + fc = codecs.getreader("utf-8")(fh) + info_data = fc.read() + fh.seek(0) + self.info = next(csv.DictReader(fc)) + except Exception: + self.message("Could not retrieve info.csv", level=logging.WARN) + + return info_data + + def addjobinfo(self): + """The purpose of this method is to populate the job variable + with the contents from REST (/services/search/jobs/) + + If we're in replay mode we will not be able to hit /services/search/jobs/ + + SPL-112815 - sendalert - not all $job.$ parameters come through + """ + if self.sid and not self.job and not self.replay_mode: + try: + r, c = rest.simpleRequest( + "search/jobs/%s" % self.sid, + sessionKey=self.session_key, + getargs={"output_mode": "json"}, + ) + if r.status == http_client.OK: + self.job = json.loads(c)["entry"][0]["content"] + self.message("Successfully retrieved search job info") + self.logger.debug(self.job) + else: + self.message( + "Could not retrieve search job info", level=logging.WARN + ) + except Exception: + self.message("Could not retrieve search job info", level=logging.WARN) + + def message(self, signature, status=None, rids=None, level=logging.INFO, **kwargs): + """The purpose of this method is to provide a common messaging interface. + + @param signature: A string representing the message we want to log. + @param status: An optional status that we want to log. + Defaults to None. + @param rids: An optional list of rid_ntuple values in case we + want to generate the message for multiple rids. + Defaults to None (use the rid currently loaded). + @param level: The logging level to use when writing the message. + Defaults to logging.INFO (INFO) + @param kwargs: Additional keyword arguments to be included with the + message. + Defaults to "no arguments". + + @return message: This method logs the message; however, for + backwards compatibility we also return the message. + """ + # worker + worker = kwargs.get("worker") or self.worker or "" + # status + status = status or self.action_status or "" + # rid + if not isinstance(rids, list) or rids == []: + rids = [self.rid_ntuple(self.orig_sid, self.rid, self.orig_rid)] + # kwargs - prune any duplicate keys based on DEFAULT_MSGFIELDS + # prune any keys with special characters [A-Za-z_]+ + newargs = [ + x + for x in sorted(kwargs) + if (x not in ModularAction.DEFAULT_MSGFIELDS) and re.match(r"[A-Za-z_]+", x) + ] + # MSG + msg = "{0} {1}".format( + ModularAction.DEFAULT_MESSAGE, + " ".join(['{i}="{{d[{i}]}}"'.format(i=i) for i in newargs]), + ) + + # This will set the default value of any value NOT in the dictionary to the + # empty string. + argsdict = collections.defaultdict(str) + # order is important here - here we update first from kwargs, then from our + # expected arg set. + argsdict.update(kwargs) + argsdict.update( + { + "worker": worker, + "signature": signature or "", + "action_name": self.action_name or "", + "search_name": self.search_name or "", + "sid": self.sid or "", + "app": self.app or "", + "user": self.user or "", + "digest_mode": self.digest_mode if self.digest_mode in [0, 1] else "", + "action_mode": self.action_mode or "", + "action_status": status, + } + ) + + for rid_ntuple in rids: + if len(rid_ntuple) == 3: + # Update the arguments dictionary + argsdict.update( + { + "orig_sid": rid_ntuple.orig_sid or "", + "rid": rid_ntuple.rid or "", + "orig_rid": rid_ntuple.orig_rid or "", + } + ) + # This is where the magic happens. The format string will use the + # attributes of "argsdict" + message = msg.format(d=argsdict) + # prune empty string key-value pairs + for match in re.finditer(r'[A-Za-z_]+=""(\s|$)', message): + message = message.replace(match.group(0), "", 1) + message = message.strip() + self.logger.log(level, message) + else: + self.logger.warn("Could not unpack rid_ntuple") + message = "" + + return message + + def update(self, result): + """The purpose of this method is to update the ModularAction instance + identifiers based on the current result being operated on. + + This is the most important method in the library as it sets up + rid, orig_sid, and orig_rid to be used by subsequent class methods. + + Not calling update() immediately for each result before doing additional + work can have adverse affects. + + @result: The result dictionary object (arbitrary key/value pairs) + """ + # This is for events/results that were created as the result of a previous action + self.orig_sid = result.get("orig_sid", "") + # This is for events/results that were created as the result of a previous action + self.orig_rid = result.get("orig_rid", "") + + # If using per-result alerting rid will be decided for you. + # This is due to the fact that a number of scripts inadvertently + # set this to 0 based on enumeration. + if self.digest_mode == 0: + # per SPL-172319 - splunkd to provide result_id for per-result-alerting + if truthy_strint_from_dict(self.settings, "result_id"): + self.rid = str(self.settings["result_id"]) + # pre SPL-172319 behavior + else: + results_file = os.path.basename(self.results_file) + pra_rid_match = self.PRA_RID_RE.match(results_file) + if pra_rid_match: + self.rid = pra_rid_match.group(1) + else: + raise InvalidResultID("Result must have an ID") + + elif truthy_strint_from_dict(result, "rid"): + self.rid = str(result["rid"]) + + else: + raise InvalidResultID("Result must have an ID") + + # add snapshot id + if self.sid_snapshot: + self.rid = "%s.%s" % (self.rid, self.sid_snapshot) + + # add result info to list of named tuples + self.rids.append(self.rid_ntuple(self.orig_sid, self.rid, self.orig_rid)) + + def invoke(self): + """The purpose of this method is to generate per-result invocation messages. + This method is used to identify that an action is being attempted on a per-result basis. + + Remember to call update() prior to invoke() to ensure that the invocation message + reflects the appropriate identifiers. + """ + self.message("Invoking modular action") + + def result2stash( + self, result, dropexp=default_dropexp, mapexp=default_mapexp, addinfo=False + ): + """The purpose of this method is to formulate an event in stash format + + @param result: The result dictionary to generate a stash event for. + @param dropexp: A lambda expression used to determine whether a field + should be dropped or not. + Defaults to default_dropexp. + @param mapexp: A lambda expression used to determine whether a field + should be mapped (prepended with "orig_") or not. + Defaults to default_mapexp. + @param addinfo: Whether or not to add search information to the event. + "info" includes search_now, info_min_time, info_max_time, + and info_search_time fields. + Requires that information was loaded into the ModularAction + instance via addinfo() + + @return _raw: Returns a string which represents the result in stash format. + + The following example has been broken onto multiple lines for readability: + 06/21/2016 10:00:00 -0700, + search_name="Access - Brute Force Access Behavior Detected - Rule", + search_now=0.000, info_min_time=1466528400.000, + info_max_time=1466532600.000, info_search_time=1465296264.179, + key1=key1val, key2=key2val, key3=key3val, key4=key4val1, key4=key4val2, ... + """ + dropexp = dropexp or (lambda x: False) + mapexp = mapexp or (lambda x: False) + + def orig_dropexp(x): + """The purpose of this method is to determine whether we should + drop an orig_key that will be overwritten by a key to be mapped. + + For instance, if we have orig_foo and foo in result, and foo is a + mapped key, then orig_foo will be dropped. + """ + return x.startswith("orig_") and x[5:] in result and mapexp(x[5:]) + + # addinfo + if addinfo: + result["info_min_time"] = self.info.get("_search_et", "0.000") + info_max_time = self.info.get("_search_lt") + if not info_max_time or info_max_time == 0 or info_max_time == "0": + info_max_time = "+Infinity" + result["info_max_time"] = info_max_time + result["info_search_time"] = self.info.get("_timestamp", "") + + # construct _raw + _raw = "%s" % result.get("_time", mktimegm(time.gmtime())) + if self.search_name: + _raw += ', search_name="%s"' % self.search_name.replace('"', r"\"") + + # get key names + result_keys = set([x[5:] if x.startswith("__mv_") else x for x in result]) + + # iterate keys + for key in sorted(list(result_keys)): + if dropexp(key) or orig_dropexp(key): + continue + + # if key is MV + mv_key = "__mv_{0}".format(key) + if ( + mv_key in result + and isinstance(result[mv_key], basestring) # string + and result[mv_key].startswith("$") # prefix + and result[mv_key].endswith("$") + ): # suffix + vals = parse_mv(result[mv_key]) + # if key is SV + elif key in result: + vals = [result[key]] + else: + vals = [] + + # iterate vals + for v in vals: + if isinstance(v, basestring) and v: + # escape slashes + v = v.replace("\\", "\\\\") + # escape quotes + v = v.replace('"', '\\"') + elif isinstance(v, basestring) and len(vals) == 1: + continue + + # check map + if mapexp(key): + _raw += ', %s="%s"' % ("orig_" + key.lstrip("_"), v) + else: + _raw += ', %s="%s"' % (key, v) + + return _raw + + def addevent(self, raw, sourcetype, cam_header=True): + """The purpose of this method is to add a properly constructed event + to the events list in the ModularAction instance. This ensures events + are created with the appropriate index-time header. + + The index-time header is responsible for setting sourcetype, + orig_action_name, orig_sid, and orig_rid. The index-time header will + not be present in the _raw of generated events. + + Remember to call update() prior to addevent() to ensure that the events + reflect the appropriate orig_sid and orig_rid identifiers. + + @param raw: The text of the event you want to generate. + @param sourcetype: The sourcetype of the event you want to generate. + @param cam_header: Optionally exclude the inclusion of the index-time header. + Defaults to True (include header). + """ + if cam_header: + if self.orig_sid: + action_idline = self.DEFAULT_IDLINE % ( + self.get_header_item( + "orig_action_name", self.action_name, "unknown" + ), + self.get_header_item("orig_sid", self.orig_sid), + self.get_header_item("orig_rid", self.orig_rid), + self.get_header_item("sourcetype", sourcetype), + ) + else: + action_idline = self.DEFAULT_IDLINE % ( + self.get_header_item( + "orig_action_name", self.action_name, "unknown" + ), + self.get_header_item("orig_sid", self.sid), + self.get_header_item("orig_rid", self.rid), + self.get_header_item("sourcetype", sourcetype), + ) + self.events.append(action_idline.rstrip() + "\n" + raw) + else: + self.events.append(raw) + + def writeevents( + self, index="summary", host=None, source=None, fext="common_action_model" + ): + """The purpose of this method is to create arbitrary splunk events + from the list of events in the ModularAction instance. + + Please use addevent() for populating the list of events in + the ModularAction instance. + + @param index: The index to write the events to. + Defaults to "summary". + @param host: The value of host the events should take on. + Defaults to None (auto). + @param source: The value of source the events should take on. + Defaults to None (auto). + @param fext: The extension of the file to write out. + Files are written to $SPLUNK_HOME/var/spool/splunk. + File extensions can only contain word characters, + dash, and have a 200 char max. + "stash_" is automatically prepended to all extensions. + Defaults to "common_action_model" ("stash_common_action_model"). + Only override if you've set up a corresponding props.conf + stanza to handle the extension. + + @return bool: Returns True if all events were successfully written + Returns False if any errors were encountered + """ + if self.events: + # sanitize file extension + if not fext or not re.match(r"^[\w-]+$", fext): + self.logger.warn( + "Requested file extension was ignored due to invalid characters" + ) + fext = "common_action_model" + elif len(fext) > 200: + self.logger.warn("Requested file extension was ignored due to length") + fext = "common_action_model" + # header + header_line = self.DEFAULT_HEADER % ( + self.get_header_item("index", index, self.DEFAULT_INDEX), + self.get_header_item("host", host), + self.get_header_item("source", source), + ) + header_line = header_line.rstrip() + # process event chunks + for chunk in ( + self.events[x : x + self.DEFAULT_CHUNK] + for x in range(0, len(self.events), self.DEFAULT_CHUNK) + ): + # initialize output string + default_breaker = "\n" + self.DEFAULT_BREAKER + fout = header_line + default_breaker + (default_breaker).join(chunk) + # write output string + try: + fn = "{0}_{1}.stash_{2}".format( + mktimegm(time.gmtime()), random.randint(0, 100000), fext + ) + fp = make_splunkhome_path(["var", "spool", "splunk", fn]) + # obtain fh + # write-binary usage intentional here + with open(fp, "wb") as fh: + fh.write(fout.encode("utf-8")) + except Exception: + signature = "Error obtaining file handle during makeevents" + self.message(signature, level=logging.ERROR, file_path=fp) + self.logger.exception(signature + " file_path=%s" % fp) + return False + self.message( + "Successfully created splunk events", event_count=len(self.events) + ) + return True + return False + + def validate(self): + """This method serves as an illustration stub. + Serves as a container for operations which validate the action's parameters. + + Outer Validation - validation based on non-result based arguments (i.e. user input). + Inner Validation - validation based on result based key-values + + Since validate() (both inner and outer validation) will be called after + update()/invoke() and prior to dowork(), it will be important to ensure that + one-time validation (i.e. outer validation) is only done once. Consider + using len(rids)<=1. + + For cleanliness it is recommended that you subclass ModularAction + and implement your own validate() method. + """ + return + + def queuework(self, exit_strategy=None, tries=3, raise_all=False): + """This method will queue an action (instead of performing it) + by inserting a row into the cam_queue kvstore collection + + For action authors wanting to support remote workers it is important + that this method be called immediately after class initialization + and prior to processing results_file and calling dowork(). + + Whether or not queuework() returns or exits is determined by exit_strategy + which can be specified explicitly or determined dynamically based on + the list of _cam_workers. For instance, if exit_strategy is None and + "local" is present in _cam_worker, queuework() will return (not exit). + + @param exit_strategy: + Whether or not queuework should exit the script + None (dynamic), True, False + + @param tries: + The number of times to try the queue operation + + @param raise_all: + Whether or not to raise certain exceptions we would + normally WARN for. + """ + # 1. Load the common action model. + # If we can't load _cam, "continue" unless raise_all=True + try: + _cam = json.loads(self.configuration.get("_cam") or "{}") + except Exception: + signature = "Failed to load _cam" + if raise_all: + raise Exception(signature) + else: + self.message(signature, level=logging.WARN) + return + + # 2. Determine if the action supports workers. + # If it does not; return. + supports_workers = normalizeBoolean(_cam.get("supports_workers", False)) + + # the lack of worker support is not a "raisable" offense + # action_name must be valid as well + if ( + supports_workers is not True + or not self.action_name + or self.action_name == "unknown" + ): + self.message("Action does not support workers", level=logging.WARN) + return + + # 3. Load _cam_workers (workers list). + # If we can't load _cam_workers, "continue" unless raise_all=True + try: + _cam_workers = list( + set(json.loads(self.configuration.get("_cam_workers") or "[]")) + ) + except Exception: + signature = "Failed to load _cam_workers" + if raise_all: + raise Exception(signature) + else: + self.message(signature, level=logging.WARN) + return + + # 4. Determine if queuework will exit or keep going + # If exit is None, determine exit based on _cam_workers (dynamically) + exit_strategy = normalizeBoolean(exit_strategy) + + # if exit_strategy is None and work to be done locally + if exit_strategy is None and ("local" in _cam_workers): + exit_strategy = False + # if exit_strategy is None and work not to be done locally + elif exit_strategy is None: + exit_strategy = True + # if exit_strategy is True, take at face value + elif exit_strategy is True: + pass + # otherwise exit_strategy is False + else: + exit_strategy = False + + self.logger.debug("exit_strategy={0}".format(exit_strategy)) + + # Remove local + _cam_workers = sorted(list(set(_cam_workers) - set(["local"]))) + + # If no workers or local-only workers; return + if not _cam_workers: + self.message("No workers specified") + return + + # use unaltered sid from payload + sid = str(self.settings.get("sid")) + + # 5. Get info + info = "" + info_data = self.addinfo() + info = base64.b64encode(info_data.encode("utf-8")).decode("utf-8") + + # 6. Queue action + records = [] + record = { + "time": mktimegm(time.gmtime()), + "action_name": self.action_name, + "sid": sid, + "info": info, + "settings": json.dumps(self.settings), + } + + for worker in _cam_workers: + new_record = record.copy() + new_record["worker"] = worker + records.append(new_record) + + c = None + e = Exception("Exception Impossible") + + for unused_x in range(0, tries): + try: + r, c = rest.simpleRequest( + self.CAM_QUEUE_URI, + sessionKey=self.session_key, + jsonargs=json.dumps(records), + ) + c = c.decode("utf-8") + + if r.status == http_client.OK: + # generate pending messages on behalf + # of each worker + for worker in _cam_workers: + self.message( + "Successfully queued action", + status="pending", + worker=worker, + ) + if exit_strategy: + sys.exit(0) + else: + break + + except Exception as tmp_e: + e = tmp_e + if self.logger.isEnabledFor(logging.DEBUG): + self.logger.exception(tmp_e) + + else: + if exit_strategy: + if c is not None: + raise Exception(c) + else: + raise e + else: + if c is not None: + self.logger.error(c) + # if we're in debug don't keep barking + elif not self.logger.isEnabledFor(logging.DEBUG): + self.logger.error(e) + + for worker in _cam_workers: + self.message( + "Unable to queue action", status="failure", worker=worker + ) + + def dowork(self): + """This method serves as an illustration stub. + Serves as a container for operations which satisfy the nature of the action. + For instance, the third party API call. + + For cleanliness it is recommended that you subclass ModularAction + and implement your own dowork() method. + """ + return + + @staticmethod + def setup_logger( + name, level=logging.INFO, maxBytes=25000000, backupCount=5, format=SHORT_FORMAT + ): + """Set up a logging instance. + + @param name: The log file name. + We recommend "$action_name$_modalert". + @param level: The logging level. + @param maxBytes: The maximum log file size before rollover. + @param backupCount: The number of log files to retain. + + @return logger: Returns an instance of logger + """ + logfile = make_splunkhome_path(["var", "log", "splunk", name + ".log"]) + logger = logging.getLogger(name) + logger.setLevel(level) + # Prevent the log messages from being duplicated in the python.log file + logger.propagate = False + + # Prevent re-adding handlers to the logger object, which can cause duplicate log lines. + handler_exists = any( + [True for h in logger.handlers if h.baseFilename == logfile] + ) + if not handler_exists: + file_handler = logging.handlers.RotatingFileHandler( + logfile, maxBytes=maxBytes, backupCount=backupCount, delay=True + ) + ModularActionFormatter.converter = time.gmtime + formatter = ModularActionFormatter(format) + file_handler.setFormatter(formatter) + logger.addHandler(file_handler) + + return logger + + @staticmethod + # internal makeevents method for normalizing strings + # that will be used in the various headers we write out + def get_header_item(field, value, default=None): + """This method is used to normalize strings destined for + index-time headers. + + @param field: The field name (string) + @param value: The value (string) + @param default: The default (string); defaults to None + + @return string: If value; the field="value" pair + Else; empty string + """ + value = value or default + if field and value: + try: + return '%s="%s"' % (field, value.replace('"', "_")) + except AttributeError: + pass + return "" + + +class ModularActionTimer(object): + """The purpose of this method is to log execution times for different code paths + within a modular action script. When the majority of the script is wrapped, this can + be used to log the approximate run duration of the action script. + + Example: + + with ModularActionTimer(modaction, 'main') as t: + + (optionally do something with t.interval) + + @param modaction: A modular action class instance instance. + @param component: The component of the action script for which interval is measured. + @param start: Optional. Floating point representation of the start timer. + Defaults to entry timer. + """ + + def __init__(self, modaction, component, start=None): + self.modaction = modaction + self.component = component + self.start = start + self.interval = -1 + + def __enter__(self): + self.start = self.start or timer() + return self + + def __exit__(self, *args): + try: + self.interval = int((timer() - self.start) * 1000) + self.modaction.message( + "Modular action script duration", + component=self.component, + duration=self.interval, + ) + except Exception: + self.modaction.message("Unable to compute duration", level=logging.WARN) diff --git a/deps/apps/Splunk_SA_CIM/lib/cim_models.py b/deps/apps/Splunk_SA_CIM/lib/cim_models.py new file mode 100644 index 000000000..799e63bc1 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lib/cim_models.py @@ -0,0 +1,287 @@ +""" +Copyright (C) 2005 - 2019 Splunk Inc. All Rights Reserved. +""" +import json +import splunk.rest as rest + +try: + from urllib.request import quote +except ImportError: + from urllib import quote + +# Python 2+3 basestring +try: + basestring +except NameError: + basestring = str + + +class DataModels(object): + """Class for data model utilities""" + + baseObjects = ["BaseEvent", "BaseSearch", "BaseTransaction"] + # per SOLNESS-5244: this list should only include fields avail to + # both | datamodel and | tstats with the exception of _raw + baseEventAttributes = ["_time", "_raw", "source", "sourcetype", "host"] + + @staticmethod + def getDatamodels(sessionKey, namespace="search", owner="nobody"): + """Return JSON specification for a given model + @param sessionKey - A splunk session key + @param namespace - A splunk app context + @param owner - A splunk user context + + @return dict - A python dictionary with datamodel specification contents + + @raise Exception - Raises "Could not parse|retrieve datamodel..." + """ + getargs = {"output_mode": "json", "count": 0} + uri = "/servicesNS/{0}/{1}/data/models/".format( + quote(owner, safe=""), quote(namespace, safe="") + ) + r, c = rest.simpleRequest(uri, sessionKey=sessionKey, getargs=getargs) + if r.status == 200: + c = json.loads(c)["entry"] + datamodels = {} + for x in c: + try: + datamodels[x["name"]] = json.loads(x["content"]["eai:data"]) + except Exception: + pass + return datamodels + + raise Exception("Could not retrieve datamodels from %s" % uri) + + @staticmethod + def getDatamodelList(sessionKey, namespace="search", owner="nobody"): + """Return list of datamodels + @param sessionKey - A splunk session key + @param namespace - A splunk app context + @param owner - A splunk user context + + @return list - A list of datamodels + + @raise Exception - Raises multiple exceptions + """ + datamodels = DataModels.getDatamodels( + sessionKey, namespace=namespace, owner=owner + ) + return list(datamodels) + + @staticmethod + def getDatamodelJson(datamodel, sessionKey, namespace="search", owner="nobody"): + """Return JSON specification for a given model + @param datamodel - The datamodel entity name + @param sessionKey - A splunk session key + @param namespace - A splunk app context + @param owner - A splunk user context + + @return dict - A python dictionary with datamodel specification contents + + @raise Exception - Raises "Could not parse|retrieve datamodel..." + """ + getargs = {"output_mode": "json"} + uri = "/servicesNS/{0}/{1}/data/models/{2}".format( + quote(owner, safe=""), quote(namespace, safe=""), quote(datamodel, safe="") + ) + r, c = rest.simpleRequest(uri, sessionKey=sessionKey, getargs=getargs) + if r.status == 200: + return json.loads(json.loads(c)["entry"][0]["content"]["eai:data"]) + + raise Exception("Could not retrieve datamodel from %s" % uri) + + @staticmethod + def getObjectLineage( + objectName, modelJson, includeBaseObject=False, outputMode="basestring" + ): + """Return the lineage of an object + @param objectName - The name of the object + @param modelJson - The datamodel JSON specification + @param includeBaseObject - Whether or not to root lineage at BaseEvent|BaseSearch + @param outputMode - Whether to output basestring|list + + @return lineage - A lineage string or list + """ + parents = {obj["objectName"]: obj["parentName"] for obj in modelJson["objects"]} + lineage = [] + tmp = objectName + + if tmp in parents: + while tmp in parents: + lineage.append(tmp) + tmp = parents[tmp] + if includeBaseObject: + lineage.append(tmp) + lineage.reverse() + if outputMode == "list": + return lineage + else: + return ".".join(lineage) + if outputMode == "list": + return [] + return "" + + @staticmethod + def stripBaseObject(lineage, outputMode="basestring"): + """Remove the baseObject from a lineage string/list + @param lineage - A lineage string or list + @param outputMode - Whether to output basestring|list + + @return lineage - A lineage string or list + """ + if len(lineage) > 0: + if isinstance(lineage, basestring): + lineage = lineage.split(".") + if lineage[0] in DataModels.baseObjects: + lineage.pop(0) + if outputMode == "list": + return lineage + else: + return ".".join(lineage) + if outputMode == "list": + return [] + return "" + + @staticmethod + def getDatamodelObjectList( + datamodel, sessionKey, baseEventOnly=False, namespace="search", owner="nobody" + ): + """Return list of objects in a datamodel + @param datamodel - The datamodel entity name + @param sessionKey - A splunk session key + @param baseEventOnly - Whether or not to whitelist BaseEvent objects + @param namespace - A splunk app context + @param owner - A splunk user context + + @return objects - A list of objects + + @raise Exception - Raises "Could not parse|retrieve datamodel..." + """ + objects = [] + + # get the model + modelJson = DataModels.getDatamodelJson(datamodel, sessionKey, namespace, owner) + + for object in modelJson.get("objects", []): + if object.get("objectName"): + objectName = object["objectName"] + + if baseEventOnly: + objectLineage = DataModels.getObjectLineage( + objectName, modelJson, includeBaseObject=True + ) + if objectLineage.startswith("BaseEvent"): + objects.append(objectName) + else: + objects.append(objectName) + + return objects + + @staticmethod + def getObjectAttributes(objectName, modelJson): + """Return a list of object specific attributes + This method does NOT return attributes from it's parent(s) + @param objectName - The name of the object + @param modelJson - The datamodel JSON specification + + @return attributes - A list of attributes + """ + attributes = [] + + for obj in modelJson.get("objects", {}): + if obj.get("objectName") == objectName: + for field in obj.get("fields", []): + attributes.append(field.get("fieldName", [])) + for fields in [ + calc.get("outputFields") for calc in obj.get("calculations", {}) + ]: + attributes.extend([field.get("fieldName", []) for field in fields]) + break + + return attributes + + @staticmethod + def getAvailableFields(objectName, modelJson, flat=False): + """Return a list of all available object attributes + Recurses through the object's parents (including the baseObject) + @param objectName - The name of the object + @param modelJson - The datamodel JSON specification + @param flat - Whether to include attribute lineage or not + + @return None - If lineage could not be established + @return list - A list of available fields + """ + availableFieldsMap = DataModels.getAvailableFieldsMap(objectName, modelJson) + + if availableFieldsMap: + if flat: + availableFields = list(set(availableFieldsMap.values())) + else: + availableFields = list(availableFieldsMap) + else: + availableFields = None + + return availableFields + + @staticmethod + def getAvailableFieldsMap(objectName, modelJson): + """Return a dictionary of all available object attributes + Recurses through the object's parents (including the baseObject) + @param objectName - The name of the object + @param modelJson - The datamodel JSON specification + + @return None - If lineage could not be established + @return dict - A dictionary of available fields of the form + {'lineage.attribute': 'attribute'} + """ + # 0. initialize availableFields list + availableFields = {} + # 1. retrieve lineage + lineage = DataModels.getObjectLineage( + objectName, modelJson=modelJson, includeBaseObject=True, outputMode="list" + ) + # 2. length should be a non-zero length string + if len(lineage) > 0: + if lineage[0] == "BaseEvent": + availableFields.update( + zip(DataModels.baseEventAttributes, DataModels.baseEventAttributes) + ) + # discard BaseObject + lineage = DataModels.stripBaseObject(lineage, outputMode="list") + # iterate through lineage + # get attributes for each object + for x in range(0, len(lineage)): + # create lineage_part + lineagePart = lineage[x] + # get attribute lineage + # note the x+1 here which does not overflow + # >>> mylist = ['a', 'b', 'c', 'd', 'e'] + # >>> '.'.join(mylist[:5]) + # >>> 'a.b.c.d.e' + attributeLineage = ".".join(lineage[0 : x + 1]) + # get attributes for this object + attributes = DataModels.getObjectAttributes(lineagePart, modelJson) + # add each attribute w/ it's lineage to the list of avail fields + for attribute in attributes: + availableFields[attributeLineage + "." + attribute] = attribute + else: + availableFields = None + + return availableFields + + @staticmethod + def isModelMixed(modelJson): + """Return a boolean as to whether the model has a mix of baseObjects + @param modelJson - The datamodel JSON specification + + @return bool + """ + baseParents = set() + + for object in modelJson.get("objects", []): + parentName = object.get("parentName") + + if parentName in DataModels.baseObjects: + baseParents.add(parentName) + + return len(baseParents) > 1 diff --git a/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/__init__.py b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/log.py b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/log.py new file mode 100644 index 000000000..4c733349a --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/log.py @@ -0,0 +1,69 @@ +import logging +import logging.handlers +import time + +from splunk.clilib.bundle_paths import make_splunkhome_path + +DEFAULT_FORMAT = "%(asctime)s %(levelname)s pid=%(process)d tid=%(threadName)s file=%(filename)s:%(funcName)s:%(lineno)d | %(message)s" +SHORT_FORMAT = "%(asctime)s %(levelname)s %(message)s" + + +class GMTimeFormatter(logging.Formatter): + """An extension to the logging.Formatter base class + Hardcodes "+0000" into default datefmt + Use in conjunction with ModularActionFormatter.converter = time.gmtime + """ + + converter = time.gmtime + + def formatTime(self, record, datefmt=None): + """ + Return the creation time of the specified LogRecord as formatted text. + + This method should be called from format() by a formatter which + wants to make use of a formatted time. This method can be overridden + in formatters to provide for any specific requirement, but the + basic behaviour is as follows: if datefmt (a string) is specified, + it is used with time.strftime() to format the creation time of the + record. Otherwise, the ISO8601 format is used. The resulting + string is returned. This function assumes time.gmtime() as the + 'converter' attribute in the Formatter class. + """ + ct = self.converter(record.created) + if datefmt: + s = time.strftime(datefmt, ct) + else: + t = time.strftime("%Y-%m-%d %H:%M:%S", ct) + s = "%s,%03d+0000" % (t, record.msecs) + return s + + +def setup_logger( + name, level=logging.INFO, maxBytes=25000000, backupCount=5, fmt=DEFAULT_FORMAT +): + """ + Set up a default logger. + + :param name: The log file name. + :param level: The logging level. + :param maxBytes: The maximum log file size before rollover. + :param backupCount: The number of log files to retain. + """ + logfile = make_splunkhome_path(["var", "log", "splunk", name + ".log"]) + loginst = logging.getLogger(name) + loginst.setLevel(level) + # Prevent the log messages from being duplicated in the python.log file + loginst.propagate = False + + # Prevent re-adding handlers to the logger object, + # which can cause duplicate log lines. + handler_exists = any([True for h in loginst.handlers if h.baseFilename == logfile]) + if not handler_exists: + file_handler = logging.handlers.RotatingFileHandler( + logfile, maxBytes=maxBytes, backupCount=backupCount + ) + formatter = GMTimeFormatter(fmt) + file_handler.setFormatter(formatter) + loginst.addHandler(file_handler) + + return loginst diff --git a/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modaction_queue.py b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modaction_queue.py new file mode 100644 index 000000000..cb7dc1543 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modaction_queue.py @@ -0,0 +1,442 @@ +import base64 +import hashlib + +try: + import http.client as http_client +except ImportError: + import httplib as http_client +import json +import logging +import os +import re +import splunk.rest as rest +import splunk.util as util + +try: + from urllib.parse import quote, quote_plus +except ImportError: + from urllib import quote, quote_plus + +from splunk import AuthorizationFailed +from splunk.clilib.bundle_paths import make_splunkhome_path + +# Python 2+3 basestring +try: + basestring +except NameError: + basestring = str + + +def validate_settings(settings): + try: + x = json.loads(settings) + except Exception: + return False + + if isinstance(x, dict) and x: + return True + + return False + + +class ModularActionQueueBR(Exception): + """Custom exception for Modular Action Queue REST handler""" + + pass + + +class ModularActionQueueUnauth(Exception): + """Custom exception for Modular Action Queue REST handler""" + + pass + + +class ModularActionQueueISE(Exception): + """Custom exception for Modular Action Queue REST handler""" + + pass + + +class ModularActionQutils(object): + API_KEY_RE = re.compile("^[a-fA-F0-9]{128}$") + CAM_QUEUE_URI = ( + "/servicesNS/nobody/Splunk_SA_CIM/storage/collections/data/cam_queue" + ) + QUEUE_PAYLOAD_MAP = { + "time": ( + lambda x: isinstance(x, (float, int)) and x >= 0, + "must be a number greater than 0", + ), + "action_name": ( + lambda x: isinstance(x, basestring) and x and x != "unknown", + "must be a valid action name", + ), + "sid": ( + lambda x: isinstance(x, basestring) and x, + "must be a string with positive length", + ), + "info": (lambda x: isinstance(x, basestring), "must be a string of any length"), + "worker": ( + lambda x: isinstance(x, basestring) and x, + "must be a string with positive length", + ), + "settings": (validate_settings, "must be a json encoded nonempty dictionary"), + } + REQUIRED_KEYS = sorted(QUEUE_PAYLOAD_MAP.keys()) + + def __init__(self, logger, session_key): + self.logger = logger + self.session_key = session_key + + @staticmethod + def set_log_level(logger, params): + debug = util.normalizeBoolean(params.get("debug", False)) + + if debug not in [True, False]: + logger.warn("Unable to normalize debug parameter") + debug = False + + if debug: + logger.setLevel(logging.DEBUG) + + @staticmethod + def is_connection_encrypted(connection): + if not isinstance(connection, dict): + return False + + if "ssl" in connection: + ssl = util.normalizeBoolean(connection["ssl"]) + + if ssl in [True, False]: + return ssl + + return False + + @staticmethod + def get_header_item(headers, item): + if not isinstance(headers, list): + return None + + for header in headers: + if isinstance(header, list) and len(header) == 2: + if header[0] == item: + return header[1] + + return None + + @staticmethod + def is_api_key_formatted(api_key): + if isinstance(api_key, basestring) and ModularActionQutils.API_KEY_RE.match( + api_key + ): + return True + + return False + + @staticmethod + def validate_payload(payload): + try: + jsonargs = json.loads(payload) + except Exception: + raise ModularActionQueueBR("Payload must be valid JSON") + + if not isinstance(jsonargs, list): + raise ModularActionQueueBR("Payload must be a JSON list") + + if not jsonargs: + raise ModularActionQueueBR("Payload must not be empty") + + return jsonargs + + @staticmethod + def build_key(item): + try: + hashtxt = item["action_name"] + item["sid"] + + return "{0}@@{1}".format( + item["worker"], hashlib.sha1(hashtxt.encode("utf-8")).hexdigest() + ) + except (TypeError, KeyError): + raise ModularActionQueueBR("Unable to build _key") + + @staticmethod + def get_unsave_sids(dequeued_items, sid_items): + """This method returns a list of sids that need to be + unsaved. Verify that for each sid, the only work + remaining is that being "dequeued". + + @param dequeued_items - a dict + @param sid_items - a dict + + [{'_key': x, 'sid': y}] + + @return dict + """ + try: + dequeued_keys = [x["_key"] for x in dequeued_items if x.get("_key")] + sids = set([x["sid"] for x in sid_items if x.get("sid")]) + bad_sids = set( + [ + x["sid"] + for x in sid_items + if (x.get("_key") and x["_key"] not in dequeued_keys) + ] + ) + + return list(sids - bad_sids) + + except Exception: + return [] + + def error(self, msg, status): + """ + Return error. + + :param msg: A message describing the problem (a string) + :type msg: str + :param status: An integer to be returned as the HTTP status code. + :type status: int + """ + self.logger.error(msg) + return {"status": status, "payload": msg} + + def is_api_key_valid(self, worker, api_key): + if not self.is_api_key_formatted(api_key): + return False + + en = "cam_queue:{0}:".format(worker) + uri = "/servicesNS/nobody/Splunk_SA_CIM/storage/passwords/{0}".format( + quote(en, safe="") + ) + + try: + if not self.session_key: + raise AuthorizationFailed + + unused_r, c = rest.simpleRequest( + uri, + sessionKey=self.session_key, + getargs={"output_mode": "json"}, + raiseAllErrors=True, + ) + + clear_password = json.loads(c)["entry"][0]["content"]["clear_password"] + + except Exception as e: + self.logger.exception(e) + return False + + return clear_password == api_key + + def get_work(self, worker): + if not (isinstance(worker, basestring) and worker): + raise ModularActionQueueBR("Must specify a worker in order to get work") + + if not self.session_key: + raise AuthorizationFailed + + # get cam_queue + uri = "{0}?query={1}".format( + self.CAM_QUEUE_URI, + # quote_plus usage intentional here + quote_plus(json.dumps({"worker": worker})), + ) + + try: + r, c = rest.simpleRequest(uri, sessionKey=self.session_key, method="GET") + except Exception as e: + self.logger.exception(e) + raise ModularActionQueueISE("Unable to retrieve cam_queue") + + if r.status != http_client.OK: + self.logger.error(c) + raise ModularActionQueueISE("Unable to retrieve cam_queue") + + return json.loads(c) + + def get_results(self, key): + if not (isinstance(key, basestring) and key): + raise ModularActionQueueBR("Must specify a key in order to get results") + + if not self.session_key: + raise AuthorizationFailed + + # get cam_queue + uri = "{0}/{1}".format(self.CAM_QUEUE_URI, quote(key, safe="")) + + try: + r, c = rest.simpleRequest(uri, sessionKey=self.session_key, method="GET") + except Exception as e: + self.logger.exception(e) + raise ModularActionQueueISE("Unable to retrieve cam_queue") + + if r.status != http_client.OK: + self.logger.error(c) + raise ModularActionQueueISE("Unable to retrieve cam_queue") + + settings = json.loads(c).get("settings") + # normalize path + results_file = os.path.normpath(json.loads(settings).get("results_file", "")) + # verify path + if not results_file.startswith( + make_splunkhome_path(["var", "run", "splunk", "dispatch"]) + ): + self.logger.error("Unable to load results_file: %s", results_file) + raise ModularActionQueueISE("Unable to load results_file") + + # read-binary usage intentional here + with open(results_file, "rb") as fh: + return base64.b64encode(fh.read()).decode("utf-8") + + def validate_queue_payload(self, payload, max_items): + jsonargs = self.validate_payload(payload) + + if len(jsonargs) > max_items: + raise ModularActionQueueBR("Payload must not exceed max_items") + + for i, jsonitem in enumerate(jsonargs): + if not isinstance(jsonitem, dict): + raise ModularActionQueueBR("Payload items must be valid dictionaries") + + jsonkeys = sorted(jsonitem.keys()) + + if not self.REQUIRED_KEYS == jsonkeys: + raise ModularActionQueueBR( + "Payload items must only contain keys: {0}".format( + self.REQUIRED_KEYS + ) + ) + + for key, val in jsonitem.items(): + exp, reason = self.QUEUE_PAYLOAD_MAP[key] + + if not exp(val): + raise ModularActionQueueBR( + 'Payload item "{0}" was invalidated: {1}'.format(key, reason) + ) + + # build and add _key + jsonargs[i]["_key"] = self.build_key(jsonitem) + + return jsonargs + + def validate_dequeue_payload(self, payload, worker): + jsonargs = self.validate_payload(payload) + + for jsonitem in jsonargs: + if not isinstance(jsonitem, basestring): + raise ModularActionQueueBR("Payload items must be valid strings") + + if not jsonitem.startswith("{0}@@".format(worker)): + raise ModularActionQueueBR( + "Payload item must pertain to authenticated worker" + ) + + def save_work(self, save_sids): + if not self.session_key: + raise AuthorizationFailed + + for save_sid in save_sids: + try: + rest.simpleRequest( + "search/jobs/{0}/control".format(quote(save_sid, safe="")), + postargs={"action": "save"}, + sessionKey=self.session_key, + raiseAllErrors=True, + ) + + self.logger.info("Successfully saved job: %s", save_sid) + except Exception as e: + self.logger.exception(e) + self.logger.warn("Unable to save job: %s", save_sid) + + def unsave_work(self, query): + if not self.session_key: + raise AuthorizationFailed + + # get cam_queue + uri = "{0}?query={1}".format( + self.CAM_QUEUE_URI, + # quote_plus usage intentional here + quote_plus(json.dumps(query)), + ) + + try: + r, c = rest.simpleRequest(uri, sessionKey=self.session_key, method="GET") + except Exception as e: + self.logger.exception(e) + raise ModularActionQueueISE("Unable to retrieve work from cam_queue") + + if r.status != http_client.OK: + self.logger.error(c) + raise ModularActionQueueISE("Unable to retrieve work from cam_queue") + + dequeued_items = json.loads(c) + + if not dequeued_items: + self.logger.warn("No work found; no jobs to unsave") + return + + sid_query = { + "$or": [{"sid": x.get("sid")} for x in dequeued_items if x.get("sid")] + } + sid_uri = "{0}?query={1}".format( + self.CAM_QUEUE_URI, + # quote_plus usage intentional here + quote_plus(json.dumps(sid_query)), + ) + + try: + r, c = rest.simpleRequest( + sid_uri, sessionKey=self.session_key, method="GET" + ) + except Exception as e: + self.logger.exception(e) + raise ModularActionQueueISE("Unable to retrieve SIDs from cam_queue") + + if r.status != http_client.OK: + self.logger.error(c) + raise ModularActionQueueISE("Unable to retrieve SIDs from cam_queue") + + sid_items = json.loads(c) + + if not sid_items: + self.logger.error("No SIDs found; no jobs to unsave") + return + + # figure out if sids have any keys not in work keys + unsave_sids = self.get_unsave_sids(dequeued_items, sid_items) + + for unsave_sid in unsave_sids: + try: + rest.simpleRequest( + "search/jobs/{0}/control".format(quote(unsave_sid, safe="")), + postargs={"action": "unsave"}, + sessionKey=self.session_key, + raiseAllErrors=True, + ) + + self.logger.info("Successfully unsaved job: %s", unsave_sid) + except Exception as e: + self.logger.exception(e) + self.logger.warn("Unable to unsave job: %s", unsave_sid) + + def delete_work(self, query): + if not self.session_key: + raise AuthorizationFailed + + # get cam_queue + uri = "{0}?query={1}".format( + self.CAM_QUEUE_URI, + # quote_plus usage intentional here + quote_plus(json.dumps(query)), + ) + + try: + r, c = rest.simpleRequest(uri, sessionKey=self.session_key, method="DELETE") + + return {"status": r.status, "payload": c.decode("utf-8")} + + except Exception as e: + self.logger.exception(e) + raise ModularActionQueueISE("Unable to dequeue item(s)") diff --git a/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/__init__.py b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/__init__.py new file mode 100644 index 000000000..7cefc29e8 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/__init__.py @@ -0,0 +1,40 @@ +""" +Copyright (C) 2005 - 2019 Splunk Inc. All Rights Reserved. +""" +from .base_modinput import logger +from .xml_modinput import XmlModularInput +from .json_modinput import JsonModularInput +from .fields import Field +from .fields import BooleanField +from .fields import DelimitedField +from .fields import DurationField +from .fields import FloatField +from .fields import IntegerField +from .fields import IntervalField +from .fields import JsonField +from .fields import ListField +from .fields import RangeField +from .fields import RegexField +from .fields import SeverityField +from .fields import FieldValidationException + +ModularInput = XmlModularInput +__all__ = [ + "logger", + "ModularInput", + "XmlModularInput", + "JsonModularInput", + "Field", + "BooleanField", + "DelimitedField", + "DurationField", + "FloatField", + "IntegerField", + "IntervalField", + "JsonField", + "ListField", + "RangeField", + "RegexField", + "SeverityField", + "FieldValidationException", +] diff --git a/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/base_modinput.py b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/base_modinput.py new file mode 100644 index 000000000..35ec88ebb --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/base_modinput.py @@ -0,0 +1,931 @@ +""" +Copyright (C) 2005 - 2020 Splunk Inc. All Rights Reserved. +""" +import argparse +import getpass +import hashlib +import json +import logging +import os +import sys +import time +import xml.dom +import splunk +import splunk.auth +import splunk.rest +import splunk.version + +from .fields import BooleanField +from .fields import Field +from .fields import FieldValidationException +from .fields import IntervalField +from .. import log +from splunk.util import normalizeBoolean + +try: + from urllib.request import quote +except ImportError: + from urllib import quote + +# Define logger using the name of the script here, versus in the modular_input class. +logger = log.setup_logger(name="python_modular_input", level=logging.INFO) + + +class ModularInputConfig(object): + def __init__( + self, server_host, server_uri, session_key, checkpoint_dir, configuration + ): + self.server_host = server_host + self.server_uri = server_uri + self.session_key = session_key + self.checkpoint_dir = checkpoint_dir + self.configuration = configuration + + def __str__(self): + attrs = [ + "server_host", + "server_uri", + "session_key", + "checkpoint_dir", + "configuration", + ] + return str({attr: str(getattr(self, attr)) for attr in attrs}) + + @staticmethod + def get_text(node, default=None): + """ + Get the value of the text in the first node under the given node. + + Arguments: + node -- The node that should have a text node under it. + default -- The default text that ought to be returned if no text node could be found (defaults to none). + """ + + if ( + node + and node.firstChild + and node.firstChild.nodeType == node.firstChild.TEXT_NODE + ): + return node.firstChild.data + else: + return default + + @staticmethod + def get_config_from_xml(config_str_xml): + """ + Get the config from the given XML and return a ModularInputConfig instance. + + Arguments: + config_str_xml -- A string of XML that represents the configuration provided by Splunk. + """ + configuration = {} + doc = xml.dom.minidom.parseString(config_str_xml) + root = doc.documentElement + server_host_node = root.getElementsByTagName("server_host")[0] + server_host = ModularInputConfig.get_text(server_host_node) + server_uri_node = root.getElementsByTagName("server_uri")[0] + server_uri = ModularInputConfig.get_text(server_uri_node) + session_key_node = root.getElementsByTagName("session_key")[0] + session_key = ModularInputConfig.get_text(session_key_node) + checkpoint_node = root.getElementsByTagName("checkpoint_dir")[0] + checkpoint_dir = ModularInputConfig.get_text(checkpoint_node) + conf_node = root.getElementsByTagName("configuration")[0] + + if conf_node: + for stanza in conf_node.getElementsByTagName("stanza"): + config = {} + if stanza: + stanza_name = stanza.getAttribute("name") + if stanza_name: + config["name"] = stanza_name + params = stanza.getElementsByTagName("param") + for param in params: + param_name = param.getAttribute("name") + config[param_name] = ModularInputConfig.get_text(param) + configuration[stanza_name] = config + + return ModularInputConfig( + server_host, server_uri, session_key, checkpoint_dir, configuration + ) + + @staticmethod + def get_config_from_json(config_str_json): + """ + Get the config from the given JSON and return a ModularInputConfig instance. + + Arguments: + config_str_json -- A string of JSON that represents the configuration provided by Splunk. + """ + configuration = {} + doc = json.loads(config_str_json) + server_host = doc.get("server_host") + server_uri = doc.get("server_uri") + session_key = doc.get("session_key") + checkpoint_dir = doc.get("checkpoint_dir") + conf = doc.get("configuration") + + if isinstance(conf, dict): + for stanza_name, stanza in conf.items(): + config = {"name": stanza_name, "_app": stanza.get("app")} + config.update(stanza.get("settings", {})) + configuration[stanza_name] = config + + return ModularInputConfig( + server_host, server_uri, session_key, checkpoint_dir, configuration + ) + + +class BaseModularInput(object): + logger = logger + + # These arguments cover the standard fields that are always supplied + standard_args = [ + BooleanField( + "disabled", "Disabled", "Whether the modular input is disabled or not" + ), + Field("host", "Host", "The host that is running the input"), + Field("index", "Index", "The index that data should be sent to"), + IntervalField("interval", "Interval", "The interval the script will be run on"), + Field("name", "Stanza name", "The name of the stanza for this modular input"), + Field( + "source", "Source", "The source for events created by this modular input" + ), + Field( + "sourcetype", "Stanza name", "The name of the stanza for this modular input" + ), + ] + + checkpoint_dir = None + + def __init__(self, scheme_args, args=None, this_logger=None): + """ + Set up the modular input. + + Arguments: + scheme_args -- The title (e.g. "Database Connector"), description of the input (e.g. "Get data from a database"), etc. + args -- A list of Field instances for validating the arguments + this_logger - A logger instance (defaults to None) + """ + # default to global logger (python_modular_input) + self.logger = this_logger if this_logger is not None else logger + + # Set the scheme arguments. + for arg in [ + "title", + "description", + "use_external_validation", + "streaming_mode", + "use_single_instance", + ]: + setattr(self, arg, self._is_valid_param(arg, scheme_args.get(arg))) + + for arg in ["always_run", "requires_kvstore"]: + if arg in scheme_args and normalizeBoolean(scheme_args[arg]) is True: + setattr(self, arg, True) + else: + setattr(self, arg, False) + + for arg in ["kvstore_wait_time"]: + try: + setattr(self, arg, int(scheme_args[arg])) + except Exception: + setattr(self, arg, 0) + + self.args = [] if args is None else args[:] + + def _is_valid_param(self, name, val): + """Raise an error if the parameter is None or empty.""" + if val is None: + raise ValueError("The {0} parameter cannot be none".format(name)) + + if len(val.strip()) == 0: + raise ValueError("The {0} parameter cannot be empty".format(name)) + + return val + + def addArg(self, arg): + """ + Add a given argument to the list of arguments. + + Arguments: + arg -- An instance of Field that represents an argument. + """ + + if self.args is None: + self.args = [] + + self.args.append(arg) + + def do_scheme(self, out=sys.stdout): + """ + Get the scheme and write it out to standard output. + + Arguments: + out -- The stream to write the message to (defaults to standard output) + """ + + self.logger.info("Modular input: scheme requested") + out.write(self.get_scheme()) + + return True + + def get_scheme(self): + """ + Get the scheme of the inputs parameters and return as a string. + """ + + raise Exception("get_scheme function was not implemented") + + def do_validation(self, in_stream=sys.stdin): + """ + Get the validation data from standard input and attempt to validate it. Returns true if the arguments validated, false otherwise. + + Arguments: + in_stream -- The stream to get the input from (defaults to standard input) + """ + + data = self.get_validation_data(in_stream) + + try: + self.validate(data) + return True + except FieldValidationException as e: + self.print_error(str(e)) + return False + + def validate(self, arguments): + """ + Validate the argument dictionary where each key is a stanza. + + Arguments: + arguments -- The parameters as a dictionary. + """ + + # Check each stanza + self.validate_parameters(arguments) + return True + + def validate_parameters(self, parameters): + """ + Validate the parameter set for a stanza and returns a dictionary of cleaner parameters. + + Arguments: + parameters -- The list of parameters + """ + + cleaned_params = {} + + # Append the arguments list such that the standard fields that Splunk provides are included + all_args = {} + + for a in self.standard_args: + all_args[a.name] = a + + for a in self.args: + all_args[a.name] = a + + # Convert and check the parameters + for name, value in parameters.items(): + # If the argument was found, then validate and convert it + if name in all_args: + cleaned_params[name] = ( + None if value == "" else all_args[name].to_python(value) + ) + + # Throw an exception if the argument could not be found + elif name not in ["_app", "python.version"]: # exclude _app, python.version + raise FieldValidationException( + "The parameter '%s' is not a valid argument" % name + ) + + return cleaned_params + + def print_error(self, error, out=sys.stdout): + raise Exception("print_error function was not implemented") + + def do_run(self, in_stream=sys.stdin, log_exception_and_continue=False): + """ + Read the config from standard input and return the configuration. + + in_stream -- The stream to get the input from (defaults to standard input) + log_exception_and_continue -- If true, exceptions will not be thrown for invalid configurations and instead the stanza will be skipped. + """ + + # Run the modular import + input_config = self.read_config(in_stream) + + # Save input config for future use (contains the session key). + self._input_config = input_config + # TODO: Remove now-redundant refs to self.checkpoint_dir + self.checkpoint_dir = input_config.checkpoint_dir + + # Is this input single instance mode? + single_instance = str( + getattr(self, "use_single_instance", "") + ).strip().lower() in ["true", "t", "1"] + + # Validate all stanza parameters. + stanzas = [] + for stanza_name, unclean_stanza in input_config.configuration.items(): + try: + stanzas.append(self.validate_parameters(unclean_stanza)) + except FieldValidationException as e: + if log_exception_and_continue: + # Discard the invalid stanza. + self.logger.error( + "Discarding invalid input stanza '%s': %s" + % (stanza_name, str(e)) + ) + else: + raise e + + # Call the modular input's "run" method on valid stanzas, handling two cases: + # a. If this script is in single_instance mode=true, we have received + # all stanzas in input_config.configuration. In this case, + # a duration parameter is not supported. The run() method may + # loop indefinitely, but we do not re-execute. + # b. If this script is in single_instance_mode=false, each stanza + # can have a duration parameter (or not) specifying the time + # at which the individual stanza will be re-executed. + # + # Note: The "duration" parameter emulates the behavior of the "interval" + # parameter available on Splunk 6.x and higher, and is mainly used by the + # VMWare application. + + # TODO: A run() method may pass results back for optional processing + + if stanzas or self.always_run: + # kvstore required/wait handling + if self.requires_kvstore: + kvstore_ready = self.is_kvstore_ready(assume_true_on_error=True) + + if not kvstore_ready and self.kvstore_wait_time > 0: + self.logger.info( + "Modular input (%s) sleeping (for %s seconds) because kvstore was not ready", + getattr(self, "title", "unknown"), + self.kvstore_wait_time, + ) + time.sleep(self.kvstore_wait_time) + kvstore_ready = self.is_kvstore_ready(assume_true_on_error=True) + + if not kvstore_ready: + self.logger.warning( + "Modular input (%s) did not execute because kvstore was not ready", + getattr(self, "title", "unknown"), + ) + # Exit with zero since this most likely represents kvstore initializing + sys.exit(0) + + if single_instance: + # Run the input across all defined stanzas and exit. + self.run(stanzas) + else: + if not stanzas: + stanza = {} + else: + # Retrieve the single input stanza. + stanza = stanzas[0] + + self.run(stanza) + else: + self.logger.info("No input stanzas defined") + + def run(self, stanza): + """ + Run the input using the arguments provided. + + Arguments: + stanza -- The name of the stanza + """ + raise NotImplementedError("Run function was not implemented") + + @staticmethod + def get_log_level(stanzas, debug_param="debug"): + """ + Get debug setting from stanzas. + + Arguments: + stanzas -- The list of stanzas being processed by the modinput. + """ + + if stanzas and any( + normalizeBoolean(stanza.get(debug_param)) is True for stanza in stanzas + ): + return logging.DEBUG + + return logging.INFO + + @staticmethod + def get_file_path(checkpoint_dir, stanza): + """ + Get the path to the checkpoint file. + + Arguments: + checkpoint_dir -- The directory where checkpoints ought to be saved + stanza -- The stanza of the input being used + """ + + return os.path.join(checkpoint_dir, hashlib.sha1(stanza).hexdigest() + ".json") + + @classmethod + def last_ran(cls, checkpoint_dir, stanza): + """ + Determines the date that the input was last run (the input denoted by the stanza name). + + Arguments: + checkpoint_dir -- The directory where checkpoints ought to be saved + stanza -- The stanza of the input being used + """ + + fp = None + + try: + fp = open(cls.get_file_path(checkpoint_dir, stanza)) # noqa + checkpoint_dict = json.load(fp) + + return checkpoint_dict["last_run"] + + finally: + if fp is not None: + fp.close() + + @classmethod + def needs_another_run(cls, checkpoint_dir, stanza, interval, cur_time=None): + """ + Determines if the given input (denoted by the stanza name) ought to be executed. + + Arguments: + checkpoint_dir -- The directory where checkpoints ought to be saved + stanza -- The stanza of the input being used + interval -- The frequency that the analysis ought to be performed + cur_time -- The current time (will be automatically determined if not provided) + """ + + try: + last_ran = cls.last_ran(checkpoint_dir, stanza) + + return cls.is_expired(last_ran, interval, cur_time) + + except IOError: + # The file likely doesn't exist + cls.logger.exception("The checkpoint file likely doesn't exist") + return True + except ValueError: + # The file could not be loaded + cls.logger.exception("The checkpoint file could not be loaded") + return True + except Exception as e: + # Catch all that enforces an extra run + cls.logger.exception( + "Unexpected exception caught, enforcing extra run, exception info: ", e + ) + return True + + @classmethod + def time_to_next_run(cls, checkpoint_dir, stanza, duration): + """ + Returns the number of seconds as int until the next run of the input is expected. + Note that a minimum of 1 second is enforced to avoid a python loop of death + constricting the system in rare checkpoint dir failure scenarios. + Snake pun entirely intentional (pythons constrict prey to death, like your cpu). + + Arguments: + checkpoint_dir -- The directory where checkpoints ought to be saved + stanza -- The stanza of the input being used + duration -- The frequency that the analysis ought to be performed + """ + + try: + last_ran = cls.last_ran(checkpoint_dir, stanza) + last_target_time = last_ran + duration + time_to_next = last_target_time - time.time() + if time_to_next < 1: + time_to_next = 1 + return time_to_next + except IOError: + # The file likely doesn't exist + cls.logger.warning( + "Could not read checkpoint file for last time run, likely does not exist, if this persists debug input immediately" + ) + return 1 + except ValueError: + # The file could not be loaded + cls.logger.error( + "Could not read checkpoint file for last time run, if this persists debug input immediately" + ) + return 1 + except Exception as e: + cls.logger.exception( + "Unexpected exception caught, enforcing extra run, exception info: ", e + ) + return 1 + + @classmethod + def save_checkpoint(cls, checkpoint_dir, stanza, last_run): + """ + Save the checkpoint state. + + Arguments: + checkpoint_dir -- The directory where checkpoints ought to be saved + stanza -- The stanza of the input being used + last_run -- The time when the analysis was last performed + """ + + fp = None + + try: + fp = open(cls.get_file_path(checkpoint_dir, stanza), "w") # noqa + + d = {"last_run": last_run} + + json.dump(d, fp) + + except Exception: + cls.logger.exception("Failed to save checkpoint directory") + finally: + if fp is not None: + fp.close() + + @staticmethod + def is_expired(last_run, interval, cur_time=None): + """ + Indicates if the last run time is expired based . + + Arguments: + last_run -- The time that the analysis was last done + interval -- The interval that the analysis ought to be done (as an integer) + cur_time -- The current time (will be automatically determined if not provided) + """ + + if cur_time is None: + cur_time = time.time() + + if (last_run + interval) < cur_time: + return True + else: + return False + + def checkpoint_data_exists(self, filename, checkpoint_dir=None): + """Returns True if a checkpoint file exists with the given filename.""" + checkpoint_dir = checkpoint_dir or self._input_config.checkpoint_dir + return os.path.isfile(os.path.join(checkpoint_dir, filename)) + + def delete_checkpoint_data(self, filename, checkpoint_dir=None, raise_err=False): + """ + Delete arbitrary checkpoint data. + + Arguments: + filename -- The name of the file to create in the checkpoint directory. + checkpoint_dir -- The directory where checkpoints ought to be saved. Should + be set only if the intent is to read data from the checkpoint directory + of a different modular input. + raise_err -- Determines if errors should be raised + + Returns: + True if file is successfully removed, False otherwise. + """ + checkpoint_dir = checkpoint_dir or self._input_config.checkpoint_dir + checkpoint_fpath = os.path.join(checkpoint_dir, filename) + exists = os.path.exists(checkpoint_fpath) + try: + os.unlink(checkpoint_fpath) + return True + except Exception as e: + if raise_err and exists: + raise e + else: + self.logger.debug( + 'msg=%s checkpoint_dir="%s" filename="%s"', + e, + checkpoint_dir, + filename, + ) + return False + + def set_checkpoint_data(self, filename, data, checkpoint_dir=None): + """ + Save arbitrary checkpoint data as JSON. + + Arguments: + filename -- The name of the file to create in the checkpoint directory. + data -- A Python data structure that can be converted to JSON. + checkpoint_dir -- The directory where checkpoints ought to be saved. Should + be set only if the intent is to read data from the checkpoint directory + of a different modular input. + + Returns: + True if the data is successfully saved, False otherwise. + Throws: + IOError if the checkpoint cannot be saved. + + Note: The caller is repsonsible for ensuring that the filename does not + clash with other uses. + """ + checkpoint_dir = checkpoint_dir or self._input_config.checkpoint_dir + + try: + with open(os.path.join(checkpoint_dir, filename), "w") as fp: # noqa + json.dump(data, fp) + return True + except IOError: + self.logger.exception( + 'msg="IOError exception when saving checkpoint data" checkpoint_dir="%s" filename="%s"', + checkpoint_dir, + filename, + ) + except ValueError: + self.logger.exception( + 'msg="ValueError when saving checkpoint data (perhaps invalid JSON)" checkpoint_dir="%s" filename="%s"', + checkpoint_dir, + filename, + ) + except Exception: + self.logger.exception( + 'msg="Unknown exception when saving checkpoint data" checkpoint_dir="%s" filename="%s"', + checkpoint_dir, + filename, + ) + return False + + def get_checkpoint_data( + self, filename, checkpoint_dir=None, raise_known_exceptions=False + ): + """ + Get arbitrary checkpoint data from JSON. + + Arguments: + filename -- The name of the file to retrieve in the checkpoint directory. + checkpoint_dir -- The directory where checkpoints ought to be saved. Should + be set only if the intent is to read data from the checkpoint directory + of a different modular input. + + Returns: + data -- A Python data structure converted from JSON. + + Throws: + IOError or Exception if the checkpoint cannot be read; ValueError for + malformed data. The caller should check if the file exists if it is + necessary to distinguish between invalid data versus missing data. + """ + checkpoint_dir = checkpoint_dir or self._input_config.checkpoint_dir + checkpoint_path = os.path.join(checkpoint_dir, filename) + data = None + + try: + if os.path.isfile(checkpoint_path): + with open(checkpoint_path, "r") as fp: # noqa + data = json.load(fp) + except (IOError, ValueError) as e: + self.logger.exception( + 'msg="Exception when reading checkpoint data" checkpoint_dir="%s" filename="%s" exception="%s"', + checkpoint_dir, + filename, + e, + ) + if raise_known_exceptions: + raise + except Exception: + self.logger.exception( + 'msg="Unknown exception when reading checkpoint data" checkpoint_dir="%s" filename="%s"', + checkpoint_dir, + filename, + ) + raise + + return data + + def get_validation_data(self, in_stream=sys.stdin): + """ + Get the validation data from standard input + + Arguments: + in_stream -- The stream to get the input from (defaults to standard input) + """ + + raise Exception("get_validation_data function was not implemented") + + def validate_parameters_from_cli(self, argument_array=None): + """ + Load the arguments from the given array (or from the command-line) and validate them. + + Arguments: + argument_array -- An array of arguments (will get them from the command-line arguments if none) + """ + + # Get the arguments from the sys.argv if not provided + if argument_array is None: + argument_array = sys.argv[1:] + + # This is the list of parameters we will generate + parameters = {} + + for i in range(0, len(self.args)): + arg = self.args[i] + + if i < len(argument_array): + parameters[arg.name] = argument_array[i] + else: + parameters[arg.name] = None + + # Now that we have simulated the parameters, go ahead and test them + self.validate_parameters("unnamed", parameters) + + def _parse_args(self, argv): + """Parse custom CLI arguments. this method must remain private to avoid conflict with similarly named methods + in classes that inherit from this class.""" + + warning_text = ( + "WARNING: this parameter is a custom Apps extension for debugging only." + ) + + parser = argparse.ArgumentParser(description="Modular input parameters") + + mode_args = parser.add_mutually_exclusive_group() + debug_args = parser.add_argument_group() + + debug_args.add_argument( + "--username", + action="store", + default=None, + help="Splunk username (%s)" % warning_text, + ) + debug_args.add_argument( + "--password", + action="store", + default=None, + help="Splunk password (%s)" % warning_text, + ) + debug_args.add_argument( + "--infile", + type=argparse.FileType(), + default=None, + help="Filename containing XML modular input configuration (%s)" + % warning_text, + ) + + mode_args.add_argument("--scheme", action="store_true") + mode_args.add_argument( + "--validate-arguments", dest="validate", action="store_true" + ) + + return parser.parse_args(argv) + + def execute(self, in_stream=sys.stdin, out_stream=sys.stdout): + """ + Get the arguments that were provided from the command-line and execute the script. + + Arguments: + in_stream -- The stream to get the input from (defaults to standard input) + out_stream -- The stream to write the output to (defaults to standard output) + """ + + # Invalid arguments will cause the modular input to return usage here. + args = self._parse_args(sys.argv[1:]) + + try: + self.logger.debug("Execute called") + + if args.scheme: + self.do_scheme(out_stream) + + elif args.validate: + self.logger.info("Modular input: validate arguments called") + + # Exit with a code of -1 if validation failed + if not self.do_validation(): + sys.exit(-1) + + else: + + if args.username: + + if not args.password: + try: + args.password = getpass.getpass("Splunk password: ") + except Exception: + self.logger.exception( + "Modular input: could not retrieve Splunk password." + ) + + try: + self._alt_session_key = splunk.auth.getSessionKey( + args.username, args.password + ) + except Exception: + self.logger.exception( + "Modular input: session key override failed." + ) + + # If specified, override the data passed on sys.stdin. + if args.infile: + try: + self.do_run(args.infile, log_exception_and_continue=True) + except IOError: + self.logger.exception( + "Modular input: modinput configuration could not be read from file %s.", + args.infile.name, + ) + else: + try: + self.do_run(in_stream, log_exception_and_continue=True) + except IOError: + self.logger.exception( + "Modular input: modinput configuration could not be read from input stream." + ) + + self.logger.debug("Execution completed.") + + except Exception as e: + self.logger.exception("Execution failed: %s" % (str(e))) + + # Make sure to grab any exceptions so that we can print a valid error message + self.print_error(str(e), out_stream) + + def gen_checkpoint_filename(self, stanza_name, modinput_name=None): + """Generate a checkpoint filename for this stanza. Collision detection + is not performed explicitly, since we don't expect duplicate stanzas. + + Parameters: + stanza_name - A string representing the stanza name, which is typically + in the form :// + modinput_name - An alternate modular input name. This can be used to + construct a safe path to the checkpoint directory of a different + modular input, which is useful in situations where two modular inputs + are acting in a producer/consumer relationship. + + Returns: The path to the checkpoint file corresponding to the stanza + and modular input name. The caller is repsonsible for ensuring that + the path can read/written. + """ + checkpoint_filename = ( + stanza_name.split("://")[1] if "://" in stanza_name else stanza_name + ) + if modinput_name: + return os.path.join( + os.path.dirname(self._input_config.checkpoint_dir), + modinput_name, + checkpoint_filename, + ) + return os.path.join(self._input_config.checkpoint_dir, checkpoint_filename) + + def get_checkpoint_update_times(self, stanza_names, modinput_name=None): + """Get the update timestamps for checkpointed files by stanza name. + + Parameters: + + stanza_names - A list of strings representing stanza names. + modinput_name - A string representing the name of another modular + input to derive checkpoint file update timstamps for, if this modular + input is acting as a consumer of the output of another modular input. + + Returns: A list of tuples: + [(stanza_name, path_to_checkpoint_file, last_updated_timestamp), + ... + ] + + """ + + output = [] + for stanza_name in stanza_names: + path = self.gen_checkpoint_filename(stanza_name, modinput_name) + if os.path.isfile(path): + try: + fstat = os.stat(path) + output.append( + (stanza_name, path, fstat.st_size, int(fstat.st_mtime)) + ) + except IOError: + output.append((stanza_name, path, None, None)) + else: + output.append((stanza_name, None, None, None)) + return output + + def is_configured(self, app, assume_true_on_error=False): + try: + unused_r, c = splunk.rest.simpleRequest( + "apps/local/{0}".format(quote(app, safe="")), + sessionKey=self._input_config.session_key, + getargs={"output_mode": "json"}, + raiseAllErrors=True, + ) + + c = json.loads(c)["entry"][0]["content"] + return normalizeBoolean(c["configured"]) is True + except Exception: + return assume_true_on_error + + def is_kvstore_ready(self, assume_true_on_error=False): + try: + unused_r, c = splunk.rest.simpleRequest( + "kvstore/status/status", + sessionKey=self._input_config.session_key, + getargs={"output_mode": "json"}, + raiseAllErrors=True, + ) + + c = json.loads(c)["entry"][0]["content"] + + return c["current"]["status"] == "ready" + except Exception as e: + self.logger.warn(e) + return assume_true_on_error diff --git a/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/fields.py b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/fields.py new file mode 100644 index 000000000..435891537 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/fields.py @@ -0,0 +1,472 @@ +""" +Copyright (C) 2005 - 2019 Splunk Inc. All Rights Reserved. +""" +import json +import re + + +class FieldValidationException(Exception): + pass + + +class Field(object): + """ + This is the base class that should be used to create field validators. Sub-class this and override to_python if you + need custom validation. + """ + + DATA_TYPE_STRING = "string" + DATA_TYPE_NUMBER = "number" + DATA_TYPE_BOOLEAN = "boolean" + + def get_data_type(self): + """ + Get the type of the field. + """ + + return Field.DATA_TYPE_STRING + + def __init__( + self, name, title, description, required_on_create=True, required_on_edit=False + ): + """ + Create the field. + + Arguments: + name -- Set the name of the field (e.g. "database_server") + title -- Set the human readable title (e.g. "Database server") + description -- Set the human readable description of the field (e.g. "The IP or domain name of the database server") + required_on_create -- If "true", the parameter is required on input stanza creation. + required_on_edit -- If "true", the parameter is required on input stanza modification. + + Default values for required_on_create and required_on_edit match the + documented behavior at http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModInputsScripts. + """ + + # Note: there is no distinction between a None value and blank value, + # as modular input UIs does not recognize such a distinction. + if name is None or len(name.strip()) == 0: + raise ValueError("The name parameter cannot be empty.") + + if title is None or len(title.strip()) == 0: + raise ValueError("The title parameter cannot be empty.") + + if description is None or len(description.strip()) == 0: + raise ValueError("The description parameter cannot be empty.") + + self.name = name + self.title = title + self.description = description + self.required_on_create = required_on_create + self.required_on_edit = required_on_edit + + def to_python(self, value): + """ + Convert the field to a Python object. Should throw a FieldValidationException if the data is invalid. + + Arguments: + value -- The value to convert + """ + + # No standard validation here; the modular input framework handles empty values. + return value + + def to_string(self, value): + """ + Convert the field to a string value that can be returned. Should throw a FieldValidationException if the data is invalid. + + Arguments: + value -- The value to convert + """ + + return str(value) + + def __str__(self): + return str(self.__dict__) + + +class BooleanField(Field): + def to_python(self, value): + Field.to_python(self, value) + + if value in [True, False]: + return value + + elif str(value).strip().lower() in ["true", "t", "1"]: + return True + + elif str(value).strip().lower() in ["false", "f", "0"]: + return False + + raise FieldValidationException( + "The value of '%s' for the '%s' parameter is not a valid boolean" + % (str(value), self.name) + ) + + def to_string(self, value): + + if value is True: + return "1" + + elif value is False: + return "0" + + return str(value) + + def get_data_type(self): + return Field.DATA_TYPE_BOOLEAN + + +class DelimitedField(Field): + def __init__( + self, + name, + title, + description, + delim, + required_on_create=True, + required_on_edit=False, + ): + super(DelimitedField, self).__init__( + name, title, description, required_on_create, required_on_edit + ) + self._delim = delim + + def to_python(self, value): + + Field.to_python(self, value) + + if value is not None: + try: + tmp = value.split(self._delim) + return tmp + except ValueError as e: + raise FieldValidationException(str(e)) + else: + return None + + def to_string(self, value): + + if value is not None: + return str(value) + + return "" + + def get_data_type(self): + return Field.DATA_TYPE_STRING + + +class DurationField(Field): + """ + The duration field represents a duration as represented by a string such as 1d for a 24 hour period. + + The string is converted to an integer indicating the number of seconds. + """ + + DURATION_RE = re.compile(r"(?P[0-9]+)\s*(?P[a-z]*)", re.IGNORECASE) + + MINUTE = 60 + HOUR = 3600 + DAY = 86400 + WEEK = 604800 + + UNITS = { + "w": WEEK, + "week": WEEK, + "d": DAY, + "day": DAY, + "h": HOUR, + "hour": HOUR, + "m": MINUTE, + "min": MINUTE, + "minute": MINUTE, + "s": 1, + } + + def to_python(self, value): + Field.to_python(self, value) + + # Parse the duration + m = DurationField.DURATION_RE.match(value) + + # Make sure the duration could be parsed + if m is None: + raise FieldValidationException( + "The value of '%s' for the '%s' parameter is not a valid duration" + % (str(value), self.name) + ) + + # Get the units and duration + d = m.groupdict() + + units = d["units"] + + # Parse the value provided + try: + duration = int(d["duration"]) + except ValueError: + raise FieldValidationException( + "The duration '%s' for the '%s' parameter is not a valid number" + % (d["duration"], self.name) + ) + + # Make sure the units are valid + if len(units) > 0 and units not in DurationField.UNITS: + raise FieldValidationException( + "The unit '%s' for the '%s' parameter is not a valid unit of duration" + % (units, self.name) + ) + + # Convert the units to seconds + if len(units) > 0: + return duration * DurationField.UNITS[units] + else: + return duration + + def to_string(self, value): + return str(value) + + +class FloatField(Field): + def to_python(self, value): + + Field.to_python(self, value) + + if value is not None: + try: + return float(value) + except ValueError as e: + raise FieldValidationException(str(e)) + else: + return None + + def to_string(self, value): + + if value is not None: + return str(value) + + return "" + + def get_data_type(self): + return Field.DATA_TYPE_NUMBER + + +class IntegerField(Field): + def to_python(self, value): + + Field.to_python(self, value) + + if value is not None: + try: + return int(value) + except ValueError as e: + raise FieldValidationException(str(e)) + else: + return None + + def to_string(self, value): + + if value is not None: + return str(value) + + return "" + + def get_data_type(self): + return Field.DATA_TYPE_NUMBER + + +class IntervalField(Field): + """Class for handling Splunk's "interval" field, which typically accepts + an integer value OR a cron-style string. Note that this means that the + data type returned is a string, so the modular input must handle conversion + of this string to an integer at runtime.""" + + # Accepted cron field formats: + # Asterisk: * (equivalent to first-last range) + # Lists: 1,2,3,4,5 + # Ranges: 1-60 + # + # and combinations of the above: + # + # Ranges followed by steps: 0-23/2 + # Asterisks followed by steps: */2 + # + # Note that we don't check explicitly for correct numeric values for each + # cron field. + + cron_rx = re.compile( + r""" + ( + \d{1,2} # A digit. + |\d{1,2}-\d{1,2} # A range. + |(\d{1,2},)+\d{1,2} # A list of digits. + |\d{1,2}-\d{1,2}/\d{1,2} # A range followed by a step. + |\* # The asterisk character. + |\*/\d{1,2} # An asterisk followed by a step. + ) + """, + re.VERBOSE, + ) + + def to_python(self, value): + + try: + # Try parsing the string as an integer. + int(value) + return value + except ValueError: + # Try parsing the string as a cron schedule. + if self.parse_cron(value): + return value + + raise FieldValidationException( + "The value of '{}' for the '{}' parameter is not a valid value".format( + value, self.name + ) + ) + + def get_data_type(self): + return Field.DATA_TYPE_STRING + + def parse_cron(self, value): + """Check for valid cron string.""" + + fields = value.split() + if len(fields) == 5 and all([self.cron_rx.match(i) for i in fields]): + return True + return False + + +class JsonField(Field): + def to_python(self, value): + Field.to_python(self, value) + + try: + return json.loads(value) + except (TypeError, ValueError): + raise FieldValidationException( + "The value of '%s' for the '%s' parameter is not a valid JSON object" + % (str(value), self.name) + ) + + def to_string(self, value): + return str(value) + + def get_data_type(self): + return Field.DATA_TYPE_STRING + + +class ListField(Field): + def to_python(self, value): + + Field.to_python(self, value) + + if value is not None: + return [x.strip() for x in value.split(",")] + else: + return [] + + def to_string(self, value): + + if value is not None: + return ",".join(value) + + return "" + + +class RangeField(Field): + def __init__( + self, + name, + title, + description, + low, + high, + required_on_create=True, + required_on_edit=False, + ): + super(RangeField, self).__init__( + name, title, description, required_on_create, required_on_edit + ) + self.low = low + self.high = high + + def to_python(self, value): + + Field.to_python(self, value) + + if value is not None: + try: + tmp = int(value) + if tmp >= self.low and tmp <= self.high: + return tmp + else: + raise FieldValidationException("Value out of range.") + except ValueError as e: + raise FieldValidationException(str(e)) + else: + return None + + def to_string(self, value): + + if value is not None: + return str(value) + + return "" + + def get_data_type(self): + return Field.DATA_TYPE_NUMBER + + +class RegexField(Field): + def to_python(self, value): + + Field.to_python(self, value) + + if value is not None: + try: + return re.compile(value) + except Exception as e: + raise FieldValidationException(str(e)) + else: + return None + + def to_string(self, value): + + if value is not None: + return value.pattern + + return "" + + +class SeverityField(Field): + + # Note: We ignore "FATAL" severity since Python's logging assigns it the + # same value as "CRITICAL". + SEVERITIES = {"DEBUG": 10, "INFO": 20, "WARN": 30, "ERROR": 40, "CRITICAL": 50} + + SEVERITIES_BY_INT = {v: k for k, v in SEVERITIES.items()} + + def to_python(self, value): + + try: + if value in SeverityField.SEVERITIES: + return SeverityField.SEVERITIES[value] + except AttributeError: + # Did not receive a string for some reason. + pass + + raise FieldValidationException( + "The value of '{}' for the '{}' parameter is not a valid value".format( + value, self.name + ) + ) + + def to_string(self, value): + if value in SeverityField.SEVERITIES_BY_INT: + return SeverityField.SEVERITIES_BY_INT[value] + else: + raise ValueError("Invalid value provided for severity.") + + def get_data_type(self): + return Field.DATA_TYPE_NUMBER diff --git a/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/json_modinput.py b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/json_modinput.py new file mode 100644 index 000000000..4565e6118 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/json_modinput.py @@ -0,0 +1,133 @@ +""" +Copyright (C) 2005 - 2019 Splunk Inc. All Rights Reserved. +""" +import sys +import json +from .base_modinput import BaseModularInput, ModularInputConfig + + +class JsonModularInput(BaseModularInput): + def _create_event(self, params, stanza): + """Create an event for JSON streaming output. + + Arguments: + params - a dictionary of attributes for the event + stanza - the stanza + """ + # Create the event base element + event = {} + # Indicate if this script is single-instance mode or not. + if self.use_single_instance: + event["stanza"] = stanza["name"] + + # Fill s/st/h/i in first from stanza configs + for element in filter( + lambda x: x in ["host", "index", "source", "sourcetype"], stanza.keys() + ): + event[element] = stanza[element] + + # Define the possible elements + valid_elements = ["host", "index", "source", "sourcetype", "time", "event"] + + # Append the valid child elements. Invalid elements will be dropped. + # Override s/st/h/i if specified in params + for element in filter(lambda x: x in valid_elements, params.keys()): + event[element] = params[element] + + return event + + def _print_event(self, event): + """ + Adds a single event or a list of evnets to JSON streaming output. + """ + + if isinstance(event, list): + return "".join([json.dumps(evt) for evt in event]) + else: + return json.dumps(event) + + def get_scheme(self): + """ + Get the scheme of the inputs parameters and return as a string. + """ + + doc = { + "title": self.title, + "description": self.description, + "use_external_validation": str(getattr(self, "use_external_validation", "")) + .strip() + .lower() + in ["true", "t", "1"], + "streaming_mode": self.streaming_mode, + "use_single_instance": str(getattr(self, "use_single_instance", "")) + .strip() + .lower() + in ["true", "t", "1"], + "endpoint": {"args": []}, + } + + # Create the argument elements + self.add_json_args(doc["endpoint"]["args"]) + + # Return the content as a string + return json.dumps(doc) + + def add_json_args(self, endpoint_args): + """ + Add the arguments to the JSON scheme. + + Arguments: + endpoint_args -- The list that should be the parent of the arg elements that will be added. + """ + for arg in self.args: + endpoint_args.append( + { + "name": arg.name, + "title": arg.title, + "description": arg.description, + "data_type": arg.get_data_type(), + "required_on_create": arg.required_on_create, + "required_on_edit": arg.required_on_edit, + } + ) + + def print_error(self, error, out=sys.stdout): + """ + Prints the given error message to standard output. + + Arguments: + error -- The message to be printed + out -- The stream to write the message to (defaults to standard output) + """ + + json.dump({"message": error}, out) + + def read_config(self, in_stream=sys.stdin): + """ + Read the config from standard input and return the configuration. + + in_stream -- The stream to get the input from (defaults to standard input) + """ + + config_str_json = in_stream.read() + return ModularInputConfig.get_config_from_json(config_str_json) + + def get_validation_data(self, in_stream=sys.stdin): + """ + Get the validation data from standard input + + Arguments: + in_stream -- The stream to get the input from (defaults to standard input) + """ + + # Read everything from stdin + val_str = in_stream.read() + + # Parse the validation JSON + doc = json.loads(val_str) + items = doc.get("items") + stanza = list(items)[0] + params = items[stanza] + params["name"] = stanza + + return params if items else {} diff --git a/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/xml_modinput.py b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/xml_modinput.py new file mode 100644 index 000000000..922a43170 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lib/splunk_sa_cim/modinput/xml_modinput.py @@ -0,0 +1,277 @@ +""" +Copyright (C) 2005 - 2017 Splunk Inc. All Rights Reserved. +""" +import sys +import xml.dom +from xml.dom.minidom import Document +import xml.sax.saxutils +from .base_modinput import BaseModularInput, ModularInputConfig + + +class XmlModularInput(BaseModularInput): + def _create_formatter_textnode(self, xmldoc, nodename, value): + """Shortcut for creating a formatter textnode. + + Arguments: + xmldoc - A Document object. + nodename - A string name for the node. + """ + node = xmldoc.createElement(nodename) + text = xmldoc.createTextNode(str(value)) + node.appendChild(text) + + return node + + def _create_document(self): + """Create the document for sending XML streaming events.""" + + doc = Document() + + # Create the base element + stream = doc.createElement("stream") + doc.appendChild(stream) + + return doc + + def _create_event(self, doc, params, stanza, unbroken=False, close=True): + """Create an event for XML streaming output. + + Arguments: + doc - a Document object. + params - a dictionary of attributes for the event. + stanza - the stanza + """ + + # Create the base element + event = doc.createElement("event") + + # Indicate if this event is to be unbroken (meaning a tag will + # need to be added by a future event. + if unbroken: + event.setAttribute("unbroken", "1") + + # Indicate if this script is single-instance mode or not. + if self.use_single_instance == "true": + event.setAttribute("stanza", stanza["name"]) + + # Define the possible elements + valid_elements = ["host", "index", "source", "sourcetype", "time", "data"] + + # Append the valid child elements. Invalid elements will be dropped. + for element in filter(lambda x: x in valid_elements, params.keys()): + event.appendChild( + self._create_formatter_textnode(doc, element, params[element]) + ) + + if close: + event.appendChild(doc.createElement("done")) + + return event + + def _print_event(self, doc, event): + """Adds an event to XML streaming output.""" + + # Get the stream from the document. + stream = doc.firstChild + + # Append the event. + stream.appendChild(event) + + # Return the content as a string WITHOUT the XML header; remove the + # child object so the next event can be returned and reuse the same + # Document object. + output = doc.documentElement.toxml() + + stream.removeChild(event) + + return output + + def _add_events(self, doc, events): + """Adds a set of events to XML streaming output.""" + + # Get the stream from the document. + stream = doc.firstChild + + # Add the node. + for event in events: + stream.appendChild(event) + + # Return the content as a string WITHOUT the XML header. + return doc.documentElement.toxml() + + def get_scheme(self): + """ + Get the scheme of the inputs parameters and return as a string. + """ + + # Create the XML document + doc = Document() + + # Create the base element + element_scheme = doc.createElement("scheme") + doc.appendChild(element_scheme) + + # Create the title element + element_title = doc.createElement("title") + element_scheme.appendChild(element_title) + + element_title_text = doc.createTextNode(self.title) + element_title.appendChild(element_title_text) + + # Create the description element + element_desc = doc.createElement("description") + element_scheme.appendChild(element_desc) + + element_desc_text = doc.createTextNode(self.description) + element_desc.appendChild(element_desc_text) + + # Create the use_external_validation element + element_external_validation = doc.createElement("use_external_validation") + element_scheme.appendChild(element_external_validation) + + element_external_validation_text = doc.createTextNode( + self.use_external_validation + ) + element_external_validation.appendChild(element_external_validation_text) + + # Create the streaming_mode element + element_streaming_mode = doc.createElement("streaming_mode") + element_scheme.appendChild(element_streaming_mode) + + element_streaming_mode_text = doc.createTextNode(self.streaming_mode) + element_streaming_mode.appendChild(element_streaming_mode_text) + + # Create the use_single_instance element + element_use_single_instance = doc.createElement("use_single_instance") + element_scheme.appendChild(element_use_single_instance) + + element_use_single_instance_text = doc.createTextNode(self.use_single_instance) + element_use_single_instance.appendChild(element_use_single_instance_text) + + # Create the elements to stored args element + element_endpoint = doc.createElement("endpoint") + element_scheme.appendChild(element_endpoint) + + element_args = doc.createElement("args") + element_endpoint.appendChild(element_args) + + # Create the argument elements + self.add_xml_args(doc, element_args) + + # Return the content as a string + return doc.toxml() + + def add_xml_args(self, doc, element_args): + """ + Add the arguments to the XML scheme. + + Arguments: + doc -- The XML document + element_args -- The element that should be the parent of the arg elements that will be added. + """ + + for arg in self.args: + element_arg = doc.createElement("arg") + element_arg.setAttribute("name", arg.name) + + element_args.appendChild(element_arg) + + # Create the title element + element_title = doc.createElement("title") + element_arg.appendChild(element_title) + + element_title_text = doc.createTextNode(arg.title) + element_title.appendChild(element_title_text) + + # Create the description element + element_desc = doc.createElement("description") + element_arg.appendChild(element_desc) + + element_desc_text = doc.createTextNode(arg.description) + element_desc.appendChild(element_desc_text) + + # Create the data_type element + element_data_type = doc.createElement("data_type") + element_arg.appendChild(element_data_type) + + element_data_type_text = doc.createTextNode(arg.get_data_type()) + element_data_type.appendChild(element_data_type_text) + + # Create the required_on_create element + element_required_on_create = doc.createElement("required_on_create") + element_arg.appendChild(element_required_on_create) + + element_required_on_create_text = doc.createTextNode( + "true" if arg.required_on_create else "false" + ) + element_required_on_create.appendChild(element_required_on_create_text) + + # Create the required_on_save element + element_required_on_edit = doc.createElement("required_on_edit") + element_arg.appendChild(element_required_on_edit) + + element_required_on_edit_text = doc.createTextNode( + "true" if arg.required_on_edit else "false" + ) + element_required_on_edit.appendChild(element_required_on_edit_text) + + def print_error(self, error, out=sys.stdout): + """ + Prints the given error message to standard output. + + Arguments: + error -- The message to be printed + out -- The stream to write the message to (defaults to standard output) + """ + + out.write( + "%s" % xml.sax.saxutils.escape(error) + ) + + def read_config(self, in_stream=sys.stdin): + """ + Read the config from standard input and return the configuration. + + in_stream -- The stream to get the input from (defaults to standard input) + """ + + config_str_xml = in_stream.read() + + return ModularInputConfig.get_config_from_xml(config_str_xml) + + def get_validation_data(self, in_stream=sys.stdin): + """ + Get the validation data from standard input + + Arguments: + in_stream -- The stream to get the input from (defaults to standard input) + """ + + val_data = {} + + # Read everything from stdin + val_str = in_stream.read() + + # Parse the validation XML + doc = xml.dom.minidom.parseString(val_str) + root = doc.documentElement + + item_node = root.getElementsByTagName("item")[0] + if item_node: + + name = item_node.getAttribute("name") + val_data["name"] = name + + params_node = item_node.getElementsByTagName("param") + + for param in params_node: + name = param.getAttribute("name") + + if ( + name + and param.firstChild + and param.firstChild.nodeType == param.firstChild.TEXT_NODE + ): + val_data[name] = param.firstChild.data + + return val_data diff --git a/deps/apps/Splunk_SA_CIM/license-eula.rtf b/deps/apps/Splunk_SA_CIM/license-eula.rtf new file mode 100644 index 000000000..868bf977a --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/license-eula.rtf @@ -0,0 +1,3160 @@ +{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch37\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe1041\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;} +{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\*\panose 05050102010706020507}Symbol;}{\f4\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Helvetica;} +{\f10\fbidi \fnil\fcharset2\fprq2{\*\panose 05000000000000000000}Wingdings;}{\f15\fbidi \fmodern\fcharset128\fprq1{\*\panose 020b0609070205080204}MS Gothic{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};} +{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604030504040204}Tahoma;} +{\f39\fbidi \fnil\fcharset128\fprq2 DejaVu Sans;}{\f40\fbidi \fnil\fcharset128\fprq2 Lohit Hindi{\*\falt MS Mincho};}{\f41\fbidi \fnil\fcharset0\fprq2{\*\panose 02000503000000020004}Helvetica Neue{\*\falt Malgun Gothic};} +{\f42\fbidi \fnil\fcharset0\fprq2{\*\panose 020b0600040502020204}Lucida Grande;}{\f87\fbidi \fmodern\fcharset128\fprq1{\*\panose 020b0609070205080204}@MS Gothic;}{\f301\fbidi \fnil\fcharset128\fprq2 @Lohit Hindi;} +{\f302\fbidi \fnil\fcharset128\fprq2 @DejaVu Sans;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;} +{\fdbmajor\f31501\fbidi \fmodern\fcharset128\fprq1{\*\panose 020b0609070205080204}MS Gothic{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};}{\fhimajor\f31502\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;} +{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;} +{\fdbminor\f31505\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt \'82\'6c\'82\'72 \'96\'be\'92\'a9};}{\fhiminor\f31506\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;} +{\fbiminor\f31507\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f303\fbidi \froman\fcharset238\fprq2 Times New Roman CE;}{\f304\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;} +{\f306\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\f307\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\f308\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\f309\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);} +{\f310\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\f311\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\f313\fbidi \fswiss\fcharset238\fprq2 Arial CE;}{\f314\fbidi \fswiss\fcharset204\fprq2 Arial Cyr;} +{\f316\fbidi \fswiss\fcharset161\fprq2 Arial Greek;}{\f317\fbidi \fswiss\fcharset162\fprq2 Arial Tur;}{\f318\fbidi \fswiss\fcharset177\fprq2 Arial (Hebrew);}{\f319\fbidi \fswiss\fcharset178\fprq2 Arial (Arabic);} +{\f320\fbidi \fswiss\fcharset186\fprq2 Arial Baltic;}{\f321\fbidi \fswiss\fcharset163\fprq2 Arial (Vietnamese);}{\f323\fbidi \fmodern\fcharset238\fprq1 Courier New CE;}{\f324\fbidi \fmodern\fcharset204\fprq1 Courier New Cyr;} +{\f326\fbidi \fmodern\fcharset161\fprq1 Courier New Greek;}{\f327\fbidi \fmodern\fcharset162\fprq1 Courier New Tur;}{\f328\fbidi \fmodern\fcharset177\fprq1 Courier New (Hebrew);}{\f329\fbidi \fmodern\fcharset178\fprq1 Courier New (Arabic);} +{\f330\fbidi \fmodern\fcharset186\fprq1 Courier New Baltic;}{\f331\fbidi \fmodern\fcharset163\fprq1 Courier New (Vietnamese);}{\f343\fbidi \fswiss\fcharset238\fprq2 Helvetica CE;}{\f344\fbidi \fswiss\fcharset204\fprq2 Helvetica Cyr;} +{\f346\fbidi \fswiss\fcharset161\fprq2 Helvetica Greek;}{\f347\fbidi \fswiss\fcharset162\fprq2 Helvetica Tur;}{\f348\fbidi \fswiss\fcharset177\fprq2 Helvetica (Hebrew);}{\f349\fbidi \fswiss\fcharset178\fprq2 Helvetica (Arabic);} +{\f350\fbidi \fswiss\fcharset186\fprq2 Helvetica Baltic;}{\f351\fbidi \fswiss\fcharset163\fprq2 Helvetica (Vietnamese);}{\f455\fbidi \fmodern\fcharset0\fprq1 MS Gothic Western{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};} +{\f453\fbidi \fmodern\fcharset238\fprq1 MS Gothic CE{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};}{\f454\fbidi \fmodern\fcharset204\fprq1 MS Gothic Cyr{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};} +{\f456\fbidi \fmodern\fcharset161\fprq1 MS Gothic Greek{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};}{\f457\fbidi \fmodern\fcharset162\fprq1 MS Gothic Tur{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};} +{\f460\fbidi \fmodern\fcharset186\fprq1 MS Gothic Baltic{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};}{\f643\fbidi \froman\fcharset238\fprq2 Cambria Math CE;}{\f644\fbidi \froman\fcharset204\fprq2 Cambria Math Cyr;} +{\f646\fbidi \froman\fcharset161\fprq2 Cambria Math Greek;}{\f647\fbidi \froman\fcharset162\fprq2 Cambria Math Tur;}{\f650\fbidi \froman\fcharset186\fprq2 Cambria Math Baltic;}{\f651\fbidi \froman\fcharset163\fprq2 Cambria Math (Vietnamese);} +{\f673\fbidi \fswiss\fcharset238\fprq2 Calibri CE;}{\f674\fbidi \fswiss\fcharset204\fprq2 Calibri Cyr;}{\f676\fbidi \fswiss\fcharset161\fprq2 Calibri Greek;}{\f677\fbidi \fswiss\fcharset162\fprq2 Calibri Tur;} +{\f680\fbidi \fswiss\fcharset186\fprq2 Calibri Baltic;}{\f681\fbidi \fswiss\fcharset163\fprq2 Calibri (Vietnamese);}{\f683\fbidi \fswiss\fcharset238\fprq2 Tahoma CE;}{\f684\fbidi \fswiss\fcharset204\fprq2 Tahoma Cyr;} +{\f686\fbidi \fswiss\fcharset161\fprq2 Tahoma Greek;}{\f687\fbidi \fswiss\fcharset162\fprq2 Tahoma Tur;}{\f688\fbidi \fswiss\fcharset177\fprq2 Tahoma (Hebrew);}{\f689\fbidi \fswiss\fcharset178\fprq2 Tahoma (Arabic);} +{\f690\fbidi \fswiss\fcharset186\fprq2 Tahoma Baltic;}{\f691\fbidi \fswiss\fcharset163\fprq2 Tahoma (Vietnamese);}{\f692\fbidi \fswiss\fcharset222\fprq2 Tahoma (Thai);}{\f723\fbidi \fnil\fcharset238\fprq2 Lucida Grande CE;} +{\f724\fbidi \fnil\fcharset204\fprq2 Lucida Grande Cyr;}{\f726\fbidi \fnil\fcharset161\fprq2 Lucida Grande Greek;}{\f727\fbidi \fnil\fcharset162\fprq2 Lucida Grande Tur;}{\f728\fbidi \fnil\fcharset177\fprq2 Lucida Grande (Hebrew);} +{\f730\fbidi \fnil\fcharset186\fprq2 Lucida Grande Baltic;}{\f731\fbidi \fnil\fcharset163\fprq2 Lucida Grande (Vietnamese);}{\f1175\fbidi \fmodern\fcharset0\fprq1 @MS Gothic Western;}{\f1173\fbidi \fmodern\fcharset238\fprq1 @MS Gothic CE;} +{\f1174\fbidi \fmodern\fcharset204\fprq1 @MS Gothic Cyr;}{\f1176\fbidi \fmodern\fcharset161\fprq1 @MS Gothic Greek;}{\f1177\fbidi \fmodern\fcharset162\fprq1 @MS Gothic Tur;}{\f1180\fbidi \fmodern\fcharset186\fprq1 @MS Gothic Baltic;} +{\flomajor\f31508\fbidi \froman\fcharset238\fprq2 Times New Roman CE;}{\flomajor\f31509\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\flomajor\f31511\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;} +{\flomajor\f31512\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\flomajor\f31513\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\flomajor\f31514\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);} +{\flomajor\f31515\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\flomajor\f31516\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);} +{\fdbmajor\f31520\fbidi \fmodern\fcharset0\fprq1 MS Gothic Western{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};}{\fdbmajor\f31518\fbidi \fmodern\fcharset238\fprq1 MS Gothic CE{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};} +{\fdbmajor\f31519\fbidi \fmodern\fcharset204\fprq1 MS Gothic Cyr{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};}{\fdbmajor\f31521\fbidi \fmodern\fcharset161\fprq1 MS Gothic Greek{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};} +{\fdbmajor\f31522\fbidi \fmodern\fcharset162\fprq1 MS Gothic Tur{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};}{\fdbmajor\f31525\fbidi \fmodern\fcharset186\fprq1 MS Gothic Baltic{\*\falt \'82\'6c\'82\'72 \'83\'53\'83\'56\'83\'62\'83\'4e};} +{\fhimajor\f31528\fbidi \fswiss\fcharset238\fprq2 Calibri CE;}{\fhimajor\f31529\fbidi \fswiss\fcharset204\fprq2 Calibri Cyr;}{\fhimajor\f31531\fbidi \fswiss\fcharset161\fprq2 Calibri Greek;}{\fhimajor\f31532\fbidi \fswiss\fcharset162\fprq2 Calibri Tur;} +{\fhimajor\f31535\fbidi \fswiss\fcharset186\fprq2 Calibri Baltic;}{\fhimajor\f31536\fbidi \fswiss\fcharset163\fprq2 Calibri (Vietnamese);}{\fbimajor\f31538\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} +{\fbimajor\f31539\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\fbimajor\f31541\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\fbimajor\f31542\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;} +{\fbimajor\f31543\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\fbimajor\f31544\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\fbimajor\f31545\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;} +{\fbimajor\f31546\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\flominor\f31548\fbidi \froman\fcharset238\fprq2 Times New Roman CE;}{\flominor\f31549\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;} +{\flominor\f31551\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\flominor\f31552\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\flominor\f31553\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} +{\flominor\f31554\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\flominor\f31555\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\flominor\f31556\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);} +{\fdbminor\f31560\fbidi \fmodern\fcharset0\fprq1 MS Mincho Western{\*\falt \'82\'6c\'82\'72 \'96\'be\'92\'a9};}{\fdbminor\f31558\fbidi \fmodern\fcharset238\fprq1 MS Mincho CE{\*\falt \'82\'6c\'82\'72 \'96\'be\'92\'a9};} +{\fdbminor\f31559\fbidi \fmodern\fcharset204\fprq1 MS Mincho Cyr{\*\falt \'82\'6c\'82\'72 \'96\'be\'92\'a9};}{\fdbminor\f31561\fbidi \fmodern\fcharset161\fprq1 MS Mincho Greek{\*\falt \'82\'6c\'82\'72 \'96\'be\'92\'a9};} +{\fdbminor\f31562\fbidi \fmodern\fcharset162\fprq1 MS Mincho Tur{\*\falt \'82\'6c\'82\'72 \'96\'be\'92\'a9};}{\fdbminor\f31565\fbidi \fmodern\fcharset186\fprq1 MS Mincho Baltic{\*\falt \'82\'6c\'82\'72 \'96\'be\'92\'a9};} +{\fhiminor\f31568\fbidi \froman\fcharset238\fprq2 Cambria CE;}{\fhiminor\f31569\fbidi \froman\fcharset204\fprq2 Cambria Cyr;}{\fhiminor\f31571\fbidi \froman\fcharset161\fprq2 Cambria Greek;}{\fhiminor\f31572\fbidi \froman\fcharset162\fprq2 Cambria Tur;} +{\fhiminor\f31575\fbidi \froman\fcharset186\fprq2 Cambria Baltic;}{\fhiminor\f31576\fbidi \froman\fcharset163\fprq2 Cambria (Vietnamese);}{\fbiminor\f31578\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} +{\fbiminor\f31579\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\fbiminor\f31581\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\fbiminor\f31582\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;} +{\fbiminor\f31583\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\fbiminor\f31584\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\fbiminor\f31585\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;} +{\fbiminor\f31586\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}}{\colortbl;\red0\green0\blue0;\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0; +\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0;\red128\green0\blue128;\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192; +\cfollowedhyperlink\ctint255\cshade255\red128\green0\blue128;\caccentone\ctint255\cshade127\red36\green63\blue96;}{\*\defchp \dbch\af37 }{\*\defpap \ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 } +\noqfpromote {\stylesheet{\ql \li0\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 \snext0 \sqformat \spriority0 \styrsid7287122 Normal;}{\*\cs10 \additive \ssemihidden \sunhideused \spriority1 Default Paragraph Font;}{\* +\ts11\tsrowd\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblind0\tblindtype3\tsvertalt\tsbrdrt\tsbrdrl\tsbrdrb\tsbrdrr\tsbrdrdgl\tsbrdrdgr\tsbrdrh\tsbrdrv +\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs20\alang1025 \ltrch\fcs0 \fs20\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 \snext11 \ssemihidden \sunhideused +Normal Table;}{\s15\ql \li0\ri0\sa200\sl276\slmult1\widctlpar\tqc\tx4680\tqr\tx9360\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 \sbasedon0 \snext15 \slink16 \sunhideused \spriority0 header;}{\*\cs16 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \sbasedon10 \slink15 \slocked \spriority0 Header Char;}{ +\s17\ql \li0\ri0\sa200\sl276\slmult1\widctlpar\tqc\tx4680\tqr\tx9360\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 \sbasedon0 \snext17 \slink18 \sunhideused \spriority0 footer;}{\*\cs18 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \sbasedon10 \slink17 \slocked \spriority0 Footer Char;}{ +\s19\ql \li0\ri0\sl-200\slmult0\nowidctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs16\lang1033\langfe1033\cgrid\langnp1033\langfenp1033 \snext19 \spriority0 MacPac Trailer;}{ +\s20\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af38\afs16\alang1025 \ltrch\fcs0 \fs16\lang1033\langfe1033\loch\f38\hich\af38\dbch\af37\cgrid\langnp1033\langfenp1033 +\sbasedon0 \snext20 \slink21 \ssemihidden \sunhideused Balloon Text;}{\*\cs21 \additive \f38\fs16 \slink20 \slocked \ssemihidden Balloon Text Char;}{\*\cs22 \additive \ul\cf2 \sunhideused Hyperlink;}{\*\cs23 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 +\sbasedon10 \sunhideused \spriority0 page number;}{\*\ts24\tsrowd\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblind0\tblindtype3\tsvertalt\tsbrdrt\tsbrdrl\tsbrdrb\tsbrdrr\tsbrdrdgl\tsbrdrdgr\tsbrdrh\tsbrdrv +\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs20\alang1025 \ltrch\fcs0 \fs20\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 +\sbasedon11 \snext24 \spriority59 \styrsid6040746 Table Grid;}{\s25\ql \li0\ri0\sb240\sa120\keepn\nowidctlpar\wrapdefault\hyphpar0\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af40\afs28\alang1081 \ltrch\fcs0 +\fs28\lang1033\langfe1081\loch\f1\hich\af1\dbch\af39\cgrid\langnp1033\langfenp1081 \sbasedon0 \snext26 \spriority0 \styrsid7680722 Heading;}{\s26\ql \li0\ri0\sa120\nowidctlpar\wrapdefault\hyphpar0\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 +\af4\afs24\alang1081 \ltrch\fcs0 \fs24\lang1033\langfe1081\loch\f4\hich\af4\dbch\af4\cgrid\langnp1033\langfenp1081 \sbasedon0 \snext26 \slink27 \spriority0 \styrsid7680722 Body Text;}{\*\cs27 \additive +\fs24\lang0\langfe1081\loch\f4\hich\af4\dbch\af4\langfenp1081 \slink26 \slocked \spriority0 \styrsid7680722 Body Text Char;}{\s28\ql \li0\ri0\sa120\nowidctlpar\wrapdefault\hyphpar0\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 +\af40\afs24\alang1081 \ltrch\fcs0 \fs24\lang1033\langfe1081\loch\f4\hich\af4\dbch\af4\cgrid\langnp1033\langfenp1081 \sbasedon26 \snext28 \spriority0 \styrsid7680722 List;}{ +\s29\ql \li0\ri0\sb120\sa120\nowidctlpar\noline\wrapdefault\hyphpar0\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \ai\af40\afs24\alang1081 \ltrch\fcs0 \i\fs24\lang1033\langfe1081\loch\f4\hich\af4\dbch\af4\cgrid\langnp1033\langfenp1081 +\sbasedon0 \snext29 \sqformat \spriority0 \styrsid7680722 caption;}{\s30\ql \li0\ri0\nowidctlpar\noline\wrapdefault\hyphpar0\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af40\afs24\alang1081 \ltrch\fcs0 +\fs24\lang1033\langfe1081\loch\f4\hich\af4\dbch\af4\cgrid\langnp1033\langfenp1081 \sbasedon0 \snext30 \spriority0 \styrsid7680722 Index;}{\*\cs31 \additive \fs18 \ssemihidden \sunhideused \styrsid10439972 annotation reference;}{ +\s32\ql \li0\ri0\sa200\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs24\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 +\sbasedon0 \snext32 \slink33 \ssemihidden \sunhideused \styrsid10439972 annotation text;}{\*\cs33 \additive \fs24 \slink32 \slocked \ssemihidden \styrsid10439972 Comment Text Char;}{ +\s34\ql \li0\ri0\sa200\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \ab\af0\afs20\alang1025 \ltrch\fcs0 \b\fs20\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 +\sbasedon32 \snext32 \slink35 \ssemihidden \sunhideused \styrsid10439972 annotation subject;}{\*\cs35 \additive \b\fs24 \slink34 \slocked \ssemihidden \styrsid10439972 Comment Subject Char;}{ +\s36\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 +\snext36 \shidden \spriority71 \styrsid12715572 Medium List 2 - Accent 21;}{\s37\qj \fi-540\li540\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls6\adjustright\rin0\lin540\itap0 \rtlch\fcs1 \af0\afs24\alang1025 \ltrch\fcs0 +\fs22\cf1\lang1033\langfe1033\loch\f41\hich\af41\dbch\af4\cgrid\langnp1033\langfenp1033\ulc1 \sbasedon0 \snext37 \sautoupd \spriority0 \styrsid6029345 Legal Outline;}{\s38\ql \li720\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin720\itap0\contextualspace \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 +\sbasedon0 \snext38 \spriority67 \styrsid15999650 List Paragraph;}{\*\cs39 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \ul\cf17 \sbasedon10 \ssemihidden \sunhideused \styrsid15164339 FollowedHyperlink;}{ +\s40\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\f0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 +\snext40 \shidden \spriority66 \styrsid3014677 Revision;}{\*\cs41 \additive \rtlch\fcs1 \af0\afs16 \ltrch\fcs0 \f0\fs16\ulnone\expnd0\expndtw0\cf0\up0\lang1024\langfe1024\nosupersub\animtext0\striked0\noproof \sbasedon10 \spriority0 \styrsid5637068 +zzmpTrailerItem;}{\s42\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af42\afs24\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\f42\hich\af42\dbch\af37\cgrid\langnp1033\langfenp1033 +\sbasedon0 \snext42 \slink43 \ssemihidden \sunhideused \styrsid15997231 Document Map;}{\*\cs43 \additive \rtlch\fcs1 \af42\afs24 \ltrch\fcs0 \f42\fs24 \sbasedon10 \slink42 \slocked \ssemihidden \styrsid15997231 Document Map Char;}}{\*\listtable +{\list\listtemplateid87983128{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'00;}{\levelnumbers;}\f3\fbias0 \fi0\li0\jclisttab\tx0\lin0 }{\listlevel\levelnfc23\levelnfcn23\leveljc0 +\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'01\u-3913 ?;}{\levelnumbers;}\f3\fbias0 \fi-360\li1080\jclisttab\tx720\lin1080 }{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0 +\levelindent0{\leveltext\'01o;}{\levelnumbers;}\f2\fbias0 \fi-360\li1800\jclisttab\tx1440\lin1800 }{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'01\u-3929 ?;}{\levelnumbers;} +\f10\fbias0 \fi-360\li2520\jclisttab\tx2160\lin2520 }{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'01\u-3846 ?;}{\levelnumbers;}\f10\fbias0 \fi-360\li3240\jclisttab\tx2880\lin3240 } +{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'01\u-3913 ?;}{\levelnumbers;}\f3\fbias0 \fi-360\li3960\jclisttab\tx3600\lin3960 }{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0 +\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'01o;}{\levelnumbers;}\f2\fbias0 \fi-360\li4680\jclisttab\tx4320\lin4680 }{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext +\'01\u-3929 ?;}{\levelnumbers;}\f10\fbias0 \fi-360\li5400\jclisttab\tx5040\lin5400 }{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'01\u-3846 ?;}{\levelnumbers;}\f10\fbias0 +\fi-360\li6120\jclisttab\tx5760\lin6120 }{\listname ;}\listid-227}{\list\listtemplateid1\listhybrid{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat0\levelspace0\levelindent0{\leveltext\leveltemplateid1\'01.;}{\levelnumbers;} +\fi-360\li720\lin720 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat0\levelspace0\levelindent0{\leveltext\'00;}{\levelnumbers;}\rtlch\fcs1 \af0 \ltrch\fcs0 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0 +\levelstartat0\levelspace0\levelindent0{\leveltext\'00;}{\levelnumbers;}\rtlch\fcs1 \af0 \ltrch\fcs0 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat0\levelspace0\levelindent0{\leveltext\'00;}{\levelnumbers;}\rtlch\fcs1 \af0 +\ltrch\fcs0 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat0\levelspace0\levelindent0{\leveltext\'00;}{\levelnumbers;}\rtlch\fcs1 \af0 \ltrch\fcs0 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0 +\levelstartat0\levelspace0\levelindent0{\leveltext\'00;}{\levelnumbers;}\rtlch\fcs1 \af0 \ltrch\fcs0 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat0\levelspace0\levelindent0{\leveltext\'00;}{\levelnumbers;}\rtlch\fcs1 \af0 +\ltrch\fcs0 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat0\levelspace0\levelindent0{\leveltext\'00;}{\levelnumbers;}\rtlch\fcs1 \af0 \ltrch\fcs0 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0 +\levelstartat0\levelspace0\levelindent0{\leveltext\'00;}{\levelnumbers;}\rtlch\fcs1 \af0 \ltrch\fcs0 }{\listname ;}\listid1}{\list\listtemplateid1399243368{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0 +\levelindent0{\leveltext\'01\'00;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-360\li360\lin360 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext +\'03\'00.\'01;}{\levelnumbers\'01\'03;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-360\li1080\lin1080 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'05\'00.\'01.\'02;}{\levelnumbers +\'01\'03\'05;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-720\li2160\lin2160 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'07\'00.\'01.\'02.\'03;}{\levelnumbers\'01\'03\'05\'07;} +\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-720\li2880\lin2880 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'09\'00.\'01.\'02.\'03.\'04;}{\levelnumbers\'01\'03\'05\'07\'09;}\rtlch\fcs1 +\af0 \ltrch\fcs0 \b\fbias0 \fi-1080\li3960\lin3960 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'0b\'00.\'01.\'02.\'03.\'04.\'05;}{\levelnumbers\'01\'03\'05\'07\'09\'0b;}\rtlch\fcs1 +\af0 \ltrch\fcs0 \b\fbias0 \fi-1080\li4680\lin4680 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'0d\'00.\'01.\'02.\'03.\'04.\'05.\'06;}{\levelnumbers\'01\'03\'05\'07\'09\'0b\'0d;} +\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-1080\li5400\lin5400 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'0f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07;}{\levelnumbers +\'01\'03\'05\'07\'09\'0b\'0d\'0f;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-1440\li6480\lin6480 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext +\'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08;}{\levelnumbers\'01\'03\'05\'07\'09\'0b\'0d\'0f\'11;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-1440\li7200\lin7200 }{\listname ;}\listid375664105}{\list\listtemplateid240158162{\listlevel\levelnfc0 +\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'02\'00.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi0\li0\lin0 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1 +\levelspace0\levelindent0{\leveltext\'02\'01.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-360\li1080\lin1080 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext +\'02\'02.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-180\li1800\lin1800 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'02\'03.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 +\ltrch\fcs0 \fbias0 \fi-360\li2520\lin2520 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'02\'04.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-360\li3240\lin3240 } +{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'02\'05.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-180\li3960\lin3960 }{\listlevel\levelnfc0\levelnfcn0\leveljc0 +\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'02\'06.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-360\li4680\lin4680 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0 +\levelindent0{\leveltext\'02\'07.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-360\li5400\lin5400 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'02\'08.;}{\levelnumbers +\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-180\li6120\lin6120 }{\listname ;}\listid631710248}{\list\listtemplateid-1085215164{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext +\'02\'00.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-360\li360\lin360 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'03\'00.\'01;}{\levelnumbers\'01\'03;} +\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-360\li1080\lin1080 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'05\'00.\'01.\'02;}{\levelnumbers\'01\'03\'05;}\rtlch\fcs1 \af0 \ltrch\fcs0 +\b\fbias0 \fi-720\li2160\lin2160 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'07\'00.\'01.\'02.\'03;}{\levelnumbers\'01\'03\'05\'07;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 +\fi-720\li2880\lin2880 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'09\'00.\'01.\'02.\'03.\'04;}{\levelnumbers\'01\'03\'05\'07\'09;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 +\fi-1080\li3960\lin3960 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'0b\'00.\'01.\'02.\'03.\'04.\'05;}{\levelnumbers\'01\'03\'05\'07\'09\'0b;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 +\fi-1080\li4680\lin4680 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'0d\'00.\'01.\'02.\'03.\'04.\'05.\'06;}{\levelnumbers\'01\'03\'05\'07\'09\'0b\'0d;}\rtlch\fcs1 \af0 \ltrch\fcs0 +\b\fbias0 \fi-1080\li5400\lin5400 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'0f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07;}{\levelnumbers\'01\'03\'05\'07\'09\'0b\'0d\'0f;}\rtlch\fcs1 +\af0 \ltrch\fcs0 \b\fbias0 \fi-1440\li6480\lin6480 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08;}{\levelnumbers +\'01\'03\'05\'07\'09\'0b\'0d\'0f\'11;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-1440\li7200\lin7200 }{\listname ;}\listid1058364145}{\list\listtemplateid1292405714\listhybrid{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1 +\levelspace0\levelindent0{\leveltext\leveltemplateid67698703\'02\'00.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-360\li720\lin720 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0 +{\leveltext\leveltemplateid67698713\'02\'01.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li1440\lin1440 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698715\'02\'02.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-180\li2160\lin2160 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698703\'02\'03.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li2880\lin2880 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698713\'02\'04.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li3600\lin3600 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698715\'02\'05.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-180\li4320\lin4320 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698703\'02\'06.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li5040\lin5040 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698713\'02\'07.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li5760\lin5760 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698715\'02\'08.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-180\li6480\lin6480 }{\listname ;}\listid1159347597}{\list\listtemplateid-257502544{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1 +\levelspace0\levelindent0{\leveltext\'02\'00.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0\afs18 \ltrch\fcs0 \b\i0\f4\fs18\fbias0 \s37\fi-360\li920\lin920 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levellegal\levelspace0 +\levelindent0{\leveltext\'03\'00.\'01;}{\levelnumbers\'01\'03;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-560\li1730\lin1730 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levellegal\levelspace0\levelindent0{\leveltext +\'05\'00.\'01.\'02;}{\levelnumbers\'01\'03\'05;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-720\li1280\lin1280 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levellegal\levelspace0\levelindent0{\leveltext +\'07\'00.\'01.\'02.\'03;}{\levelnumbers\'01\'03\'05\'07;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-720\li1280\lin1280 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levellegal\levelspace0\levelindent0{\leveltext +\'09\'00.\'01.\'02.\'03.\'04;}{\levelnumbers\'01\'03\'05\'07\'09;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-1080\li1640\lin1640 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levellegal\levelspace0\levelindent0{\leveltext +\'0b\'00.\'01.\'02.\'03.\'04.\'05;}{\levelnumbers\'01\'03\'05\'07\'09\'0b;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-1080\li1640\lin1640 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levellegal\levelspace0\levelindent0 +{\leveltext\'0d\'00.\'01.\'02.\'03.\'04.\'05.\'06;}{\levelnumbers\'01\'03\'05\'07\'09\'0b\'0d;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-1440\li2000\lin2000 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levellegal +\levelspace0\levelindent0{\leveltext\'0f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07;}{\levelnumbers\'01\'03\'05\'07\'09\'0b\'0d\'0f;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-1440\li2000\lin2000 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0 +\levelstartat1\levellegal\levelspace0\levelindent0{\leveltext\'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08;}{\levelnumbers\'01\'03\'05\'07\'09\'0b\'0d\'0f\'11;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 \fi-1800\li2360\lin2360 }{\listname ;}\listid1167211875 +}{\list\listtemplateid281554762\listhybrid{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\leveltemplateid67698703\'02\'00.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fbias0 +\fi-360\li720\lin720 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\leveltemplateid67698713\'02\'01.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li1440\lin1440 }{\listlevel +\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext\leveltemplateid67698715\'02\'02.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-180\li2160\lin2160 }{\listlevel\levelnfc0 +\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext\leveltemplateid67698703\'02\'03.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li2880\lin2880 }{\listlevel\levelnfc4\levelnfcn4\leveljc0 +\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext\leveltemplateid67698713\'02\'04.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li3600\lin3600 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2 +\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext\leveltemplateid67698715\'02\'05.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-180\li4320\lin4320 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0 +\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext\leveltemplateid67698703\'02\'06.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li5040\lin5040 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1 +\lvltentative\levelspace0\levelindent0{\leveltext\leveltemplateid67698713\'02\'07.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li5760\lin5760 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\lvltentative +\levelspace0\levelindent0{\leveltext\leveltemplateid67698715\'02\'08.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-180\li6480\lin6480 }{\listname ;}\listid1171219419}{\list\listtemplateid-303689902\listhybrid{\listlevel\levelnfc0\levelnfcn0 +\leveljc0\leveljcn0\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\leveltemplateid-305912556\'02\'00.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \b\fbias0 \fi-360\li720\lin720 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0 +\levelfollow0\levelstartat1\levelspace0\levelindent0{\leveltext\leveltemplateid67698713\'02\'01.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li1440\lin1440 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1 +\lvltentative\levelspace0\levelindent0{\leveltext\leveltemplateid67698715\'02\'02.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-180\li2160\lin2160 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative +\levelspace0\levelindent0{\leveltext\leveltemplateid67698703\'02\'03.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li2880\lin2880 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0 +\levelindent0{\leveltext\leveltemplateid67698713\'02\'04.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li3600\lin3600 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0 +{\leveltext\leveltemplateid67698715\'02\'05.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-180\li4320\lin4320 }{\listlevel\levelnfc0\levelnfcn0\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698703\'02\'06.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li5040\lin5040 }{\listlevel\levelnfc4\levelnfcn4\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698713\'02\'07.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-360\li5760\lin5760 }{\listlevel\levelnfc2\levelnfcn2\leveljc2\leveljcn2\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext +\leveltemplateid67698715\'02\'08.;}{\levelnumbers\'01;}\rtlch\fcs1 \af0 \ltrch\fcs0 \fi-180\li6480\lin6480 }{\listname ;}\listid1529951530}}{\*\listoverridetable{\listoverride\listid-227\listoverridecount0\ls1}{\listoverride\listid1529951530 +\listoverridecount0\ls2}{\listoverride\listid1058364145\listoverridecount0\ls3}{\listoverride\listid375664105\listoverridecount0\ls4}{\listoverride\listid1159347597\listoverridecount0\ls5}{\listoverride\listid1167211875\listoverridecount0\ls6} +{\listoverride\listid1171219419\listoverridecount0\ls7}{\listoverride\listid1\listoverridecount0\ls8}{\listoverride\listid631710248\listoverridecount0\ls9}}{\*\revtbl {Unknown;}}{\*\pgptbl {\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp16\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp25 +\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp30\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp25\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0 +\sb0\sa0}{\pgp\ipgp25\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp25\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp25\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp27\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp30\itap0\li0\ri0\sb0\sa0} +{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp47\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp25\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp47\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp23 +\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp19\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0 +\sb0\sa0}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp25\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp +\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp30\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp44\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp28\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp52\itap0 +\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp25\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}}{\*\rsidtbl \rsid4868\rsid11145\rsid14914\rsid17681\rsid19617 +\rsid21172\rsid26970\rsid28134\rsid69227\rsid69234\rsid83622\rsid85159\rsid87762\rsid91696\rsid95204\rsid95536\rsid95977\rsid138121\rsid149281\rsid149296\rsid204601\rsid205423\rsid207904\rsid208127\rsid214762\rsid217837\rsid220955\rsid225954\rsid229183 +\rsid279047\rsid290679\rsid328555\rsid344753\rsid347097\rsid353871\rsid395318\rsid407594\rsid411803\rsid412651\rsid414610\rsid414826\rsid420039\rsid460684\rsid461181\rsid470461\rsid488423\rsid526753\rsid530721\rsid547082\rsid549712\rsid550878\rsid551550 +\rsid554500\rsid609701\rsid612038\rsid618197\rsid621719\rsid622078\rsid666308\rsid673635\rsid674069\rsid674081\rsid721687\rsid724510\rsid732770\rsid734646\rsid740405\rsid792272\rsid792488\rsid797421\rsid810514\rsid856017\rsid874020\rsid876626\rsid917894 +\rsid920164\rsid921768\rsid925473\rsid926508\rsid936435\rsid945347\rsid945876\rsid946540\rsid947423\rsid989329\rsid996663\rsid999923\rsid1007464\rsid1011594\rsid1053074\rsid1053415\rsid1058224\rsid1059769\rsid1060028\rsid1071368\rsid1075480\rsid1077391 +\rsid1078254\rsid1114540\rsid1119707\rsid1119971\rsid1131731\rsid1138390\rsid1187261\rsid1192748\rsid1196146\rsid1200102\rsid1205024\rsid1207953\rsid1250383\rsid1258948\rsid1265775\rsid1319778\rsid1322096\rsid1331787\rsid1382284\rsid1395281\rsid1396249 +\rsid1400857\rsid1442810\rsid1444958\rsid1448729\rsid1455894\rsid1462648\rsid1517699\rsid1522344\rsid1529783\rsid1536850\rsid1538008\rsid1585021\rsid1592550\rsid1598766\rsid1601138\rsid1605324\rsid1649589\rsid1650508\rsid1654364\rsid1660166\rsid1661817 +\rsid1665187\rsid1670465\rsid1712392\rsid1714879\rsid1715652\rsid1720556\rsid1720656\rsid1724072\rsid1727288\rsid1729363\rsid1773193\rsid1775623\rsid1777042\rsid1788165\rsid1797578\rsid1843277\rsid1843543\rsid1845987\rsid1847498\rsid1849566\rsid1859664 +\rsid1859867\rsid1861382\rsid1862055\rsid1863580\rsid1903267\rsid1917023\rsid1918168\rsid1921454\rsid1923934\rsid1925410\rsid1925956\rsid1926639\rsid1926692\rsid1926771\rsid1928645\rsid1966699\rsid1978638\rsid1978719\rsid1983831\rsid2033692\rsid2036461 +\rsid2041131\rsid2050037\rsid2050835\rsid2053910\rsid2099257\rsid2105483\rsid2113601\rsid2114789\rsid2118364\rsid2126037\rsid2164582\rsid2171008\rsid2176517\rsid2182119\rsid2183301\rsid2237453\rsid2240671\rsid2252620\rsid2294033\rsid2308700\rsid2309187 +\rsid2309988\rsid2315508\rsid2319561\rsid2322792\rsid2324239\rsid2324474\rsid2360587\rsid2362763\rsid2368071\rsid2377742\rsid2381177\rsid2391422\rsid2426596\rsid2430927\rsid2447395\rsid2451045\rsid2455829\rsid2493349\rsid2496155\rsid2497263\rsid2498145 +\rsid2503503\rsid2504121\rsid2513994\rsid2516418\rsid2562494\rsid2564266\rsid2564573\rsid2566913\rsid2568982\rsid2578911\rsid2583745\rsid2584472\rsid2621760\rsid2625492\rsid2626793\rsid2630853\rsid2635806\rsid2638928\rsid2639426\rsid2641682\rsid2653001 +\rsid2653367\rsid2688007\rsid2691138\rsid2691420\rsid2697273\rsid2703051\rsid2713871\rsid2718300\rsid2755216\rsid2757557\rsid2762772\rsid2768137\rsid2769074\rsid2769294\rsid2777606\rsid2783290\rsid2830191\rsid2832898\rsid2839246\rsid2845363\rsid2849917 +\rsid2892897\rsid2894579\rsid2894613\rsid2904269\rsid2950394\rsid2957401\rsid2961722\rsid2965046\rsid3014677\rsid3016834\rsid3019033\rsid3024631\rsid3032049\rsid3032896\rsid3033102\rsid3033655\rsid3037711\rsid3044104\rsid3081829\rsid3086118\rsid3095373 +\rsid3097037\rsid3098183\rsid3098739\rsid3101366\rsid3105619\rsid3106927\rsid3162320\rsid3165307\rsid3172227\rsid3211481\rsid3222951\rsid3233675\rsid3243428\rsid3277881\rsid3280675\rsid3283553\rsid3287093\rsid3290864\rsid3297221\rsid3301565\rsid3304715 +\rsid3352585\rsid3374991\rsid3412991\rsid3415411\rsid3416406\rsid3422872\rsid3428296\rsid3432065\rsid3438910\rsid3440243\rsid3440270\rsid3440335\rsid3478073\rsid3486640\rsid3490130\rsid3492701\rsid3493735\rsid3497842\rsid3498425\rsid3544078\rsid3544512 +\rsid3553433\rsid3559338\rsid3565112\rsid3567699\rsid3569234\rsid3570229\rsid3607446\rsid3607824\rsid3613029\rsid3615011\rsid3615793\rsid3624235\rsid3636651\rsid3675690\rsid3681376\rsid3687082\rsid3695339\rsid3698158\rsid3701289\rsid3738749\rsid3743693 +\rsid3747058\rsid3755293\rsid3760062\rsid3807773\rsid3810426\rsid3813645\rsid3814008\rsid3830700\rsid3831821\rsid3880828\rsid3883114\rsid3889658\rsid3889982\rsid3891189\rsid3892453\rsid3892541\rsid3895378\rsid3897727\rsid3938240\rsid3951647\rsid3962440 +\rsid3998914\rsid4007280\rsid4008717\rsid4009185\rsid4019428\rsid4071359\rsid4071622\rsid4079296\rsid4080161\rsid4080865\rsid4089395\rsid4094929\rsid4133400\rsid4142040\rsid4149811\rsid4196294\rsid4225255\rsid4271335\rsid4278485\rsid4287477\rsid4288419 +\rsid4289004\rsid4331479\rsid4331811\rsid4333618\rsid4342646\rsid4349346\rsid4352155\rsid4398210\rsid4403436\rsid4422676\rsid4422760\rsid4458084\rsid4466161\rsid4466969\rsid4472330\rsid4488921\rsid4522545\rsid4524417\rsid4532131\rsid4541093\rsid4542405 +\rsid4542988\rsid4545384\rsid4552749\rsid4590490\rsid4600461\rsid4657088\rsid4660669\rsid4669405\rsid4719072\rsid4723870\rsid4730787\rsid4735610\rsid4740788\rsid4741197\rsid4749767\rsid4750613\rsid4750985\rsid4785544\rsid4805928\rsid4815005\rsid4857980 +\rsid4865158\rsid4865603\rsid4873569\rsid4875164\rsid4917613\rsid4924541\rsid4947407\rsid4947436\rsid4981926\rsid4985922\rsid4988096\rsid4991775\rsid4998370\rsid4998677\rsid5008490\rsid5012406\rsid5013107\rsid5070719\rsid5074240\rsid5118776\rsid5119505 +\rsid5120733\rsid5125674\rsid5134101\rsid5135299\rsid5243784\rsid5258355\rsid5258827\rsid5259472\rsid5315836\rsid5331368\rsid5384980\rsid5387267\rsid5391349\rsid5449426\rsid5454977\rsid5459368\rsid5464771\rsid5507382\rsid5508532\rsid5510141\rsid5519738 +\rsid5523183\rsid5531504\rsid5533133\rsid5576363\rsid5578871\rsid5584407\rsid5585440\rsid5592961\rsid5598572\rsid5636631\rsid5637068\rsid5642427\rsid5650183\rsid5653730\rsid5656071\rsid5666434\rsid5703173\rsid5707308\rsid5707954\rsid5712122\rsid5715368 +\rsid5721469\rsid5729098\rsid5776441\rsid5796996\rsid5797039\rsid5797045\rsid5797727\rsid5834833\rsid5840820\rsid5850480\rsid5851450\rsid5853799\rsid5859377\rsid5861765\rsid5902605\rsid5902613\rsid5907613\rsid5914897\rsid5917579\rsid5919028\rsid5922662 +\rsid5930867\rsid5965043\rsid5965557\rsid5968425\rsid5973793\rsid5983534\rsid5991859\rsid5991925\rsid6029345\rsid6040746\rsid6046561\rsid6050960\rsid6054223\rsid6054778\rsid6057856\rsid6060042\rsid6105660\rsid6106191\rsid6112150\rsid6126727\rsid6161905 +\rsid6169458\rsid6172601\rsid6182044\rsid6186545\rsid6189273\rsid6227274\rsid6231352\rsid6232079\rsid6233723\rsid6243838\rsid6312746\rsid6318571\rsid6358409\rsid6365643\rsid6366662\rsid6371067\rsid6383409\rsid6386332\rsid6387306\rsid6424265\rsid6425283 +\rsid6431596\rsid6493890\rsid6496493\rsid6500253\rsid6504070\rsid6504248\rsid6514639\rsid6555667\rsid6563213\rsid6577690\rsid6577841\rsid6579486\rsid6580158\rsid6582692\rsid6620879\rsid6628178\rsid6634930\rsid6699384\rsid6704684\rsid6710057\rsid6751439 +\rsid6754123\rsid6759600\rsid6763306\rsid6767501\rsid6775199\rsid6779144\rsid6781698\rsid6829015\rsid6842463\rsid6843113\rsid6888243\rsid6888818\rsid6889448\rsid6905737\rsid6911022\rsid6911381\rsid6912029\rsid6912703\rsid6965042\rsid6968650\rsid6973190 +\rsid6974263\rsid6979070\rsid7014499\rsid7015222\rsid7019418\rsid7020384\rsid7027006\rsid7027423\rsid7028181\rsid7029516\rsid7031491\rsid7036188\rsid7038034\rsid7042868\rsid7081287\rsid7089642\rsid7092056\rsid7097561\rsid7108641\rsid7143767\rsid7144971 +\rsid7148695\rsid7149780\rsid7156023\rsid7158350\rsid7158535\rsid7163013\rsid7166979\rsid7209984\rsid7211331\rsid7211664\rsid7235327\rsid7238597\rsid7238706\rsid7277709\rsid7279966\rsid7281412\rsid7283704\rsid7284716\rsid7287122\rsid7290075\rsid7291830 +\rsid7292862\rsid7292939\rsid7297141\rsid7302731\rsid7351125\rsid7360639\rsid7362857\rsid7368165\rsid7437740\rsid7437836\rsid7479393\rsid7487258\rsid7489501\rsid7491271\rsid7491400\rsid7498952\rsid7500110\rsid7500862\rsid7502760\rsid7542706\rsid7543861 +\rsid7549752\rsid7553625\rsid7554265\rsid7560551\rsid7562759\rsid7605956\rsid7613606\rsid7617112\rsid7618515\rsid7628401\rsid7629881\rsid7667898\rsid7667963\rsid7677610\rsid7680722\rsid7687692\rsid7689881\rsid7698214\rsid7744836\rsid7748604\rsid7754262 +\rsid7755084\rsid7760620\rsid7761403\rsid7765876\rsid7799991\rsid7803195\rsid7806631\rsid7807437\rsid7812558\rsid7823025\rsid7829025\rsid7830498\rsid7866006\rsid7867164\rsid7881183\rsid7887901\rsid7888689\rsid7931169\rsid7936680\rsid7942271\rsid7945273 +\rsid7946704\rsid7949383\rsid7954639\rsid7956883\rsid7958680\rsid7959983\rsid7997281\rsid8004797\rsid8005200\rsid8010418\rsid8019731\rsid8021618\rsid8027180\rsid8065428\rsid8073565\rsid8085440\rsid8133367\rsid8138548\rsid8151209\rsid8154834\rsid8205489 +\rsid8207593\rsid8209141\rsid8215838\rsid8261468\rsid8264953\rsid8273793\rsid8274739\rsid8279082\rsid8280851\rsid8289653\rsid8329927\rsid8329941\rsid8335957\rsid8336779\rsid8340796\rsid8343654\rsid8347131\rsid8390393\rsid8391001\rsid8396734\rsid8399740 +\rsid8401879\rsid8473885\rsid8478472\rsid8480377\rsid8485039\rsid8521347\rsid8523492\rsid8531099\rsid8535024\rsid8536098\rsid8538303\rsid8539344\rsid8542481\rsid8546124\rsid8548806\rsid8552369\rsid8596824\rsid8598748\rsid8609611\rsid8610084\rsid8610103 +\rsid8611797\rsid8661693\rsid8664216\rsid8672582\rsid8673657\rsid8674892\rsid8676187\rsid8676537\rsid8677019\rsid8720844\rsid8724443\rsid8732702\rsid8734758\rsid8746879\rsid8784173\rsid8797174\rsid8797821\rsid8852436\rsid8856174\rsid8859568\rsid8863884 +\rsid8865336\rsid8914415\rsid8921212\rsid8926221\rsid8926615\rsid8939863\rsid8991349\rsid8993084\rsid8998618\rsid9008577\rsid9046129\rsid9052636\rsid9058371\rsid9060416\rsid9062058\rsid9071595\rsid9113322\rsid9113571\rsid9114341\rsid9119814\rsid9129235 +\rsid9132029\rsid9133764\rsid9134362\rsid9137127\rsid9139365\rsid9175756\rsid9177346\rsid9178332\rsid9179445\rsid9181159\rsid9184435\rsid9184503\rsid9186846\rsid9191819\rsid9244578\rsid9245389\rsid9255140\rsid9256510\rsid9261457\rsid9264272\rsid9264396 +\rsid9266376\rsid9273339\rsid9309775\rsid9310801\rsid9312214\rsid9313362\rsid9318906\rsid9323701\rsid9329677\rsid9330256\rsid9330996\rsid9373569\rsid9376717\rsid9376839\rsid9389365\rsid9399028\rsid9440407\rsid9442096\rsid9443851\rsid9445743\rsid9459511 +\rsid9464847\rsid9468812\rsid9505875\rsid9506626\rsid9523363\rsid9533930\rsid9569796\rsid9570711\rsid9571075\rsid9571228\rsid9584443\rsid9592990\rsid9600015\rsid9638840\rsid9639001\rsid9639644\rsid9654466\rsid9656713\rsid9663787\rsid9701423\rsid9707847 +\rsid9713597\rsid9715860\rsid9718331\rsid9724035\rsid9767610\rsid9768990\rsid9773554\rsid9779716\rsid9781995\rsid9784600\rsid9786486\rsid9790599\rsid9790966\rsid9837841\rsid9839182\rsid9840578\rsid9840708\rsid9842770\rsid9843213\rsid9846083\rsid9852312 +\rsid9896659\rsid9922041\rsid9927413\rsid9964237\rsid9969545\rsid9988150\rsid9989616\rsid9992690\rsid10032857\rsid10038196\rsid10040263\rsid10043959\rsid10050039\rsid10051983\rsid10104323\rsid10105632\rsid10111315\rsid10121013\rsid10124107\rsid10158953 +\rsid10160774\rsid10174441\rsid10177295\rsid10182740\rsid10188719\rsid10225772\rsid10228178\rsid10229086\rsid10231534\rsid10232415\rsid10238296\rsid10249217\rsid10250841\rsid10252955\rsid10289407\rsid10358841\rsid10362524\rsid10363719\rsid10368446 +\rsid10369982\rsid10370643\rsid10373567\rsid10377103\rsid10383679\rsid10383869\rsid10384975\rsid10386609\rsid10439972\rsid10440189\rsid10443272\rsid10444500\rsid10447719\rsid10450477\rsid10492054\rsid10493293\rsid10494223\rsid10496850\rsid10496887 +\rsid10497727\rsid10500025\rsid10505935\rsid10509042\rsid10515568\rsid10558948\rsid10560090\rsid10620334\rsid10625761\rsid10630610\rsid10633892\rsid10635421\rsid10635824\rsid10639240\rsid10641471\rsid10643170\rsid10700251\rsid10704321\rsid10711132 +\rsid10747918\rsid10752458\rsid10757179\rsid10758913\rsid10763357\rsid10774026\rsid10774811\rsid10775095\rsid10779611\rsid10822514\rsid10831583\rsid10831822\rsid10843854\rsid10880640\rsid10884541\rsid10897313\rsid10956920\rsid10961330\rsid11013320 +\rsid11025635\rsid11029157\rsid11032075\rsid11033131\rsid11075704\rsid11076407\rsid11084200\rsid11085823\rsid11087748\rsid11089577\rsid11102104\rsid11173558\rsid11224753\rsid11225395\rsid11226265\rsid11238323\rsid11272815\rsid11273272\rsid11274143 +\rsid11302461\rsid11303494\rsid11347950\rsid11362937\rsid11364246\rsid11365378\rsid11365907\rsid11367214\rsid11403723\rsid11404613\rsid11406914\rsid11412158\rsid11414789\rsid11414843\rsid11418614\rsid11426514\rsid11427255\rsid11476353\rsid11480537 +\rsid11482652\rsid11487845\rsid11498005\rsid11501159\rsid11550175\rsid11553660\rsid11554488\rsid11559763\rsid11566684\rsid11601893\rsid11614143\rsid11620541\rsid11630493\rsid11630716\rsid11674073\rsid11688579\rsid11688947\rsid11697144\rsid11733363 +\rsid11737644\rsid11739871\rsid11746574\rsid11758238\rsid11759755\rsid11760010\rsid11761059\rsid11798975\rsid11800748\rsid11805016\rsid11806633\rsid11815883\rsid11815999\rsid11821835\rsid11822366\rsid11824706\rsid11828462\rsid11866843\rsid11877944 +\rsid11879677\rsid11890155\rsid11930503\rsid11940799\rsid11941109\rsid11945517\rsid11950202\rsid11951442\rsid11954481\rsid11997808\rsid12000438\rsid12001522\rsid12015742\rsid12060692\rsid12061734\rsid12066290\rsid12073180\rsid12078870\rsid12091033 +\rsid12091159\rsid12124502\rsid12134457\rsid12137919\rsid12145259\rsid12154564\rsid12189934\rsid12190962\rsid12196620\rsid12198352\rsid12211042\rsid12217503\rsid12217582\rsid12255818\rsid12258326\rsid12259479\rsid12260374\rsid12266006\rsid12275452 +\rsid12321566\rsid12324826\rsid12325173\rsid12326275\rsid12328697\rsid12332132\rsid12332488\rsid12333787\rsid12338951\rsid12339443\rsid12340912\rsid12341002\rsid12345273\rsid12347501\rsid12347828\rsid12352200\rsid12388817\rsid12389960\rsid12392318 +\rsid12392496\rsid12407223\rsid12415427\rsid12462478\rsid12477183\rsid12481309\rsid12521107\rsid12522138\rsid12530970\rsid12535831\rsid12540057\rsid12540676\rsid12543896\rsid12585441\rsid12595682\rsid12599565\rsid12615423\rsid12650756\rsid12658989 +\rsid12659639\rsid12671324\rsid12675601\rsid12715572\rsid12722187\rsid12726317\rsid12730182\rsid12779779\rsid12783444\rsid12795743\rsid12847836\rsid12851453\rsid12853568\rsid12855426\rsid12862202\rsid12873267\rsid12877022\rsid12877628\rsid12913500 +\rsid12916947\rsid12918597\rsid12919323\rsid12919899\rsid12935472\rsid12936037\rsid12937888\rsid12942887\rsid12942925\rsid12980340\rsid12982329\rsid12987900\rsid12989213\rsid12989536\rsid12994275\rsid12995408\rsid12997325\rsid12998694\rsid13005448 +\rsid13055850\rsid13063116\rsid13063898\rsid13065494\rsid13067628\rsid13071040\rsid13121505\rsid13175032\rsid13176864\rsid13177476\rsid13196014\rsid13202841\rsid13241076\rsid13242816\rsid13243221\rsid13247746\rsid13249368\rsid13252600\rsid13253533 +\rsid13260218\rsid13267153\rsid13267344\rsid13305099\rsid13306007\rsid13310656\rsid13313828\rsid13372411\rsid13391126\rsid13394099\rsid13435885\rsid13448583\rsid13452364\rsid13457831\rsid13467479\rsid13517435\rsid13518662\rsid13519154\rsid13520448 +\rsid13528052\rsid13530123\rsid13571263\rsid13573719\rsid13578662\rsid13581531\rsid13591109\rsid13593467\rsid13633411\rsid13643590\rsid13646502\rsid13651676\rsid13661471\rsid13662464\rsid13697541\rsid13698450\rsid13700431\rsid13701664\rsid13707064 +\rsid13708024\rsid13710296\rsid13724297\rsid13727112\rsid13728008\rsid13728784\rsid13764909\rsid13769546\rsid13775177\rsid13781391\rsid13783288\rsid13785815\rsid13787194\rsid13794584\rsid13829534\rsid13832135\rsid13833537\rsid13843844\rsid13851384 +\rsid13894301\rsid13896973\rsid13905502\rsid13908784\rsid13925452\rsid13961574\rsid13968129\rsid13976316\rsid13980722\rsid13981147\rsid13984781\rsid13989554\rsid14025081\rsid14029360\rsid14038540\rsid14041181\rsid14041768\rsid14043052\rsid14054746 +\rsid14055163\rsid14092422\rsid14104424\rsid14116794\rsid14155894\rsid14169891\rsid14172912\rsid14176133\rsid14176943\rsid14182390\rsid14188139\rsid14222922\rsid14226221\rsid14229858\rsid14230089\rsid14237188\rsid14246163\rsid14287019\rsid14304037 +\rsid14305109\rsid14310910\rsid14352931\rsid14353900\rsid14358719\rsid14359258\rsid14359808\rsid14364925\rsid14365411\rsid14366598\rsid14374692\rsid14375642\rsid14381403\rsid14433419\rsid14437997\rsid14439526\rsid14487122\rsid14490159\rsid14491359 +\rsid14501514\rsid14502083\rsid14506711\rsid14506794\rsid14508636\rsid14512603\rsid14515243\rsid14558645\rsid14564319\rsid14566446\rsid14568207\rsid14573035\rsid14616450\rsid14633874\rsid14635474\rsid14635628\rsid14680953\rsid14690450\rsid14692209 +\rsid14694974\rsid14703286\rsid14705644\rsid14705963\rsid14709469\rsid14711268\rsid14711801\rsid14748193\rsid14753976\rsid14755231\rsid14763321\rsid14773633\rsid14774826\rsid14812868\rsid14814671\rsid14815039\rsid14826087\rsid14837237\rsid14892695 +\rsid14893187\rsid14893910\rsid14896315\rsid14897880\rsid14908137\rsid14943537\rsid14945652\rsid14946561\rsid14953859\rsid14954727\rsid14956530\rsid14961841\rsid14962217\rsid14962445\rsid14968039\rsid14970664\rsid14974937\rsid15016109\rsid15020827 +\rsid15022960\rsid15026983\rsid15032103\rsid15081904\rsid15091339\rsid15095098\rsid15096826\rsid15142959\rsid15154586\rsid15156470\rsid15159011\rsid15162170\rsid15162673\rsid15162976\rsid15164339\rsid15169589\rsid15206434\rsid15216067\rsid15228006 +\rsid15233896\rsid15275306\rsid15279801\rsid15285656\rsid15294647\rsid15299333\rsid15300607\rsid15338612\rsid15343274\rsid15348081\rsid15348134\rsid15360098\rsid15362081\rsid15413851\rsid15413901\rsid15415005\rsid15416519\rsid15421229\rsid15423284 +\rsid15473338\rsid15473662\rsid15479859\rsid15482680\rsid15482958\rsid15486501\rsid15495468\rsid15535238\rsid15542969\rsid15561072\rsid15603628\rsid15623581\rsid15629828\rsid15668349\rsid15670497\rsid15677039\rsid15682892\rsid15686267\rsid15688345 +\rsid15695859\rsid15734730\rsid15740555\rsid15746505\rsid15749283\rsid15752459\rsid15802179\rsid15803981\rsid15814733\rsid15824247\rsid15864045\rsid15866862\rsid15868711\rsid15871894\rsid15879643\rsid15879770\rsid15885607\rsid15887319\rsid15926802 +\rsid15929691\rsid15930263\rsid15933975\rsid15951578\rsid15953308\rsid15953435\rsid15992736\rsid15994258\rsid15997231\rsid15999404\rsid15999650\rsid16002599\rsid16005349\rsid16017574\rsid16062169\rsid16067760\rsid16076932\rsid16086670\rsid16125183 +\rsid16133092\rsid16133400\rsid16153415\rsid16188635\rsid16193534\rsid16194443\rsid16208584\rsid16273706\rsid16275218\rsid16276028\rsid16277524\rsid16278681\rsid16327572\rsid16328117\rsid16332194\rsid16333144\rsid16347156\rsid16348287\rsid16386127 +\rsid16393413\rsid16398636\rsid16457295\rsid16463572\rsid16466098\rsid16516131\rsid16516367\rsid16516942\rsid16538122\rsid16539501\rsid16584802\rsid16591493\rsid16604464\rsid16658315\rsid16659253\rsid16660577\rsid16662236\rsid16715265\rsid16726030 +\rsid16728825\rsid16729686\rsid16735329\rsid16739450\rsid16740673\rsid16741977}{\mmathPr\mmathFont34\mbrkBin0\mbrkBinSub0\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Rob Eber}{\operator kchase} +{\creatim\yr2017\mo4\dy5\hr12\min56}{\revtim\yr2017\mo4\dy5\hr12\min56}{\printim\yr2017\mo3\dy1\hr15\min56}{\version2}{\edmins0}{\nofpages15}{\nofwords9997}{\nofchars56988}{\nofcharsws66852}{\vern49167}}{\*\xmlnstbl {\xmlns1 http://schemas.microsoft.com/o +ffice/word/2003/wordml}}\paperw12240\paperh15840\margl720\margr720\margt1008\margb1008\gutter0\ltrsect +\widowctrl\ftnbj\aenddoc\trackmoves0\trackformatting1\donotembedsysfont1\relyonvml0\donotembedlingdata0\grfdocevents0\validatexml1\showplaceholdtext0\ignoremixedcontent0\saveinvalidxml0\showxmlerrors1\noxlattoyen +\expshrtn\noultrlspc\dntblnsbdb\nospaceforul\formshade\horzdoc\dgmargin\dghspace180\dgvspace180\dghorigin720\dgvorigin1008\dghshow1\dgvshow1 +\jexpand\viewkind1\viewscale150\pgbrdrhead\pgbrdrfoot\splytwnine\ftnlytwnine\htmautsp\nolnhtadjtbl\useltbaln\alntblind\lytcalctblwd\lyttblrtgr\lnbrkrule\nobrkwrptbl\snaptogridincell\allowfieldendsel\wrppunct +\asianbrkrule\rsidroot996663\newtblstyruls\nogrowautofit\remdttm\usenormstyforlist\noindnmbrts\felnbrelev\nocxsptable\indrlsweleven\noafcnsttbl\afelev\utinl\hwelev\spltpgpar\notcvasp\notbrkcnstfrctbl\notvatxbx\krnprsnet\cachedcolbal \nouicompat \fet0 +{\*\wgrffmtfilter 2450}\nofeaturethrottle1\ilfomacatclnup0{\*\ftnsep \ltrpar \pard\plain \ltrpar\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid12259479 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 \chftnsep +\par }}{\*\ftnsepc \ltrpar \pard\plain \ltrpar\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid12259479 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 \chftnsepc +\par }}{\*\ftncn \ltrpar \pard\plain \ltrpar\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 { +\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 +\par }}{\*\aftnsep \ltrpar \pard\plain \ltrpar\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid12259479 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 \chftnsep +\par }}{\*\aftnsepc \ltrpar \pard\plain \ltrpar\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid12259479 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 \chftnsepc +\par }}{\*\aftncn \ltrpar \pard\plain \ltrpar\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 +{\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 +\par }}\ltrpar \sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\headerr \ltrpar \pard\plain \ltrpar\s15\qr \li0\ri0\sa200\sl276\slmult1\widctlpar +\tqc\tx4680\tqr\tx9360\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid12650756 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 +\ltrch\fcs0 \b\insrsid2324239\charrsid15104862 +\par }}{\footerr \ltrpar \pard\plain \ltrpar\s17\ql \li0\ri0\sa200\sl-200\slmult0\widctlpar\tqc\tx4680\tqr\tx9360\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid5637068 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid2324239 +\par }\pard \ltrpar\s17\ql \li0\ri0\sa200\sl276\slmult1\widctlpar\tqc\tx4680\tqr\tx9360\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid8674892 {\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 \f4\fs14\insrsid2324239 \hich\af4\dbch\af37\loch\f4 +Software}{\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 \f4\fs14\insrsid2324239\charrsid3440243 \hich\af4\dbch\af37\loch\f4 License Agreement}{\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 \f4\fs14\insrsid2324239 \hich\af4\dbch\af37\loch\f4 0}{\rtlch\fcs1 \af0\afs14 +\ltrch\fcs0 \f4\fs14\insrsid16715265 \hich\af4\dbch\af37\loch\f4 5}{\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 \f4\fs14\insrsid2324239 0}{\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 \f4\fs14\insrsid2497263 \hich\af4\dbch\af37\loch\f4 2}{\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 +\f4\fs14\insrsid2324239 \hich\af4\dbch\af37\loch\f4 201}{\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 \f4\fs14\insrsid2497263 \hich\af4\dbch\af37\loch\f4 7}{\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 \f4\fs14\insrsid2324239\charrsid3440243 \tab }{\rtlch\fcs1 \af0\afs14 +\ltrch\fcs0 \f4\fs14\insrsid2324239 \tab }{\field{\*\fldinst {\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 \cs23\f4\fs14\insrsid2324239\charrsid3440243 \hich\af4\dbch\af37\loch\f4 PAGE }}{\fldrslt {\rtlch\fcs1 \af0\afs14 \ltrch\fcs0 +\cs23\f4\fs14\lang1024\langfe1024\noproof\insrsid7292862 \hich\af4\dbch\af37\loch\f4 1}}}\sectd \ltrsect\linex0\endnhere\sectdefaultcl\sftnbj {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid2324239\charrsid5637068 \hich\af0\dbch\af37\loch\f0 }{\rtlch\fcs1 +\af0\afs14 \ltrch\fcs0 \f4\fs14\insrsid2324239\charrsid8674892 +\par }}{\*\pnseclvl1\pnucrm\pnstart1\pnindent720\pnhang {\pntxta .}}{\*\pnseclvl2\pnucltr\pnstart1\pnindent720\pnhang {\pntxta .}}{\*\pnseclvl3\pndec\pnstart1\pnindent720\pnhang {\pntxta .}}{\*\pnseclvl4\pnlcltr\pnstart1\pnindent720\pnhang {\pntxta )}} +{\*\pnseclvl5\pndec\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}{\*\pnseclvl6\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}{\*\pnseclvl7\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}{\*\pnseclvl8 +\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}{\*\pnseclvl9\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}\pard\plain \ltrpar\qc \li0\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\outlinelevel0\adjustright\rin0\lin0\itap0\pararsid9715860 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 SOFTWARE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + LICENSE AGREEMENT +\par }\pard \ltrpar\ql \li0\ri0\widctlpar\tx1320\wrapdefault\aspalpha\aspnum\faauto\outlinelevel0\adjustright\rin0\lin0\itap0\pararsid3478073 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid9786486\charrsid11476353 +\par }\pard \ltrpar\qj \li0\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 THIS }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 SOFTWARE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 LICENSE AGREEMENT (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 AGREEMENT}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) GOVERNS THE }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2568982 +\hich\af1\dbch\af37\loch\f1 LICENSING, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10831822\charrsid11476353 \hich\af1\dbch\af37\loch\f1 INSTALLATION AND USE OF }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 SPLUNK SOFTWARE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1331787 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787 \hich\af1\dbch\af37\loch\f1 BY DO}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid12190962 +\hich\af1\dbch\af37\loch\f1 WNLOADING AND/OR INSTALLING SPLUNK}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 +SOFTWARE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid2564573 \hich\af1\dbch\af37\loch\f1 :}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\caps\f1\fs18\insrsid1331787\charrsid1331787 \hich\af1\dbch\af37\loch\f1 (a) you are indicating that you have read and understand this Agreement, and agree to be legally bound by it on behalf of the company}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\caps\f1\fs18\insrsid6106191 \hich\af1\dbch\af37\loch\f1 , GOVERNMENT,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787\charrsid1331787 \hich\af1\dbch\af37\loch\f1 or other entity for which you are acting (for example, as an employee}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid6106191 \hich\af1\dbch\af37\loch\f1 OR GOVERNMENT OFFICIAL}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787\charrsid1331787 \hich\af1\dbch\af37\loch\f1 ) or, i +\hich\af1\dbch\af37\loch\f1 f there is no company}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid6106191 \hich\af1\dbch\af37\loch\f1 , GOVERNMENT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787\charrsid1331787 +\hich\af1\dbch\af37\loch\f1 or other entity for which you are acting, on behalf of yourself as an individual; and (b) you represent and warrant that you have the authority to act on behalf of and bind }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\caps\f1\fs18\insrsid12321566 \hich\af1\dbch\af37\loch\f1 SUCH}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787\charrsid1331787 \hich\af1\dbch\af37\loch\f1 company}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid6106191 +\hich\af1\dbch\af37\loch\f1 , GOVERNMENT}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787\charrsid1331787 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787 \hich\af1\dbch\af37\loch\f1 +OR OTHER ENTITY}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid12321566 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787\charrsid1331787 \hich\af1\dbch\af37\loch\f1 if a}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \caps\f1\fs18\insrsid12321566 \hich\af1\dbch\af37\loch\f1 ny)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid1331787\charrsid1331787 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \caps\f1\fs18\insrsid4875164 + +\par }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9376717 \hich\af1\dbch\af37\loch\f1 WITHOUT LIMITING THE FOREGOING, YOU (AND YOUR ENTITY, IF ANY) ACKNOWLEDGE THAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2584472 \hich\af1\dbch\af37\loch\f1 BY SUBMITTING A}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7238597 \hich\af1\dbch\af37\loch\f1 N}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2584472 \hich\af1\dbch\af37\loch\f1 ORDER FOR }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7562759 \hich\af1\dbch\af37\loch\f1 THE }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2584472 \hich\af1\dbch\af37\loch\f1 SPLUNK SOFTWARE, YOU }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4466161 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2584472 \hich\af1\dbch\af37\loch\f1 AND YOUR ENTITY (IF ANY)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4466161 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2584472 \hich\af1\dbch\af37\loch\f1 HAVE AGREED TO BE BOUND BY THIS AGREEMENT}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9376717 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2584472\charrsid2568982 +\par }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982 \hich\af1\dbch\af37\loch\f1 As used in this Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982\charrsid11414843 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \ab\af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid2568982 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982\charrsid14041768 ,}{ +\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid2568982 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2568982\charrsid11414843 \hich\af1\dbch\af37\loch\f1 refers to \hich\af1\dbch\af37\loch\f1 Splunk Inc., a Delaware corporation,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982 \hich\af1\dbch\af37\loch\f1 + with its principal place of business at 2}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7689881 \hich\af1\dbch\af37\loch\f1 7}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982 \hich\af1\dbch\af37\loch\f1 +0 Brannan Street, San Francisco, California 94107, U.S.A.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10493293 \hich\af1\dbch\af37\loch\f1 ;}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982\charrsid11414843 \hich\af1\dbch\af37\loch\f1 + and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid2568982\charrsid11414843 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982\charrsid11414843 \hich\af1\dbch\af37\loch\f1 +refers to the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982 \hich\af1\dbch\af37\loch\f1 company}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2564573 \hich\af1\dbch\af37\loch\f1 , government,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2568982 \hich\af1\dbch\af37\loch\f1 or other }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982\charrsid11414843 \hich\af1\dbch\af37\loch\f1 entity on whose behalf you }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2568982 \hich\af1\dbch\af37\loch\f1 have entered}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2568982\charrsid11414843 \hich\af1\dbch\af37\loch\f1 into this Agreement or, if there is no such entity, you as an individual.}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2564573 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9654466 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2568982\charrsid11476353 +\par {\*\bkmkstart _Ref280370660}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid13785815\charrsid11476353 \hich\af1\dbch\af37\loch\f1 1.\tab}}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid13785815\charrsid11476353 \hich\af1\dbch\af37\loch\f1 DEFINITIONS}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13785815\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13785815\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Capitalized terms }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2568982 \hich\af1\dbch\af37\loch\f1 used but }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13785815\charrsid11476353 \hich\af1\dbch\af37\loch\f1 not otherwise defined }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2568982 \hich\af1\dbch\af37\loch\f1 +in this Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13785815\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2568982 +\hich\af1\dbch\af37\loch\f1 have the meanings}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11997808 \hich\af1\dbch\af37\loch\f1 set forth }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13785815\charrsid11476353 \hich\af1\dbch\af37\loch\f1 in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\ul\lang9\langfe1033\langnp9\insrsid13785815\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Exhibit A}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13785815\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13785815\charrsid11476353 {\*\bkmkend _Ref280370660} +\par {\*\bkmkstart _Ref290064612}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid11697144\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.\tab}}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid3892541 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid11697144\charrsid11476353 \hich\af1\dbch\af37\loch\f1 LICENSE GRANTS}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11697144\charrsid11476353 {\*\bkmkend _Ref290064612}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 2.1\tab}}\pard \ltrpar\qj \fi360\li360\ri0\sa200\sl276\slmult1\widctlpar +\tx360\wrapdefault\aspalpha\aspnum\faauto\ls3\ilvl1\adjustright\rin0\lin360\itap0\pararsid3892541 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8473885\charrsid14694974 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11697144\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Subject to }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13571263 +\hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11697144\charrsid11476353 \hich\af1\dbch\af37\loch\f1 compliance with this Agreement, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1917023 +\hich\af1\dbch\af37\loch\f1 including}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5851450 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1917023 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1917023 \hich\af1\dbch\af37\loch\f1 s timely payment of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9639644 +\hich\af1\dbch\af37\loch\f1 all }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975 \hich\af1\dbch\af37\loch\f1 L}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1917023 \hich\af1\dbch\af37\loch\f1 icense }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid15933975 \hich\af1\dbch\af37\loch\f1 F}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1917023 \hich\af1\dbch\af37\loch\f1 ees, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11697144\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Splunk grants to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1724072 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11697144\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1724072 \hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11697144\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + nonexclusive, worldwide, nontransferable, nonsublicensable license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13571263 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6767501 \hich\af1\dbch\af37\loch\f1 +during the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6767501 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2099257\charrsid11476353 \hich\af1\dbch\af37\loch\f1 to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15929691 \hich\af1\dbch\af37\loch\f1 +install and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2099257\charrsid11476353 \hich\af1\dbch\af37\loch\f1 use}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11414843 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12321566 \hich\af1\dbch\af37\loch\f1 +within}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid936435 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid554500 +\hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14826087 \hich\af1\dbch\af37\loch\f1 solely }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10635421 \hich\af1\dbch\af37\loch\f1 for }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 +\loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10635421 \hich\af1\dbch\af37\loch\f1 Internal Business Purpose}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6504070 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid936435 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4947436 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12937888\charrsid13571263 +\par {\*\bkmkstart _Ref291500461}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12937888\charrsid8343654 \hich\af1\dbch\af37\loch\f1 2.2\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid12937888\charrsid8343654 \hich\af1\dbch\af37\loch\f1 Evaluation Software.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2957401 \hich\af1\dbch\af37\loch\f1 If}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2957401\charrsid8343654 \hich\af1\dbch\af37\loch\f1 the applicable Order } +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2957401 \hich\af1\dbch\af37\loch\f1 specifies that any Software is provided under}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2957401\charrsid8343654 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2957401 \hich\af1\dbch\af37\loch\f1 an e}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2957401\charrsid8343654 \hich\af1\dbch\af37\loch\f1 valuation }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2957401 \hich\af1\dbch\af37\loch\f1 +license or a free trial license, then s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12000438 \hich\af1\dbch\af37\loch\f1 ubject to Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12000438 \hich\af1\dbch\af37\loch\f1 s compliance with this Agreement, }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8993084 \hich\af1\dbch\af37\loch\f1 Splunk grants to Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13571263 \hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13571263\charrsid11476353 \hich\af1\dbch\af37\loch\f1 nonexclusive, worldwide, nontransferable, nonsublicensable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4352155 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid13571263 \hich\af1\dbch\af37\loch\f1 license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13571263\charrsid8343654 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6767501 \hich\af1\dbch\af37\loch\f1 during the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15929691 \hich\af1\dbch\af37\loch\f1 applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6767501 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13571263 \hich\af1\dbch\af37\loch\f1 to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13310656 \hich\af1\dbch\af37\loch\f1 install and use the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12015742 \hich\af1\dbch\af37\loch\f1 Evaluation}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13310656 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9440407 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12321566 \hich\af1\dbch\af37\loch\f1 within}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15951578 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9440407 \hich\af1\dbch\af37\loch\f1 solely}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7677610 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12937888\charrsid8343654 \hich\af1\dbch\af37\loch\f1 for }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 evaluating }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12937888\charrsid8343654 \hich\af1\dbch\af37\loch\f1 whether }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 Customer wishes }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12937888\charrsid8343654 \hich\af1\dbch\af37\loch\f1 to purchase a }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2957401 +\hich\af1\dbch\af37\loch\f1 commercial}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9440407 \hich\af1\dbch\af37\loch\f1 license }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12321566 +\hich\af1\dbch\af37\loch\f1 for}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9440407 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15929691 +\hich\af1\dbch\af37\loch\f1 such }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12937888\charrsid8343654 \hich\af1\dbch\af37\loch\f1 Software.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6763306 {\*\bkmkstart _Ref193190255}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12415427 \hich\af1\dbch\af37\loch\f1 Notwithstanding }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15929691 \hich\af1\dbch\af37\loch\f1 anything to the contrary in}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12415427 \hich\af1\dbch\af37\loch\f1 + this Agreemen}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 \hich\af1\dbch\af37\loch\f1 t}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12415427 \hich\af1\dbch\af37\loch\f1 , }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid554500 \hich\af1\dbch\af37\loch\f1 Splunk does not provide}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13571263 \hich\af1\dbch\af37\loch\f1 m}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13571263\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +aintenance and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13571263 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13571263\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 upport}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10630610 \hich\af1\dbch\af37\loch\f1 (Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 \hich\af1\dbch\af37\loch\f1 REF _Ref291499860 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003400390039003800360030000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 7}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10630610 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13571263\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13571263 \hich\af1\dbch\af37\loch\f1 w}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13571263\charrsid11476353 \hich\af1\dbch\af37\loch\f1 arranty}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10630610 \hich\af1\dbch\af37\loch\f1 (Section }{\field{\*\fldinst { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 \hich\af1\dbch\af37\loch\f1 REF _Ref291499868 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003400390039003800360038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 10}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10630610 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15929691 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 or}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15929691 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13571263 \hich\af1\dbch\af37\loch\f1 i}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13571263\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ndemnification}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10630610 \hich\af1\dbch\af37\loch\f1 (Section }{\field{\*\fldinst { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 \hich\af1\dbch\af37\loch\f1 REF _Ref280472428 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380030003400370032003400320038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 13}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10630610 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13571263 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12324826 \hich\af1\dbch\af37\loch\f1 with respect to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9440407 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12324826 \hich\af1\dbch\af37\loch\f1 E}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12324826\charrsid11476353 \hich\af1\dbch\af37\loch\f1 valuation }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13571263\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Software +{\*\bkmkend _Ref193190255}.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11498005 {\*\bkmkend _Ref291500461}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12937888\charrsid11476353 +\par {\*\bkmkstart _Ref291500524}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 2.3\tab}}\pard \ltrpar\qj \fi360\li360\ri0\sa200\sl276\slmult1\widctlpar +\tx360\wrapdefault\aspalpha\aspnum\faauto\ls3\ilvl1\adjustright\rin0\lin360\itap0\pararsid6365643 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 Test and Development}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid6365643\charrsid8343654 \hich\af1\dbch\af37\loch\f1 Software.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12481309 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 If}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643\charrsid8343654 \hich\af1\dbch\af37\loch\f1 the applicable Order }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 +specifies that any Software is provided under a test and development license, then subject to Customer\hich\f1 \rquote \loch\f1 s \hich\af1\dbch\af37\loch\f1 compliance with this Agreement, Splunk grants to Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6365643 \hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6365643\charrsid11476353 \hich\af1\dbch\af37\loch\f1 nonexclusive, worldwide, nontransferable, nonsublicensable}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid6365643 \hich\af1\dbch\af37\loch\f1 license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643\charrsid8343654 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 during the applicable Term to install and use the Test and Development Software within the Licensed Capacity }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12481309 \hich\af1\dbch\af37\loch\f1 in a non-production \hich\af1\dbch\af37\loch\f1 +system used for software product migration testing, software product pre-production staging, testing new data sources, types or use cases, or other non-production use. In no way should the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1205024 \hich\af1\dbch\af37\loch\f1 Test and Development Software be }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12481309 \hich\af1\dbch\af37\loch\f1 u}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1205024 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12481309 \hich\af1\dbch\af37\loch\f1 ed for any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6365643\charrsid7292939 \hich\af1\dbch\af37\loch\f1 revenue generation, c\hich\af1\dbch\af37\loch\f1 ommercial activity or other productive business or purpose}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6365643\charrsid8343654 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 + Notwithstanding anything to the contrary in this Agreement, Splunk does not provide w}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643\charrsid11476353 \hich\af1\dbch\af37\loch\f1 arranty}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 (Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 REF _Ref291499868 \\r +\\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003400390039003800360038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 10}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 ), or i}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ndemnification}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 (Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 REF _Ref280472428 \\r +\\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380030003400370032003400320038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 13}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6365643 \hich\af1\dbch\af37\loch\f1 ) with respect to the Test and Development}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6365643\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10635824 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12851453 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6365643\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid4857980\charrsid12324826 \hich\af1\dbch\af37\loch\f1 2.4\tab}}\pard \ltrpar\qj \fi360\li360\ri0\sa200\sl276\slmult1\widctlpar +\tx360\wrapdefault\aspalpha\aspnum\faauto\ls3\ilvl1\adjustright\rin0\lin360\itap0 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid4857980\charrsid12324826 \hich\af1\dbch\af37\loch\f1 Free }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid6763306\charrsid12324826 \hich\af1\dbch\af37\loch\f1 Software.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2957401\charrsid12324826 \hich\af1\dbch\af37\loch\f1 Splunk may make certain Software available for license without charge}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2957401 \hich\af1\dbch\af37\loch\f1 , and such Free Software may have limited features, functions, or other limitations of any kind. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Subject to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975\charrsid11476353 \hich\af1\dbch\af37\loch\f1 compliance with this Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid15933975 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk grants to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975 \hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975\charrsid11476353 \hich\af1\dbch\af37\loch\f1 nonexclusive, worldwide, nontransferable, nonsublicensable license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975 \hich\af1\dbch\af37\loch\f1 + during the\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975\charrsid11476353 \hich\af1\dbch\af37\loch\f1 to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 +\hich\af1\dbch\af37\loch\f1 install and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 use}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 + the Free Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12321566 \hich\af1\dbch\af37\loch\f1 within}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 solely for Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 +\loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 s Internal Business Purposes}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15933975 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15933975 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 {\*\bkmkend _Ref291500524}\hich\af1\dbch\af37\loch\f1 +Notwithstanding anything to the contrary in this Agr}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid554500 \hich\af1\dbch\af37\loch\f1 eement, Splunk does not provide}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 m}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 aintenance and }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 upport}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 (Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 REF _Ref291499860 \\ +r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003400390039003800360030000000}}}{\fldrslt {\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 7}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 w}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 arranty}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 (Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 REF _Ref291499868 \\r \\h }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003400390039003800360038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 10}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 ), or i}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ndemnification}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 (Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 + REF _Ref280472\hich\af1\dbch\af37\loch\f1 428 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380030003400370032003400320038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 13}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 ) with respect to Free}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid12324826 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2894579 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid2894579\charrsid1727288 \hich\af1\dbch\af37\loch\f1 2.5\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid2894579\charrsid1727288 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid2762772 \hich\af1\dbch\af37\loch\f1 Subscription}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2894579 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2762772 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10050039 \hich\af1\dbch\af37\loch\f1 When }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9261457 \hich\af1\dbch\af37\loch\f1 the a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10383679 \hich\af1\dbch\af37\loch\f1 pplicable Order }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5983534 \hich\af1\dbch\af37\loch\f1 specifies}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10383679 \hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5387267 \hich\af1\dbch\af37\loch\f1 Content S}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9261457 \hich\af1\dbch\af37\loch\f1 ubscription }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10050039 \hich\af1\dbch\af37\loch\f1 service as elected by Customer, }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7799991\charrsid7799991 \hich\af1\dbch\af37\loch\f1 Splunk will deliver }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7799991 \hich\af1\dbch\af37\loch\f1 or otherwise make available }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid2762772 \hich\af1\dbch\af37\loch\f1 the applicable Content S}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7799991\charrsid7799991 \hich\af1\dbch\af37\loch\f1 ubscription service to Customer }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid7799991 \hich\af1\dbch\af37\loch\f1 during the subscription period, and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10050039 \hich\af1\dbch\af37\loch\f1 subject to Customer\hich\f1 \rquote +\loch\f1 s compliance with this Agreement (including Customer\hich\f1 \rquote \loch\f1 s timely payment of all applicable Content Subscription Fees), }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2894579 +\hich\af1\dbch\af37\loch\f1 Splunk grants to such Customer a }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2894579\charrsid11476353 \hich\af1\dbch\af37\loch\f1 nonexclusive, worldwide, nontransferable, nonsublicensable license}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2894579 \hich\af1\dbch\af37\loch\f1 during the applicable subscription period }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2894579\charrsid11476353 \hich\af1\dbch\af37\loch\f1 to }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid2894579 \hich\af1\dbch\af37\loch\f1 install and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2894579\charrsid11476353 \hich\af1\dbch\af37\loch\f1 use}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2894579 +\hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15233896 \hich\af1\dbch\af37\loch\f1 subscribed }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2894579 \hich\af1\dbch\af37\loch\f1 +content solely in connection with the designated Purchased Software and solely f\hich\af1\dbch\af37\loch\f1 or Customer\hich\f1 \rquote \loch\f1 s Internal Business Purposes. Such content will be treated }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9261457 \hich\af1\dbch\af37\loch\f1 as Purchased Software under this Agreement except that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2762772 \hich\af1\dbch\af37\loch\f1 Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid2762772 \hich\af1\dbch\af37\loch\f1 REF _Ref291499868 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2762772 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003400390039003800360038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 10}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2762772 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2322792 \hich\af1\dbch\af37\loch\f1 W}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2762772 \hich\af1\dbch\af37\loch\f1 arranty) will not \hich\af1\dbch\af37\loch\f1 apply.}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12324826\charrsid14573035 +\par {\*\bkmkstart _Ref418075389}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 2.6\tab}}\pard \ltrpar\qj \fi360\li360\ri0\sa200\sl276\slmult1\widctlpar +\tx360\wrapdefault\aspalpha\aspnum\faauto\ls3\ilvl1\adjustright\rin0\lin360\itap0\pararsid13571263 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 Splunk Extensions}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4868\charrsid12324826 \hich\af1\dbch\af37\loch\f1 +Subject to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 s compliance with}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4868\charrsid12324826 \hich\af1\dbch\af37\loch\f1 this Agreement, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid5907613\charrsid12324826 \hich\af1\dbch\af37\loch\f1 including }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 +\loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 s }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5907613\charrsid12324826 \hich\af1\dbch\af37\loch\f1 timely payment of }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9840578 \hich\af1\dbch\af37\loch\f1 all }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5907613\charrsid12324826 \hich\af1\dbch\af37\loch\f1 License Fees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9264272 \hich\af1\dbch\af37\loch\f1 (if any)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5907613\charrsid12324826 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4868\charrsid12324826 +\hich\af1\dbch\af37\loch\f1 Splunk grants to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6763306\charrsid12324826 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4868\charrsid12324826 +\hich\af1\dbch\af37\loch\f1 a nonexclusive, worldwide, nontransferable, nonsublicensable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13571263\charrsid12324826 \hich\af1\dbch\af37\loch\f1 license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3416406\charrsid12324826 \hich\af1\dbch\af37\loch\f1 to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 use Splunk \hich\af1\dbch\af37\loch\f1 Extensions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3416406\charrsid12324826 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid4868\charrsid12324826 \hich\af1\dbch\af37\loch\f1 solely }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 in connection }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4868\charrsid12324826 \hich\af1\dbch\af37\loch\f1 with }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4352155 \hich\af1\dbch\af37\loch\f1 applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12190962 +\hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid554500 \hich\af1\dbch\af37\loch\f1 that Customer has licensed from Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 +, subject to the same limitations and restrictions (including with respect to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12321566 +\hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 ) that apply to the }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 with which the Splunk Extens\hich\af1\dbch\af37\loch\f1 +ions are used}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4868\charrsid12324826 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11032075 \hich\af1\dbch\af37\loch\f1 Notwithstanding the foregoing, i}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 f any Splunk Extension is }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11032075 \hich\af1\dbch\af37\loch\f1 provided to Customer under a separate}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 license agreement }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12325173\charrsid12324826 \hich\af1\dbch\af37\loch\f1 that grants Customer more permissive or broader rights}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 with respect to }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12321566 \hich\af1\dbch\af37\loch\f1 such}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 Splunk Extension }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11032075 +\hich\af1\dbch\af37\loch\f1 (e.g., a separate license agreement that is provided to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 Customer as part of the download process for }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid12321566 \hich\af1\dbch\af37\loch\f1 such}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12321566 \hich\af1\dbch\af37\loch\f1 S}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 plunk Extension)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4875164\charrsid12324826 \hich\af1\dbch\af37\loch\f1 then }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 +\hich\af1\dbch\af37\loch\f1 separate }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 license agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 +, and not this Agreement,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8473885\charrsid12324826 \hich\af1\dbch\af37\loch\f1 will govern}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 Customer}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12325173 \hich\af1\dbch\af37\loch\f1 s installation and use of such Splunk Extension +\hich\af1\dbch\af37\loch\f1 (but, for clarity, this Agreement will apply to all other Splunk Extensions)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4071359\charrsid12324826 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9840578 +{\*\bkmkend _Ref418075389}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12321566 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5598572\charrsid12324826 +\par {\*\bkmkstart _Ref291500589}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12145259 \hich\af1\dbch\af37\loch\f1 2.7\tab}}\pard \ltrpar\qj \fi360\li360\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\ilvl1\adjustright\rin0\lin360\itap0\pararsid14893910 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12145259 \hich\af1\dbch\af37\loch\f1 Customer Extensions}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid14508636\charrsid14508636 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14508636\charrsid14508636 +\hich\af1\dbch\af37\loch\f1 Subject to Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14508636\charrsid14508636 \hich\af1\dbch\af37\loch\f1 s}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9840578 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14508636\charrsid14508636 \hich\af1\dbch\af37\loch\f1 +compliance with this Agreement, Splunk grants to Customer a nonexclusive, worldwide, nontransferable, nonsublicensable license }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12145259 \hich\af1\dbch\af37\loch\f1 (a) }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid14508636\charrsid14508636 \hich\af1\dbch\af37\loch\f1 to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12145259 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 +\hich\af1\dbch\af37\loch\f1 copy, modify and}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14508636\charrsid14508636 \hich\af1\dbch\af37\loch\f1 use }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14508636\charrsid14508636 \hich\af1\dbch\af37\loch\f1 the Splunk Developer Tools solely }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11365907 \hich\af1\dbch\af37\loch\f1 to develop} +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14508636\charrsid14508636 \hich\af1\dbch\af37\loch\f1 Extensions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2182119 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11365907 \hich\af1\dbch\af37\loch\f1 for use}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14508636\charrsid14508636 +\hich\af1\dbch\af37\loch\f1 with }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7617112 +\hich\af1\dbch\af37\loch\f1 designated }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7617112 +\hich\af1\dbch\af37\loch\f1 or Splunk Extension}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14508636\charrsid14508636 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Customer Extension}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid14508636\charrsid9264272 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14508636\charrsid14508636 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9840578 \hich\af1\dbch\af37\loch\f1 , including to }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4875164 \hich\af1\dbch\af37\loch\f1 support interoperability between}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9840578 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4875164 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7617112 \hich\af1\dbch\af37\loch\f1 or Splunk Extension }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4875164 \hich\af1\dbch\af37\loch\f1 and Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4875164 \hich\af1\dbch\af37\loch\f1 s \hich\af1\dbch\af37\loch\f1 system or environment}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12145259 \hich\af1\dbch\af37\loch\f1 + and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079 \hich\af1\dbch\af37\loch\f1 (b) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12145259 \hich\af1\dbch\af37\loch\f1 +to distribute the Customer Extensions }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079 \hich\af1\dbch\af37\loch\f1 exclusively for the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid279047 \hich\af1\dbch\af37\loch\f1 use with}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid11482652 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079 \hich\af1\dbch\af37\loch\f1 designated Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7617112 \hich\af1\dbch\af37\loch\f1 or Splunk Extension}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14508636\charrsid14508636 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6232079 \hich\af1\dbch\af37\loch\f1 The foregoing license is subject to the following conditions: }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 (}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2315508 \hich\af1\dbch\af37\loch\f1 x}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 Splunk proprietary legends or notices contained in the }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid279047 \hich\af1\dbch\af37\loch\f1 Splunk Developer Tools}{\rtlch\fcs1 +\ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2315508 \hich\af1\dbch\af37\loch\f1 may not}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2315508\charrsid9523363 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 be removed or altered when used in }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2315508 \hich\af1\dbch\af37\loch\f1 or with }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 the Customer Extension;}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid279047 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 +\ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2315508 \hich\af1\dbch\af37\loch\f1 y}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079\charrsid9523363 +\hich\af1\dbch\af37\loch\f1 Customer }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2315508 \hich\af1\dbch\af37\loch\f1 may}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2315508\charrsid9523363 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 not make }{\rtlch\fcs1 \af0 \ltrch\fcs0 \f1\fs18\insrsid6232079\charrsid414826 \hich\af1\dbch\af37\loch\f1 any }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 statement that Customer Extension is certified}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13260218 \hich\af1\dbch\af37\loch\f1 (unless it}{\rtlch\fcs1 \ab\af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid13467479 \hich\af1\dbch\af37\loch\f1 i}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13260218 \hich\af1\dbch\af37\loch\f1 s duly certified by Splunk through the }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13467479 \hich\af1\dbch\af37\loch\f1 Splunk App}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13260218 \hich\af1\dbch\af37\loch\f1 Certification Program)}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 or that its performance is guaranteed by Splunk.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 + Customer retains title to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2315508 \hich\af1\dbch\af37\loch\f1 the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 +\hich\af1\dbch\af37\loch\f1 Customer Extensions, subject to Splunk\hich\f1 \rquote \loch\f1 s }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2315508 \hich\af1\dbch\af37\loch\f1 ownership}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9571075 \hich\af1\dbch\af37\loch\f1 set forth}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 + REF _Ref283015022 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380033003000310035003000320032000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 5}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9571075 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 If Customer allows }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2315508 \hich\af1\dbch\af37\loch\f1 end users of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 Customer Extensions }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9571075 \hich\af1\dbch\af37\loch\f1 to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2315508 \hich\af1\dbch\af37\loch\f1 modify }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11482652 \hich\af1\dbch\af37\loch\f1 or distribute}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2315508 \hich\af1\dbch\af37\loch\f1 the}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11482652 \hich\af1\dbch\af37\loch\f1 Customer Extensions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 +, Customer shall limit such modification or distribution to use with the designated Softwa\hich\af1\dbch\af37\loch\f1 re }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9571075 \hich\af1\dbch\af37\loch\f1 or Splunk Extension +}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 only}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9571075 ,}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid279047 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11482652 \hich\af1\dbch\af37\loch\f1 will }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid279047 \hich\af1\dbch\af37\loch\f1 flow}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11482652 \hich\af1\dbch\af37\loch\f1 down the conditions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid279047 \hich\af1\dbch\af37\loch\f1 in (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2315508 \hich\af1\dbch\af37\loch\f1 x}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid279047 \hich\af1\dbch\af37\loch\f1 ) and (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2315508 \hich\af1\dbch\af37\loch\f1 y}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid279047 \hich\af1\dbch\af37\loch\f1 ) above to end users}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9571075 \hich\af1\dbch\af37\loch\f1 of Customer Extensions}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6232079\charrsid9523363 \hich\af1\dbch\af37\loch\f1 . Customer agrees to assume full responsibility for the performance and distribution of Customer Extensions}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14892695 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10252955 {\*\bkmkend _Ref291500589}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid14892695\charrsid14892695 +\par {\*\bkmkstart _Ref418075346}{\*\bkmkstart _Ref291500646}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid1455894\charrsid14893910 \hich\af1\dbch\af37\loch\f1 2.8\tab}}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid1455894\charrsid14893910 \hich\af1\dbch\af37\loch\f1 O}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 pen Source}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid9964237 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1455894\charrsid14893910 \hich\af1\dbch\af37\loch\f1 . }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10774811 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4352155\charrsid4352155 \hich\af1\dbch\af37\loch\f1 acknowledges that certain }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4352155\charrsid4352155 \hich\af1\dbch\af37\loch\f1 may contain }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 +\hich\af1\dbch\af37\loch\f1 Open Source Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid14893910 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid14893910 \hich\af1\dbch\af37\loch\f1 Open Source Software may be identified in the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9113322 \hich\af1\dbch\af37\loch\f1 end user d}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 ocumentation}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid14893910 \hich\af1\dbch\af37\loch\f1 or in a list of the Open Source So}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 ftware provided to Customer upon Customer\hich\f1 \rquote \loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid14893910 \hich\af1\dbch\af37\loch\f1 + written request. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9964237 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 Any Open \hich\af1\dbch\af37\loch\f1 Source Software that}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 is delivered to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 Customer as part of Purchased Software,}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 which}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 may}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 + not be taken out of the Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 or }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 +used separately from the Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 is covered by the warranty}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 +\hich\af1\dbch\af37\loch\f1 , support}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 and indemni}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 +fication provisions applicab\hich\af1\dbch\af37\loch\f1 le to Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15879643 +\hich\af1\dbch\af37\loch\f1 Customer acknowledges that specific t}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 erms}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15879643 \hich\af1\dbch\af37\loch\f1 required by the respective licensor of the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 Open Source Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 may }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15879643 \hich\af1\dbch\af37\loch\f1 apply to the use of Open Source Software, which terms shall }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 +be include}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 d in the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5387267 \hich\af1\dbch\af37\loch\f1 d}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 ocumentation}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 ;}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 +\hich\af1\dbch\af37\loch\f1 however}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 , these terms will \hich\af1\dbch\af37\loch\f1 not: (a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 +\hich\af1\dbch\af37\loch\f1 ) impose any additional restrictions }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 on Customer's use of the Software, or (b) negate or amend Splunk\hich\f1 \rquote \loch\f1 s}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 responsibilities with respect to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145\charrsid13065494 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10369982 +{\*\bkmkend _Ref418075346}{\*\bkmkend _Ref291500646} +\par {\*\bkmkstart _Ref290064620}{\*\bkmkstart _Ref418068232}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid6912703 \hich\af1\dbch\af37\loch\f1 3.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid6912703 \hich\af1\dbch\af37\loch\f1 +LICENSE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 RESTRICTIONS.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1859867 \hich\af1\dbch\af37\loch\f1 +Unless otherwise expressly permitted by Splunk, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6843113\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 not}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9329677 \hich\af1\dbch\af37\loch\f1 and Customer has no right to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2961722 \hich\af1\dbch\af37\loch\f1 :}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) copy }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 any }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11815883 \hich\af1\dbch\af37\loch\f1 Splunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 (except as required to run the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 and for reasonable backup purposes); (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 b}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) modify, adapt, or create derivative works of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4857980 \hich\af1\dbch\af37\loch\f1 Splunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ; (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 c}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) rent, lease, loan, resell, transfer, sublic\hich\af1\dbch\af37\loch\f1 ense}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 distribute}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13787194 \hich\af1\dbch\af37\loch\f1 , disclose or otherwise provide}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10633892\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Splunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13055850\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 to any third party; (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 d}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) decompile, disassemble or reverse-engineer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 +}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 any Splunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13787194 \hich\af1\dbch\af37\loch\f1 , }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13787194\charrsid13787194 \hich\af1\dbch\af37\loch\f1 or determine or attempt to determine any source code, algorithms, methods or techniques embodied \hich\af1\dbch\af37\loch\f1 in any}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13787194 \hich\af1\dbch\af37\loch\f1 Splunk Materials,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1053415 \hich\af1\dbch\af37\loch\f1 except to the extent }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13697541 \hich\af1\dbch\af37\loch\f1 expressly }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1053415 \hich\af1\dbch\af37\loch\f1 permitted by }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3607824 \hich\af1\dbch\af37\loch\f1 applicable }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1053415 \hich\af1\dbch\af37\loch\f1 law}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 + notwithstanding a contractual prohibition to the contrary}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ; }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid4080865 \hich\af1\dbch\af37\loch\f1 (e) access or use any Disabled Materials; }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 (}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4080865 \hich\af1\dbch\af37\loch\f1 f}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16662236 \hich\af1\dbch\af37\loch\f1 pro}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 vide}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 to any third party the results of any benchmark tests or other evaluation of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9329677 \hich\af1\dbch\af37\loch\f1 any Splunk Materials }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 without Splunk}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 s }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid16017574 \hich\af1\dbch\af37\loch\f1 prior }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 written consent}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid26970 \hich\af1\dbch\af37\loch\f1 ;}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4080865 \hich\af1\dbch\af37\loch\f1 g}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 attempt to disab}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16662236 \hich\af1\dbch\af37\loch\f1 le or circumvent any }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9329677 \hich\af1\dbch\af37\loch\f1 license key or other }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 technological}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9329677 \hich\af1\dbch\af37\loch\f1 mechanisms or measures }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 intended to}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9329677 \hich\af1\dbch\af37\loch\f1 preven\hich\af1\dbch\af37\loch\f1 t}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 +\hich\af1\dbch\af37\loch\f1 , limit or control}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9329677 \hich\af1\dbch\af37\loch\f1 use or copying of, or access to, any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid16017574 \hich\af1\dbch\af37\loch\f1 Splunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 + (including in order to gain access to any Disabled Materials)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 ; }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6912703 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4080865 \hich\af1\dbch\af37\loch\f1 h}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6912703 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6912703\charrsid11476353 \hich\af1\dbch\af37\loch\f1 remove or obscure any copyright, trademark, } +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6912703 \hich\af1\dbch\af37\loch\f1 patent, or other}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6912703\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13787194 \hich\af1\dbch\af37\loch\f1 proprietary notices, legends or symbols }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6912703\charrsid11476353 \hich\af1\dbch\af37\loch\f1 from }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6912703 \hich\af1\dbch\af37\loch\f1 any}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6912703\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6912703 \hich\af1\dbch\af37\loch\f1 ; }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4080865 \hich\af1\dbch\af37\loch\f1 i}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4875164 \hich\af1\dbch\af37\loch\f1 exceed}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 ; }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793\charrsid138121 {\*\bkmkend _Ref290064620}\hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4080865\charrsid138121 \hich\af1\dbch\af37\loch\f1 j}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793\charrsid138121 \hich\af1\dbch\af37\loch\f1 ) }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid138121\charrsid10496887 \hich\af1\dbch\af37\loch\f1 separately use any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid138121\charrsid10496887 \hich\af1\dbch\af37\loch\f1 +of the applicable features and functionalities of the Splunk Materials with external applications or code not furnished by Splunk or any data not processed by the Software, except \hich\af1\dbch\af37\loch\f1 +otherwise specifically permitted in the Documentation}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid138121\charrsid138121 \hich\af1\dbch\af37\loch\f1 ; (k)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid138121 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 otherwise access or }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 use }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076 \hich\af1\dbch\af37\loch\f1 any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13241076\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Splunk Materials except as expressly authorized in this Agreement; }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 or (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14230089 \hich\af1\dbch\af37\loch\f1 l}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 +) encourage or assist any third party to do any of the foregoing.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9571228\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 Customer acknowledges that}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5797727 \hich\af1\dbch\af37\loch\f1 the}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 \hich\af1\dbch\af37\loch\f1 may }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 be configured to display warnings, reduce available functionality,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768 +\hich\af1\dbch\af37\loch\f1 and/or cease functioning}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 if unauthorized or improper use is detected, including if the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3607824 +\hich\af1\dbch\af37\loch\f1 expires or the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1859867 \hich\af1\dbch\af37\loch\f1 is}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 \hich\af1\dbch\af37\loch\f1 reached}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 or exceeded}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041768\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 {\*\bkmkend _Ref418068232}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11362937 +\par {\*\bkmkstart _Ref418000422}{\*\bkmkstart _Ref418003478}{\*\bkmkstart _Ref418075408}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid1903267\charrsid14694974 \hich\af1\dbch\af37\loch\f1 4.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid12462478 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid1903267\charrsid14694974 \hich\af1\dbch\af37\loch\f1 +CONSULTANTS}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10384975 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8273793 \hich\af1\dbch\af37\loch\f1 +Customer may permit its authorized }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 consultant}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid16133092\charrsid11476353 \hich\af1\dbch\af37\loch\f1 contractor}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 and}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16133092\charrsid11476353 \hich\af1\dbch\af37\loch\f1 agent}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4917613 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid4917613\charrsid4917613 \hich\af1\dbch\af37\loch\f1 Service Providers}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4917613 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8273793 \hich\af1\dbch\af37\loch\f1 to}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 \hich\af1\dbch\af37\loch\f1 access and use}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 +Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6912703 \hich\af1\dbch\af37\loch\f1 +solely }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 on }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 +\hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12275452\charrsid11476353 \hich\af1\dbch\af37\loch\f1 behal}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid16133092\charrsid11476353 \hich\af1\dbch\af37\loch\f1 f}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2892897\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4917613 \hich\af1\dbch\af37\loch\f1 in connection with providing services to Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 \hich\af1\dbch\af37\loch\f1 +, subject to the terms and conditions of this \hich\af1\dbch\af37\loch\f1 Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4917613 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 {\*\bkmkend _Ref418000422}\hich\af1\dbch\af37\loch\f1 +Any such access or use by a Service Provider will be subject to the same limitations and restrictions that apply to Customer under this Agreement, and Customer will be }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14897880 +\hich\af1\dbch\af37\loch\f1 jointly and severally liable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 \hich\af1\dbch\af37\loch\f1 for any}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid724510 \hich\af1\dbch\af37\loch\f1 Service Provider\hich\f1 \rquote \loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid724510 \hich\af1\dbch\af37\loch\f1 actions relating to o\hich\af1\dbch\af37\loch\f1 r }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14897880 +\hich\af1\dbch\af37\loch\f1 use of the Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 \hich\af1\dbch\af37\loch\f1 +. For avoidance of doubt, the aggregate use by Customer and all of its Service Providers must not exceed the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 \hich\af1\dbch\af37\loch\f1 and nothing in this Section{\*\bkmkend _Ref418003478} }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 \hich\af1\dbch\af37\loch\f1 REF _Ref418003478 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000300033003400370038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 4}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 \hich\af1\dbch\af37\loch\f1 is intended to or will be deemed to increase any }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8521347 .{\*\bkmkend _Ref418075408} +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1660166\charrsid12462478 +\par {\*\bkmkstart _Ref283015022}{\*\bkmkstart _Ref280375344}{\*\bkmkstart _Ref203558538}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid11476353 \hich\af1\dbch\af37\loch\f1 5.\tab} +}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid2240671 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid11476353 \hich\af1\dbch\af37\loch\f1 OWNERSHIP.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8329941\charrsid11476353 \hich\af1\dbch\af37\loch\f1 S}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1859867 \hich\af1\dbch\af37\loch\f1 plunk, its suppliers and/or }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8329941\charrsid11476353 \hich\af1\dbch\af37\loch\f1 licensors own all}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8329941 +\hich\af1\dbch\af37\loch\f1 worldwide right, title and interest in and to the Splunk Materials, including all related Intellectual Property Rights}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8329941\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13787194 \hich\af1\dbch\af37\loch\f1 Except for the licenses expressly granted to Customer in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13787194 \hich\af1\dbch\af37\loch\f1 REF _Ref290064612 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13787194 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390030003000360034003600310032000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 2}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13787194 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13787194 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13787194\charrsid13787194 \hich\af1\dbch\af37\loch\f1 will not acquire or claim any right, title or interest in or to }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13787194 \hich\af1\dbch\af37\loch\f1 any Splunk Materials or related Intellectual Property Rights}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13787194\charrsid13787194 \hich\af1\dbch\af37\loch\f1 +, whether by implication, operation of law or otherwise}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13787194 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2635806\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6579486 {\*\bkmkend _Ref283015022}\hich\af1\dbch\af37\loch\f1 Notwithstanding anything to the contrary\hich\af1\dbch\af37\loch\f1 +, the Software is licensed, not sold, to Customer. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2240671 \hich\af1\dbch\af37\loch\f1 To the extent that Customer provides any}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid989329 \hich\af1\dbch\af37\loch\f1 Feedback}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid2240671 +\hich\af1\dbch\af37\loch\f1 Customer grants to Splunk a perpetual, irrevocable, worldwide, nonexclusive, transferable, sublicensable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1983831 \hich\af1\dbch\af37\loch\f1 , royalty-free, fully paid-up}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid2240671 \hich\af1\dbch\af37\loch\f1 right and license to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2319561 \hich\af1\dbch\af37\loch\f1 use and }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid2240671 \hich\af1\dbch\af37\loch\f1 commercially exploit }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8274739 \hich\af1\dbch\af37\loch\f1 the Feedback }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2240671\charrsid2240671 \hich\af1\dbch\af37\loch\f1 in any manner }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2319561 \hich\af1\dbch\af37\loch\f1 Splunk deems fit}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2240671\charrsid2240671 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13249368\charrsid2240671 +\par {\*\bkmkstart _Ref280375279}{\*\bkmkstart _Ref280472410}{\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 6.\tab}}\pard\plain \ltrpar +\s38\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid1727288\contextualspace \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 LICENSE }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid9261457 \hich\af1\dbch\af37\loch\f1 AND SUBSCRIPTION }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 FEES.}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid1727288 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 Customer }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13448583\charrsid1727288 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3962440\charrsid1727288 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 pay}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2635806\charrsid1727288 \hich\af1\dbch\af37\loch\f1 all }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15933975\charrsid1727288 \hich\af1\dbch\af37\loch\f1 l}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 icense }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15933975\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 f}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 ees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3962440\charrsid1727288 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid19617\charrsid1727288 \hich\af1\dbch\af37\loch\f1 set forth in the }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3962440\charrsid1727288 \hich\af1\dbch\af37\loch\f1 Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15933975\charrsid1727288 \hich\af1\dbch\af37\loch\f1 + (the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413\charrsid1727288 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid15933975\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 License Fees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413\charrsid1727288 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15933975\charrsid1727288 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13448583\charrsid1727288 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid724510\charrsid1727288 \hich\af1\dbch\af37\loch\f1 for the Software delivered to Customer }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13448583\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 no later than }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 thirty (30) days }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13448583\charrsid1727288 \hich\af1\dbch\af37\loch\f1 after}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 the date of }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13448583\charrsid1727288 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367\charrsid1727288 +\loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13448583\charrsid1727288 \hich\af1\dbch\af37\loch\f1 s applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3962440\charrsid1727288 \hich\af1\dbch\af37\loch\f1 invoice.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid1727288 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7799991 \hich\af1\dbch\af37\loch\f1 Customer will also pay all }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6911381\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 content subscription fees as may be applicable to the Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14366598\charrsid1727288 \hich\af1\dbch\af37\loch\f1 +, as identified in the Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7799991 \hich\af1\dbch\af37\loch\f1 \hich\f1 (the \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid7799991\charrsid1727288 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid8859568\charrsid1727288 \hich\af1\dbch\af37\loch\f1 + Subscription Fees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8859568 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 , collectively \hich\af1\dbch\af37\loch\f1 \hich\f1 together with License Fees, the \'93}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid8859568\charrsid1727288 \hich\af1\dbch\af37\loch\f1 Fees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8859568 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 )}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6911381\charrsid1727288 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13448583\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 Without limitation of Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367\charrsid1727288 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13448583\charrsid1727288 \hich\af1\dbch\af37\loch\f1 s other termination rights, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8797821\charrsid1727288 \hich\af1\dbch\af37\loch\f1 +if Customer fails to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2635806\charrsid1727288 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 pay }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8797821\charrsid1727288 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 Fees }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8797821\charrsid1727288 \hich\af1\dbch\af37\loch\f1 +when due, then Splunk may terminate this Agreement and all licenses granted hereunder}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572\charrsid1727288 \hich\af1\dbch\af37\loch\f1 by notice to Customer}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid1727288 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8797821\charrsid1727288 \hich\af1\dbch\af37\loch\f1 All}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 \hich\af1\dbch\af37\loch\f1 Fees are non-refundable once paid.}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid1727288 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 Any fees and payment terms for Splunk Extensions }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid19617\charrsid1727288 \hich\af1\dbch\af37\loch\f1 not included in the }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8797821\charrsid1727288 \hich\af1\dbch\af37\loch\f1 Order will be as set forth on the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 download page}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8797821\charrsid1727288 \hich\af1\dbch\af37\loch\f1 for such Splunk Extensions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid1727288 .{\*\bkmkend _Ref280375279}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14366598\charrsid1727288 {\*\bkmkend _Ref280472410} +\par {\*\bkmkstart _Ref280472413}{\*\bkmkstart _Ref291499860}{\*\bkmkstart _Ref418075450}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid8335957 \hich\af1\dbch\af37\loch\f1 7.\tab} +}\pard\plain \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid7956883 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid8335957 \hich\af1\dbch\af37\loch\f1 MAINTENANCE AND SUPPORT.}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid8335957 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14038540\charrsid8335957 \hich\af1\dbch\af37\loch\f1 +If Customer has purchased support and maintenance\hich\af1\dbch\af37\loch\f1 for the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid8335957 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14038540\charrsid8335957 \hich\af1\dbch\af37\loch\f1 as set forth in the Order }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14487122\charrsid8335957 +\hich\af1\dbch\af37\loch\f1 (the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413\charrsid8335957 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid14487122\charrsid8335957 \hich\af1\dbch\af37\loch\f1 Support Services}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413\charrsid8335957 \loch\af1\dbch\af37\hich\f1 \'94}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14487122\charrsid8335957 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14038540\charrsid8335957 +\hich\af1\dbch\af37\loch\f1 , then }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid8335957 \hich\af1\dbch\af37\loch\f1 Splunk will provide the level of support }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14038540\charrsid8335957 \hich\af1\dbch\af37\loch\f1 and maint}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid19617\charrsid8335957 \hich\af1\dbch\af37\loch\f1 enance included in the } +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14038540\charrsid8335957 \hich\af1\dbch\af37\loch\f1 Order in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13249368\charrsid8335957 +\hich\af1\dbch\af37\loch\f1 accordance with }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14038540\charrsid8335957 \hich\af1\dbch\af37\loch\f1 the terms and conditions set forth in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\ul\lang9\langfe1033\langnp9\insrsid13249368\charrsid8335957 \hich\af1\dbch\af37\loch\f1 Exhibit C}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14038540\charrsid8335957 {\*\bkmkend _Ref280472413} +{\*\bkmkend _Ref291499860}.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8335957\charrsid8335957 {\*\bkmkend _Ref418075450}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13249368\charrsid10494223 +\par {\*\bkmkstart _Ref291500791}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid1926692\charrsid10494223 \hich\af1\dbch\af37\loch\f1 8.\tab}}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid13249368 {\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid1926692\charrsid10494223 \hich\af1\dbch\af37\loch\f1 CONFIGURATION}{\rtlch\fcs1 \ab\af1\afs18 +\ltrch\fcs0 \b\f1\fs18\insrsid13249368\charrsid10494223 \hich\af1\dbch\af37\loch\f1 SERVICES.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159\charrsid10494223 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12877022\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Subject to Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367\charrsid10494223 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12877022\charrsid10494223 \hich\af1\dbch\af37\loch\f1 s payment of applicable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10494223 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12877022 +\hich\af1\dbch\af37\loch\f1 fees, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13249368\charrsid15992736 \hich\af1\dbch\af37\loch\f1 Splunk will provide}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9781995 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7888689 \hich\af1\dbch\af37\loch\f1 the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12877022 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9781995 +\hich\af1\dbch\af37\loch\f1 deployment}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13249368\charrsid15992736 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9781995 \hich\af1\dbch\af37\loch\f1 usage assistance,}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid13249368\charrsid15992736 \hich\af1\dbch\af37\loch\f1 configuration}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9781995 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13249368\charrsid15992736 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9781995 \hich\af1\dbch\af37\loch\f1 and/or}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9781995\charrsid15992736 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13249368\charrsid15992736 \hich\af1\dbch\af37\loch\f1 training services }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7888689 \hich\af1\dbch\af37\loch\f1 (if any) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid19617 \hich\af1\dbch\af37\loch\f1 set forth in the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12877022 \hich\af1\dbch\af37\loch\f1 Order }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14487122 \hich\af1\dbch\af37\loch\f1 +(the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid14487122\charrsid11954481 \hich\af1\dbch\af37\loch\f1 Professional Services}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14487122 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12877022 \hich\af1\dbch\af37\loch\f1 +in accordance with Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12877022 \hich\af1\dbch\af37\loch\f1 s standard }{\field\fldedit{\*\fldinst { +\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 \hich\af0\dbch\af37\loch\f0 HYPERLINK "http://www.splunk.com/en_us/legal/professional-services-agreement.html" }}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\cs22\f1\fs18\ul\cf2\insrsid12877022\charrsid8329941 \hich\af1\dbch\af37\loch\f1 professional services terms and conditions}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12877022 \hich\af1\dbch\af37\loch\f1 , which terms and conditions }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13249368\charrsid15992736 \hich\af1\dbch\af37\loch\f1 are hereby incorporated by reference }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid12877022 \hich\af1\dbch\af37\loch\f1 and made a part of this Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13249368\charrsid15992736 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14038540 +{\*\bkmkend _Ref291500791}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13249368\charrsid11476353 +\par {\*\bkmkstart _Ref203558592}{\*\bkmkstart _Ref193190162}{\*\bkmkend _Ref280375344}{\*\bkmkend _Ref203558538}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 9.\tab}}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 SOFTWARE VERIFICATION AND \hich\af1\dbch\af37\loch\f1 AUDIT.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 At Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 s request, }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + will furnish Splunk with a certification signed by }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid4985922\charrsid11476353 \hich\af1\dbch\af37\loch\f1 authorized representative }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11828462 \hich\af1\dbch\af37\loch\f1 verifying that the} +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12521107 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid26970 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9839182\charrsid11476353 \hich\af1\dbch\af37\loch\f1 is}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 being used in accordance with this Agreement and the applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3032049\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16659253 \hich\af1\dbch\af37\loch\f1 Also, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6365643 +\hich\af1\dbch\af37\loch\f1 if Customer has purchased }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12481309 \hich\af1\dbch\af37\loch\f1 an }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6365643 \hich\af1\dbch\af37\loch\f1 +offering that requires usage reporting as identified in the Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16659253 \hich\af1\dbch\af37\loch\f1 , Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16659253\charrsid16659253 +\hich\af1\dbch\af37\loch\f1 agrees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12481309 \hich\af1\dbch\af37\loch\f1 to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16659253\charrsid16659253 \hich\af1\dbch\af37\loch\f1 provide such report +}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6365643 \hich\af1\dbch\af37\loch\f1 ing}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16659253\charrsid16659253 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6365643 \hich\af1\dbch\af37\loch\f1 pursuant to the requirements set forth by Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16659253\charrsid16659253 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16659253 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Upon at least ten (10) days}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 prior written}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4875164 \hich\af1\dbch\af37\loch\f1 notice}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 to Customer}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12779779\charrsid11476353 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk may audit }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3283553 \hich\af1\dbch\af37\loch\f1 (and its Service Providers}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3283553 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +use of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12521107 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 to ensure that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3283553 \hich\af1\dbch\af37\loch\f1 (and such Service Providers)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3283553 \hich\af1\dbch\af37\loch\f1 are}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 in compliance with this Agreement and the applicable Order.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Any such audit will be conducted during regular business hours at }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3283553 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 and/}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3283553 \hich\af1\dbch\af37\loch\f1 or its Service Providers) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +facilities, will not unreasonably interfere with }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4009185 \hich\af1\dbch\af37\loch\f1 (or its Service Providers}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4009185 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1859867 \hich\af1\dbch\af37\loch\f1 business and will }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9781995 \hich\af1\dbch\af37\loch\f1 comply}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 with }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4009185 \hich\af1\dbch\af37\loch\f1 (or its Service +\hich\af1\dbch\af37\loch\f1 Providers}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4009185 +\hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 reasonable security procedures. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 will }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4009185 \hich\af1\dbch\af37\loch\f1 (and will ensure that its Service Providers) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 provide Splunk with }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7543861\charrsid11476353 \hich\af1\dbch\af37\loch\f1 reasonable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 access to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9781995 \hich\af1\dbch\af37\loch\f1 all}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 relevant records and facilities}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7543861\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9781995 \hich\af1\dbch\af37\loch\f1 reasonably necessary to conduct the audit}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 If an audit reveals that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999650 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4009185 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 and/}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14230089 \hich\af1\dbch\af37\loch\f1 or any Service Provider}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4009185 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999650 \hich\af1\dbch\af37\loch\f1 has}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 exceeded the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15164339 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14358719\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +or the scope of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 +\rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14358719\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11501159\charrsid11476353 \hich\af1\dbch\af37\loch\f1 grant}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 during the period audited, then Splunk will invoice }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + will promptly pay Splunk any underpaid }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8005200 \hich\af1\dbch\af37\loch\f1 F}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ees based on Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 s price list \hich\af1\dbch\af37\loch\f1 in effect at the time the audit is completed.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 If the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12521107 \hich\af1\dbch\af37\loch\f1 excess }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +usage exceeds ten percent (10%) of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , then }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 will also pay Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 s reasonable costs of conducting the audit.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12595682 \hich\af1\dbch\af37\loch\f1 Customer will ensure that its Service Providers provide Spl +\hich\af1\dbch\af37\loch\f1 unk with the access described in this Section}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3813645 \hich\af1\dbch\af37\loch\f1 }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3813645 \hich\af1\dbch\af37\loch\f1 REF _Ref203558592 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3813645 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200300033003500350038003500390032000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 9}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12595682 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid11630716\charrsid11476353 \hich\af1\dbch\af37\loch\f1 This Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3813645 \hich\af1\dbch\af37\loch\f1 + REF _Ref203558592 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3813645 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200300033003500350038003500390032000000}}}{\fldrslt { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 9}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3813645 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid11630716\charrsid11476353 \hich\af1\dbch\af37\loch\f1 surviv}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8535024\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +e expiration or termination of this Agreement for a period of t}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7029516\charrsid11476353 \hich\af1\dbch\af37\loch\f1 hree}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8535024\charrsid11476353 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7029516\charrsid11476353 \hich\af1\dbch\af37\loch\f1 3}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8535024\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) \hich\af1\dbch\af37\loch\f1 years.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10043959\charrsid11476353 +{\*\bkmkend _Ref203558592}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8289653\charrsid11476353 {\*\bkmkend _Ref193190162} +\par {\*\bkmkstart _Ref192757662}{\*\bkmkstart _Ref291499868}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 10.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid8329941 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 WARRANTY}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid8329941 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 {\*\bkmkstart _Ref418063975}\hich\af1\dbch\af37\loch\f1 Splunk warrants that for a period of thirty (30) days }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7754262\charrsid8329941 \hich\af1\dbch\af37\loch\f1 from }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1053415\charrsid8329941 \hich\af1\dbch\af37\loch\f1 the}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15020827\charrsid8329941 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5125674\charrsid8329941 \hich\af1\dbch\af37\loch\f1 +Delivery }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2769294\charrsid8329941 \hich\af1\dbch\af37\loch\f1 of}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid8329941 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10289407\charrsid8329941 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16660577\charrsid8329941 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid8329941 \hich\af1\dbch\af37\loch\f1 Purchased Software}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2516418\charrsid8329941 \hich\af1\dbch\af37\loch\f1 will substantially perform the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 \hich\af1\dbch\af37\loch\f1 material function}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2516418\charrsid8329941 \hich\af1\dbch\af37\loch\f1 s}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 \hich\af1\dbch\af37\loch\f1 described in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2516418\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367\charrsid8329941 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2516418\charrsid8329941 \hich\af1\dbch\af37\loch\f1 s user }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 \hich\af1\dbch\af37\loch\f1 documentation for }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6888243\charrsid8329941 \hich\af1\dbch\af37\loch\f1 such}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15688345\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid8329941 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid5315836\charrsid8329941 \hich\af1\dbch\af37\loch\f1 , when used in accordance with the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6888243\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 user }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5315836\charrsid8329941 \hich\af1\dbch\af37\loch\f1 documentation}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 . The sole }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962\charrsid8329941 \hich\af1\dbch\af37\loch\f1 liability}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1859867 \hich\af1\dbch\af37\loch\f1 (and its Affiliates and suppliers/l}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8329941 \hich\af1\dbch\af37\loch\f1 icensors)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3044104\charrsid8329941 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283\charrsid8329941 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367\charrsid8329941 \loch\af1\dbch\af37\hich\f1 \rquote }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283\charrsid8329941 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 sole remedy}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 for any failure of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid8329941 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 \hich\af1\dbch\af37\loch\f1 to conform to th}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962\charrsid8329941 \hich\af1\dbch\af37\loch\f1 e foregoing}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 \hich\af1\dbch\af37\loch\f1 warranty, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 is for Splunk to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962\charrsid8329941 \hich\af1\dbch\af37\loch\f1 do one of the following (at Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367\charrsid8329941 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962\charrsid8329941 \hich\af1\dbch\af37\loch\f1 s sole }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 option and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962\charrsid8329941 \hich\af1\dbch\af37\loch\f1 discretion)}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3044104\charrsid8329941 \hich\af1\dbch\af37\loch\f1 :}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 (a) modify}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1077391\charrsid8329941 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1077391\charrsid8329941 \hich\af1\dbch\af37\loch\f1 or provide an Enhancement for, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 +the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid8329941 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1077391\charrsid8329941 \hich\af1\dbch\af37\loch\f1 so that it}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12190962\charrsid8329941 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 conform}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1077391\charrsid8329941 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 + to the foregoing warranty, (b) replace}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15749283\charrsid8329941 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367\charrsid8329941 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283\charrsid8329941 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 \hich\af1\dbch\af37\loch\f1 + copy of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid8329941 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 with }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962\charrsid8329941 \hich\af1\dbch\af37\loch\f1 +a copy that conforms to the foregoing warranty, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 or (c) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10560090\charrsid8329941 \hich\af1\dbch\af37\loch\f1 terminate the license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1077391\charrsid8329941 \hich\af1\dbch\af37\loch\f1 + with respect to the non-conforming }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid8329941 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1077391\charrsid8329941 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 refund the }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1077391\charrsid8329941 \hich\af1\dbch\af37\loch\f1 License Fees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15933975\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 paid}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7754262\charrsid8329941 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10560090\charrsid8329941 \hich\af1\dbch\af37\loch\f1 by Customer}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13578662\charrsid8329941 \hich\af1\dbch\af37\loch\f1 for}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1077391\charrsid8329941 \hich\af1\dbch\af37\loch\f1 + such }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14815039\charrsid8329941 \hich\af1\dbch\af37\loch\f1 non-conforming }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid8329941 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid8329941 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8329941 {\*\bkmkend _Ref192757662}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid5315836\charrsid8329941 \hich\af1\dbch\af37\loch\f1 All warranty claims must be made by\hich\af1\dbch\af37\loch\f1 written notice}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 from Customer}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5315836\charrsid8329941 \hich\af1\dbch\af37\loch\f1 + to Splunk on or before the expiration of the warranty period}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14230089 \hich\af1\dbch\af37\loch\f1 , as detail}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8154834 \hich\af1\dbch\af37\loch\f1 ed in Section }{\field{\*\fldinst {\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8154834 \hich\af1\dbch\af37\loch\f1 REF _Ref478980383 \\r \\h } +{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8154834 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400370038003900380030003300380033000000}}}{\fldrslt {\rtlch\fcs1 +\ab\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8154834 \hich\af1\dbch\af37\loch\f1 23.2}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 below}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12015742\charrsid8329941 .}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2697273\charrsid8329941 {\*\bkmkend _Ref291499868}{\*\bkmkend _Ref418063975}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14487122\charrsid8329941 +\par {\*\bkmkstart _Ref203558605}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 11.\tab}}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 WARRANTY DISCLAIMER.}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +EXCEPT AS }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12989536 \hich\af1\dbch\af37\loch\f1 EXPRESSLY }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 SET FORTH }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13517435\charrsid11476353 \hich\af1\dbch\af37\loch\f1 IN SECTION }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13517435\charrsid11476353 \hich\af1\dbch\af37\loch\f1 REF _Ref192757662 \\w \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13633411\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +\\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13517435\charrsid11476353 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003100390032003700350037003600360032000000}} +}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 10}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13517435\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ABOVE, }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 THE }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5914897 \hich\af1\dbch\af37\loch\f1 SPLUNK MATERIALS}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14815039 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1797578 \hich\af1\dbch\af37\loch\f1 OPEN SOURCE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid11800748 \hich\af1\dbch\af37\loch\f1 SOFTWARE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1797578 \hich\af1\dbch\af37\loch\f1 , THIRD PARTY CONTENT,}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14815039 \hich\af1\dbch\af37\loch\f1 SUPPORT SERVICES AND PROFESSIONAL SERVICES}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12989536 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10560090 \hich\af1\dbch\af37\loch\f1 ARE PROVIDED }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10560090 \hich\af1\dbch\af37\loch\f1 AS IS}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5914897 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 WITH NO }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 WARRANTIES}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7754262 \hich\af1\dbch\af37\loch\f1 WHATSOEVER}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , EXPRESS OR IMPLIED}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15885607 +\hich\af1\dbch\af37\loch\f1 . TO THE FULL EXTENT PERMITTED BY LAW, SPLUNK }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15879643 \hich\af1\dbch\af37\loch\f1 AND ITS SUPPLIERS AND LICENSORS }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15885607 \hich\af1\dbch\af37\loch\f1 DISCLAIM ALL WARRANTIES}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid95204 \hich\af1\dbch\af37\loch\f1 + OTHER THAN AS EXPRESSLY SET FORTH IN }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid95204\charrsid11476353 \hich\af1\dbch\af37\loch\f1 SECTION }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid95204\charrsid11476353 \hich\af1\dbch\af37\loch\f1 REF _Ref192757662 \\w \\h \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid95204\charrsid11476353 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003100390032003700350037003600360032000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 10}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15885607 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 INCLUDING}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15885607 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7754262 \hich\af1\dbch\af37\loch\f1 ANY}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7754262\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 IMPLIED WARRANT}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10560090 \hich\af1\dbch\af37\loch\f1 IES}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 OF MERCHANTABILITY,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 + SATISFACTORY QUALITY,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10763357 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10560090 \hich\af1\dbch\af37\loch\f1 OR }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10763357 \hich\af1\dbch\af37\loch\f1 QUIET ENJOYMENT}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10560090 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10763357 \hich\af1\dbch\af37\loch\f1 AND }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10560090 \hich\af1\dbch\af37\loch\f1 ANY }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10763357 \hich\af1\dbch\af37\loch\f1 WARRANTIES ARISING OUT OF \hich\af1\dbch\af37\loch\f1 COURSE OF DEALING OR }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7754262 +\hich\af1\dbch\af37\loch\f1 TRADE }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10763357 \hich\af1\dbch\af37\loch\f1 USAGE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14815039 \hich\af1\dbch\af37\loch\f1 WITHOUT LIMITATION OF THE GENERALITY OF THE FOREGOING, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 \hich\af1\dbch\af37\loch\f1 +SPLUNK DOES NOT WARRANT THAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7754262 \hich\af1\dbch\af37\loch\f1 USE OF }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 +\hich\af1\dbch\af37\loch\f1 THE }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15164339 \hich\af1\dbch\af37\loch\f1 SOFTWARE }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 +\hich\af1\dbch\af37\loch\f1 WILL BE UNINTERRUPTED}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7997281 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 +\hich\af1\dbch\af37\loch\f1 ERROR FREE }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7997281 \hich\af1\dbch\af37\loch\f1 OR SECURE, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 +\hich\af1\dbch\af37\loch\f1 OR THAT ALL DEFECTS }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7997281 \hich\af1\dbch\af37\loch\f1 WILL}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10384975 +\hich\af1\dbch\af37\loch\f1 BE CORRECTED.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 {\*\bkmkend _Ref203558605}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid16273706\charrsid16273706 {\*\bkmkstart _Ref203558652} +\par {\*\bkmkstart _Ref291501021}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 12.\tab}}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid1843277 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 LIMITATION OF LIABILITY.}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999404 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277\charrsid1843277 \hich\af1\dbch\af37\loch\f1 TO THE +\hich\af1\dbch\af37\loch\f1 FULL EXTENT PERMITTED BY APPLICABLE LAW AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY OR LIMITATION OF LIABILITY}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1926692 +\hich\af1\dbch\af37\loch\f1 :}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277 \hich\af1\dbch\af37\loch\f1 (A) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 SPLUNK }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3892453 \hich\af1\dbch\af37\loch\f1 AND}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3892453\charrsid3892453 +\hich\af1\dbch\af37\loch\f1 ITS AFFILIATES, SUBSIDIARIES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, PARTNERS}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8005200 \hich\af1\dbch\af37\loch\f1 (INCLUDING AUTHORIZ +\hich\af1\dbch\af37\loch\f1 ED PARTNERS AS DEFINED IN SECTION }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8005200 \hich\af1\dbch\af37\loch\f1 REF _Ref418075667 \\r \\h }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8005200 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000370035003600360037000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8005200 \hich\af1\dbch\af37\loch\f1 21}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8005200 +\hich\af1\dbch\af37\loch\f1 BELOW)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3892453\charrsid3892453 \hich\af1\dbch\af37\loch\f1 AND LICENSORS}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3892453 \hich\af1\dbch\af37\loch\f1 \hich\f1 (THE \'93\loch\f1 \hich\f1 SPLUNK ENTITIES\'94\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681 +\hich\af1\dbch\af37\loch\f1 WILL NOT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277\charrsid11476353 \hich\af1\dbch\af37\loch\f1 BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL OR PUNITIV +\hich\af1\dbch\af37\loch\f1 E DAMAGES}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681 \hich\af1\dbch\af37\loch\f1 (INCLUDING ANY DAMAGES ARISING FROM }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1843277\charrsid11476353 \hich\af1\dbch\af37\loch\f1 LOSS OF USE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277 \hich\af1\dbch\af37\loch\f1 , LOSS OF }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277\charrsid11476353 \hich\af1\dbch\af37\loch\f1 DATA, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277 \hich\af1\dbch\af37\loch\f1 LOST }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277\charrsid11476353 \hich\af1\dbch\af37\loch\f1 PROFITS, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 LOST REVENUE, } +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277\charrsid11476353 \hich\af1\dbch\af37\loch\f1 BUSINESS INTERRUPTION, OR COSTS OF PROCURING SUBSTITUTE }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1843277 \hich\af1\dbch\af37\loch\f1 SOFTWARE OR SERVICES}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1843277\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ARISING OUT OF OR }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1843277 \hich\af1\dbch\af37\loch\f1 +RELATING TO THIS AGREEMENT OR THE SUBJECT MATTER HEREOF; }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681 \hich\af1\dbch\af37\loch\f1 AND}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1843277 \hich\af1\dbch\af37\loch\f1 (B) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 SPLUNK}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3892453 \hich\af1\dbch\af37\loch\f1 ENTITIES}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 TOTAL CUMULATIVE LIABILITY }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999404\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 ARISING OUT OF OR }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999404 \hich\af1\dbch\af37\loch\f1 RELATING TO THIS AGREEMENT OR THE SUBJECT MATTER HEREOF}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15885607 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681 \hich\af1\dbch\af37\loch\f1 WILL NOT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 EXCEED THE AMOUNTS PAID BY }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 CUSTOMER}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 TO SPLUNK}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16466098\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2113601 \hich\af1\dbch\af37\loch\f1 FOR THE }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1859867 +\hich\af1\dbch\af37\loch\f1 PURCHAS}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 ED SOFTWARE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7029516\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 IN THE TWELVE }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3081829 \hich\af1\dbch\af37\loch\f1 (12) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +MONTHS PRIOR TO THE EVEN}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681 \hich\af1\dbch\af37\loch\f1 T GIVING RISE TO SUCH LIABILITY, IN EACH OF THE FOREGOING CASES (A) AND (B), REGARDLESS OF }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681\charrsid11476353 \hich\af1\dbch\af37\loch\f1 WHETHER SUCH LIABILITY ARISES FROM CONTRACT, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681 +\hich\af1\dbch\af37\loch\f1 INDEMNIFICATION, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681\charrsid11476353 \hich\af1\dbch\af37\loch\f1 WARRANTY, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, AND }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681 \hich\af1\dbch\af37\loch\f1 REGARDLESS OF }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16278681\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 WHETHER SPLUNK \hich\af1\dbch\af37\loch\f1 HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 .}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999404 {\*\bkmkend _Ref203558652}{\*\bkmkend _Ref291501021} +\hich\af1\dbch\af37\loch\f1 IN ADDITION, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15885607 \hich\af1\dbch\af37\loch\f1 CUSTOMER, AND NOT SPLUNK, IS SOLELY RESPONSIBLE FOR THE ACCURACY, QUALITY AND SECURITY OF CUSTOMER} +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15885607 \hich\af1\dbch\af37\loch\f1 +S DATA AND FOR MAINTAINING A BACKUP OF ALL SUCH DATA, AND FOR ENSURING THE SECURITY \hich\af1\dbch\af37\loch\f1 AND INTEGRITY OF CUSTOMER}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 +\rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15885607 \hich\af1\dbch\af37\loch\f1 S (AND ITS SERVICE PROVIDER}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 +\loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15885607 \hich\af1\dbch\af37\loch\f1 +S) DATA, COMPUTERS, NETWORKS AND SYSTEMS (INCLUDING WITH RESPECT TO PROTECTING AGAINST VIRUSES AND MALWARE).}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999404 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8289653\charrsid11476353 +\par {\*\bkmkstart _Ref418065685}{\*\bkmkstart _Ref418075546}{\*\bkmkstart _Ref203558672}{\*\bkmkstart _Ref280472428}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid3951647 +\hich\af1\dbch\af37\loch\f1 13.\tab}}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid5797727 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid3951647 \hich\af1\dbch\af37\loch\f1 INDEMNITY}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221 {\*\bkmkend _Ref418065685}\hich\af1\dbch\af37\loch\f1 . }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8598748\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Splunk will defend}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10111315\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9244578\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2381177\charrsid13243221 \hich\af1\dbch\af37\loch\f1 against}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10111315\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2381177\charrsid13243221 \hich\af1\dbch\af37\loch\f1 any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid612038\charrsid13243221 \hich\af1\dbch\af37\loch\f1 +claim, demand, suit or proceeding brought\hich\af1\dbch\af37\loch\f1 against Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9784600\charrsid13243221 \hich\af1\dbch\af37\loch\f1 by a third party alleging that }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9600015\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9784600\charrsid13243221 \hich\af1\dbch\af37\loch\f1 infringes or misappropriates such third party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5991925\charrsid13243221 \hich\af1\dbch\af37\loch\f1 s Intellectual Property Rights}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239\charrsid13243221 \hich\af1\dbch\af37\loch\f1 (}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid2324239\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Claim} +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239\charrsid13243221 \hich\af1\dbch\af37\loch\f1 )}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2381177\charrsid13243221 \hich\af1\dbch\af37\loch\f1 , and Splunk will pay all damages finally awarded against Customer by a court of competent \hich\af1\dbch\af37\loch\f1 +jurisdiction as a result of such Claim}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 , subject to the other terms and conditions of this Agreement}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5991925\charrsid13243221 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Notwithstanding the foregoing, Splunk has no obligation to indemnify }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid16398636\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 + with respect to: (a) use of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 in a manner that is not pe\hich\af1\dbch\af37\loch\f1 rmitted under the Agreement or that is inconsistent with Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 +s applicable user documentation; (b) modifications to the Splunk Materials made by anyone other than Splunk; (c) the combination of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Software} +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 with hardware}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4522545 +\hich\af1\dbch\af37\loch\f1 or}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1926692 \hich\af1\dbch\af37\loch\f1 not made by Splunk, or with third-party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 + services}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1926692 \hich\af1\dbch\af37\loch\f1 , processes}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 or materials where the infringement }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 or misappropriation }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 would not occur but for such combination; (d) Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 +\loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 s continued use of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 + or other allegedly infringing activity aft\hich\af1\dbch\af37\loch\f1 er receiving notice of the alleged infringement; or (e) any version of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 +\hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 that is no longer supported by Splunk ((a) through (e), collectively, }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid15081904 \hich\af1\dbch\af37\loch\f1 +Excluded }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid10188719\charrsid15081904 \hich\af1\dbch\af37\loch\f1 Matters}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 ). If a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 n applicable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 + Claim is made or appears likely to be made, Splunk may\hich\af1\dbch\af37\loch\f1 , at its option and expense, modify the affected }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 +Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 + so that it is noninfringing, or replace it with substantially functionally equivalent software. If Splunk determines that neither is reasonably feasible, Splunk may terminate Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 s ap\hich\af1\dbch\af37\loch\f1 +plicable license and refund Customer a pro rata refund of the Fees previously paid by Customer, which will be calculated using the remainder of the license term (beginning with the date of Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 s receipt of notice of the }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 \hich\af1\dbch\af37\loch\f1 applicable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 Claim), or if the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purc\hich\af1\dbch\af37\loch\f1 hased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 + is licensed under a perpetual license, a refund of Fees previously paid by Customer, less straight-line depreciation on a three-year basis from the Delivery of the applicable Software. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 The obligations set forth in this Section constitute Cus\hich\af1\dbch\af37\loch\f1 tomer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 +\rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 s sole and exclusive remedy, and Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 s entire liability, with respect to any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14616450 \hich\af1\dbch\af37\loch\f1 C}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 laims that the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 infringes any third party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 s Intellectual Property R}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13243221 \hich\af1\dbch\af37\loch\f1 ights. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Customer will defend Splunk against any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 C}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 laim brought against }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10188719\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 by a third party }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10188719\charrsid13243221 \hich\af1\dbch\af37\loch\f1 arising out of or relating to any Excluded Matter or any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Customer Extension}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10188719\charrsid13243221 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10188719\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Customer}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 will pay all damages finally awarded against }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10188719\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 \hich\af1\dbch\af37\loch\f1 + by a court of competent jurisdiction as a result of such }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 \hich\af1\dbch\af37\loch\f1 C}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10188719\charrsid13243221 \hich\af1\dbch\af37\loch\f1 laim}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12124502\charrsid13243221 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Each party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 \hich\af1\dbch\af37\loch\f1 s indemnity obligatio +\hich\af1\dbch\af37\loch\f1 ns set forth in this Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 \hich\af1\dbch\af37\loch\f1 REF _Ref418065685 \\r \\h }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000360035003600380035000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 13}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 \hich\af1\dbch\af37\loch\f1 are}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6500253\charrsid13243221 \hich\af1\dbch\af37\loch\f1 con}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12154564\charrsid13243221 \hich\af1\dbch\af37\loch\f1 ditioned upon}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10884541\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 \hich\af1\dbch\af37\loch\f1 the party seeking indemnification}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10884541\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12154564\charrsid13243221 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 x}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12154564\charrsid13243221 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 providing }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12154564\charrsid13243221 \hich\af1\dbch\af37\loch\f1 +prompt written notice to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13243221\charrsid13243221 \hich\af1\dbch\af37\loch\f1 the other party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12154564\charrsid13243221 \hich\af1\dbch\af37\loch\f1 of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 the applicable}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12154564\charrsid13243221 \hich\af1\dbch\af37\loch\f1 Claim}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10884541\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 ; (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 y}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10884541\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 giving }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 +\hich\af1\dbch\af37\loch\f1 the indemnifying party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid10884541\charrsid13243221 \hich\af1\dbch\af37\loch\f1 sole control}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid470461\charrsid13243221 \hich\af1\dbch\af37\loch\f1 of the de +\hich\af1\dbch\af37\loch\f1 fense and/or settlement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9713597\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid204601\charrsid13243221 \hich\af1\dbch\af37\loch\f1 of the Claim}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid470461\charrsid13243221 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9134362\charrsid13243221 \hich\af1\dbch\af37\loch\f1 except that}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7235327\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 :}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3951647\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7866006\charrsid13243221 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4875164\charrsid13243221 \hich\af1\dbch\af37\loch\f1 i}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7866006\charrsid13243221 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 the indemnified party}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9134362\charrsid13243221 \hich\af1\dbch\af37\loch\f1 may participate in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9134362\charrsid13243221 \hich\af1\dbch\af37\loch\f1 defense with counsel of its choice at }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 its own }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9134362\charrsid13243221 \hich\af1\dbch\af37\loch\f1 expense}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid204601\charrsid13243221 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8609611\charrsid13243221 \hich\af1\dbch\af37\loch\f1 and}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7866006\charrsid13243221 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4875164\charrsid13243221 \hich\af1\dbch\af37\loch\f1 ii}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7866006\charrsid13243221 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 the indemnifying party}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid609701\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7942271\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid609701\charrsid13243221 \hich\af1\dbch\af37\loch\f1 not agree to any settlement that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 imposes a material obligation on }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 +the indemnified party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid609701\charrsid13243221 \hich\af1\dbch\af37\loch\f1 without }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 +\hich\af1\dbch\af37\loch\f1 the indemnified party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 s prior written consent (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid609701\charrsid13243221 \hich\af1\dbch\af37\loch\f1 not }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 to be }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid609701\charrsid13243221 \hich\af1\dbch\af37\loch\f1 +unreasonably withh}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 eld}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid609701\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 or delay}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 ed}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid609701\charrsid13243221 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7235327\charrsid13243221 \hich\af1\dbch\af37\loch\f1 and}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid609701\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9134362\charrsid13243221 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14616450 \hich\af1\dbch\af37\loch\f1 z}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9134362\charrsid13243221 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid204601\charrsid13243221 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2769074\charrsid13243221 \hich\af1\dbch\af37\loch\f1 providing }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15032103\charrsid13243221 +\hich\af1\dbch\af37\loch\f1 reasonable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10625761\charrsid13243221 \hich\af1\dbch\af37\loch\f1 cooperation and assistance}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14558645\charrsid13243221 \hich\af1\dbch\af37\loch\f1 in the defense and negotiations}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15032103\charrsid13243221 .}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid13243221 {\*\bkmkend _Ref418075546}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8289653\charrsid3681376 {\*\bkmkend _Ref203558672} +{\*\bkmkend _Ref280472428} +\par {\*\bkmkstart _Ref291501055}{\listtext\pard\plain\ltrpar \s37 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\fs18\cf1\loch\af1\hich\af1\dbch\af4\ulc1\insrsid8673657\charrsid12995408 \hich\af1\dbch\af4\loch\f1 14.\tab}}\pard\plain \ltrpar +\s37\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid8673657 \rtlch\fcs1 \af0\afs24\alang1025 \ltrch\fcs0 +\fs22\cf1\lang1033\langfe1033\loch\af41\hich\af41\dbch\af4\cgrid\langnp1033\langfenp1033\ulc1 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid8673657\charrsid12995408 \hich\af1\dbch\af4\loch\f1 CONFIDENTIAL INFORMATION.}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \b\f1\fs18\insrsid1395281 {\*\bkmkend _Ref291501055}\hich\af1\dbch\af4\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid8673657\charrsid12995408 +\par {\*\bkmkstart _Ref280473218}{\listtext\pard\plain\ltrpar \s37 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\fs18\cf1\loch\af1\hich\af1\dbch\af4\ulc1\insrsid8673657\charrsid12995408 \hich\af1\dbch\af4\loch\f1 14.1\tab}}\pard \ltrpar +\s37\qj \fi360\li360\ri0\sa240\sl276\slmult1\widctlpar\tx990\wrapdefault\aspalpha\aspnum\faauto\ls3\ilvl1\adjustright\rin0\lin360\itap0\pararsid14616450 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid8673657\charrsid12995408 +\hich\af1\dbch\af4\loch\f1 Confidential Information}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid12995408 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af4\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af4\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid8673657\charrsid12995408 \hich\af1\dbch\af4\loch\f1 Confidential Information}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9927413 \loch\af1\dbch\af4\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid12995408 \hich\af1\dbch\af4\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 +means any technical or business information, ideas, materials, know-how or other subject matter that is disclosed by one party to the other party that: (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid1395281\charrsid14616450 \hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 ) if disclosed in writing, is marked }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 +\hich\af1\dbch\af37\loch\f1 confidential}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 or }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 proprietary}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 +\hich\af1\dbch\af37\loch\f1 at the time of such disclosure; (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid1395281\charrsid14616450 \hich\af1\dbch\af37\loch\f1 b}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 ) if disclosed orally, is identified as }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 +\hich\af1\dbch\af37\loch\f1 confidential}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 or }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 proprietary}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 +\hich\af1\dbch\af37\loch\f1 at the time of such disclosure, and is summarized in a writing sent by the disclo\hich\af1\dbch\af37\loch\f1 sing party to the receiving party within thirty (30) days after any such disclosure; or (}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid1395281\charrsid14616450 \hich\af1\dbch\af37\loch\f1 c}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 ) under the circumstances, a person exercising reasonable business judgment would understand to be confidential or proprietary}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid1395281\charrsid14616450 \hich\af1\dbch\af37\loch\f1 . Confidential Information}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 of Splunk }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid7942271\charrsid14616450 \hich\af1\dbch\af37\loch\f1 wil\hich\af1\dbch\af37\loch\f1 l}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 include the Splunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid15162976\charrsid14616450 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid5797727 +\hich\af1\dbch\af37\loch\f1 (including}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid2564266\charrsid14616450 \hich\af1\dbch\af37\loch\f1 any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid8673657\charrsid14616450 \hich\af1\dbch\af37\loch\f1 license keys}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid5797727 +\hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\cf0\lang9\langfe1033\loch\af1\hich\af1\dbch\af37\langnp9\insrsid2564266\charrsid14616450 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid1598766 {\*\bkmkstart _Ref364669092} +{\*\bkmkend _Ref280473218} +\par {\listtext\pard\plain\ltrpar \s37 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\fs18\cf1\loch\af1\hich\af1\dbch\af4\ulc1\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 14.2\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Use and Disclosure Restrictions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12091159\charrsid1598766 \hich\af1\dbch\af4\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14616450 \hich\af1\dbch\af4\loch\f1 T}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 he party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3081829\charrsid1598766 \hich\af1\dbch\af4\loch\f1 receiving }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 +Confidential Information (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af4\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Recipient}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af4\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 ) agrees: (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4875164\charrsid1598766 \hich\af1\dbch\af4\loch\f1 a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 +) to maintain the Confidential Information of the party disclosing such information (the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af4\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Discloser}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af4\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 ) in strict confidence; (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4875164\charrsid1598766 \hich\af1\dbch\af4\loch\f1 b}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 ) not to disclose such Confidential Information to any third parties; and (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4875164\charrsid1598766 \hich\af1\dbch\af4\loch\f1 c}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6233723\charrsid1598766 \~}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 +not to use any such Confidential Information for any purpose other than }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4288419\charrsid1598766 \hich\af1\dbch\af4\loch\f1 to exercise its rights or perform its obligations under this}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Agreement.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159\charrsid1598766 \hich\af1\dbch\af4\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 +Recipient will treat Confidential Information of the Discloser with the same degree of care as it accords to its own Confidential Information, but in no event with less than reasonable care. Recipient may disclose the Confidential Information o +\hich\af1\dbch\af4\loch\f1 f Discloser to its directors, officers, employees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12730182 \hich\af1\dbch\af4\loch\f1 , and subcontractors}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 (collectively, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af4\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Representatives}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af4\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1395281 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 + who have a bona fide need to know such Confidential Information, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid7149780 \hich\af1\dbch\af4\loch\f1 provided}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 that each such Representative }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7149780 \hich\af1\dbch\af4\loch\f1 is}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2564266\charrsid1598766 \hich\af1\dbch\af4\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 bound by a }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9840708\charrsid1598766 \hich\af1\dbch\af4\loch\f1 legal obligation}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 as protective of\hich\af1\dbch\af4\loch\f1 the other party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af4\hich\f1 \rquote }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 s Confidential Information as those set forth herein.{\*\bkmkend _Ref364669092} }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14616450 +\hich\af1\dbch\af4\loch\f1 Recipient}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af4\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14616450 \hich\af1\dbch\af4\loch\f1 s obligations under this Section } +{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14616450 \hich\af1\dbch\af4\loch\f1 REF _Ref291501055 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14616450 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003500300031003000350035000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af4\loch\f1 14}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14616450 \hich\af1\dbch\af4\loch\f1 will continue in effect for a period of}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid14616450\charrsid1598766 \hich\af1\dbch\af4\loch\f1 three (3) years from the date of last disclosure of Confidential Information by }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14616450 \hich\af1\dbch\af4\loch\f1 Discloser}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2503503 \hich\af1\dbch\af4\loch\f1 , except that Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af4\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2503503 \hich\af1\dbch\af4\loch\f1 s obligations under this Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2503503 \hich\af1\dbch\af4\loch\f1 REF _\hich\af1\dbch\af4\loch\f1 Ref291501055 \\r \\h }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2503503 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003500300031003000350035000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9896659 \hich\af1\dbch\af4\loch\f1 14}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2503503 \hich\af1\dbch\af4\loch\f1 + will continue in effect in perpetuity with respect to Splunk Materials. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid1598766 +\par {\listtext\pard\plain\ltrpar \s37 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\fs18\cf1\loch\af1\hich\af1\dbch\af4\ulc1\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 14.3\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Exclusions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 . The obligations of Recipient under Section }{\field{\*\fldinst { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3081829\charrsid1598766 \hich\af1\dbch\af4\loch\f1 REF _Ref364669092 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14222922\charrsid1598766 \hich\af1\dbch\af4\loch\f1 \\* MERGEFORMAT }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3081829\charrsid1598766 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003300360034003600360039003000390032000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9896659 \hich\af1\dbch\af4\loch\f1 14.1}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271\charrsid1598766 \hich\af1\dbch\af4\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 not apply to any Confidential Information }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2503503 \hich\af1\dbch\af4\loch\f1 that}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 :}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 +(a) is now or thereafter becomes generally known or available to the public, through no act or omission on the par\hich\af1\dbch\af4\loch\f1 t of Recipient (or any of its Representatives, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2324239 +\hich\af1\dbch\af4\loch\f1 A}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 +ffiliates, or agents) or any third party subject to any use or disclosure restrictions with respect to such Confidential Information; (b)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6233723\charrsid1598766 \~}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 was known by or lawfully in the possession of Recipient, prior to rece\hich\af1\dbch\af4\loch\f1 +iving such information from Discloser, without restriction as to use or disclosure; (c) is rightfully acquired by }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6233723\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Recipient }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 from a third party who has the right to disclose it and who provides it without restriction as to use or disclosure; or (d) is indep\hich\af1\dbch\af4\loch\f1 +endently developed by Recipient without access}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9330256\charrsid1598766 \hich\af1\dbch\af4\loch\f1 , use or reference}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 to any Confidential Information of Discloser.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159\charrsid1598766 \hich\af1\dbch\af4\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid1598766 +\par {\listtext\pard\plain\ltrpar \s37 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\fs18\cf1\loch\af1\hich\af1\dbch\af4\ulc1\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 14.4\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Required Disclosures}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 The provisions of Section\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3081829\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 REF _Ref364669092 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14222922\charrsid1598766 \hich\af1\dbch\af4\loch\f1 \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3081829\charrsid1598766 +{\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003300360034003600360039003000390032000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af4\loch\f1 14.1}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13176864\charrsid1598766 \hich\af1\dbch\af4\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 will not restrict Recipient from disclosing Discloser}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af4\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 +\hich\af1\dbch\af4\loch\f1 s Confidential Information to the extent required by any law or regulation or compelled by a court or administrative agency of competent \hich\af1\dbch\af4\loch\f1 jurisdiction}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid7667898\charrsid1598766 \hich\af1\dbch\af4\loch\f1 +, provided that, to the extent permissible under law, Recipient uses reasonable efforts to give Discloser advance notice of such required disclosure in order to enable Discloser to prevent or limit disclosure.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\insrsid1598766 {\*\bkmkstart _Ref280370643} +\par {\listtext\pard\plain\ltrpar \s37 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\fs18\cf1\loch\af1\hich\af1\dbch\af4\ulc1\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 14.5\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Return or Destruction of \hich\af1\dbch\af4\loch\f1 Confidential Information.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid12091159\charrsid1598766 \hich\af1\dbch\af4\loch\f1 } +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 Upon termination of the Agreement or support and maintenance, Recipient wi}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 +\hich\af1\dbch\af4\loch\f1 ll promptly return to Discloser}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 or}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 ,}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 at Discloser}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af4\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 s option, destroy all tangible items and embodiments containing or consisting of Discloser}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af4\hich\f1 \rquote }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8673657\charrsid1598766 \hich\af1\dbch\af4\loch\f1 s Confidential I\hich\af1\dbch\af4\loch\f1 +nformation and all copies thereof and provide written certification of such destruction or return by an authorized person.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid8673657\charrsid2503503 {\*\bkmkend _Ref280370643} +\par {\listtext\pard\plain\ltrpar \s37 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\fs18\cf1\loch\af1\hich\af1\dbch\af4\ulc1\insrsid2503503 \hich\af1\dbch\af4\loch\f1 14.6\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid2503503 \hich\af1\dbch\af4\loch\f1 +Injunctive Relief. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144\charrsid16333144 \hich\af1\dbch\af4\loch\f1 Recipient agrees that, due to the unique nature of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 +\hich\af1\dbch\af4\loch\f1 Confidential}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144\charrsid16333144 \hich\af1\dbch\af4\loch\f1 Information, the unauthorized disclosure or us\hich\af1\dbch\af4\loch\f1 e of the }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid16333144 \hich\af1\dbch\af4\loch\f1 Confidential}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144\charrsid16333144 \hich\af1\dbch\af4\loch\f1 + Information will cause irreparable harm and significant injury to Discloser, the extent of which will be difficult to ascertain and for which there will be no adequate remedy at law. Accordingly, Recipient agrees that Discloser, in ad +\hich\af1\dbch\af4\loch\f1 dition to any other available remedies, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 \hich\af1\dbch\af4\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144\charrsid16333144 +\hich\af1\dbch\af4\loch\f1 have the right to an immediate injunction and other equitable relief enjoining any breach or threatened breach of this }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 \hich\af1\dbch\af4\loch\f1 Section } +{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 \hich\af1\dbch\af4\loch\f1 REF _Ref291501055 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003500300031003000350035000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af4\loch\f1 14}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144\charrsid16333144 \hich\af1\dbch\af4\loch\f1 , without the necessity of posting any bond or other security. Recipient }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 \hich\af1\dbch\af4\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144\charrsid16333144 \hich\af1\dbch\af4\loch\f1 notify Discloser in writing immediately upon Recipient}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af4\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144\charrsid16333144 \hich\af1\dbch\af4\loch\f1 +s becoming aware of any such breach or threatened breach}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid2503503\charrsid1598766 +\par {\*\bkmkstart _Ref291500928}{\*\bkmkstart _Ref203555325}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 15.\tab}}\pard\plain \ltrpar +\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid945876 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 TERM.}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 This Agreement will }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6889448 \hich\af1\dbch\af37\loch\f1 commence upon }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16333144 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16333144 \hich\af1\dbch\af37\loch\f1 s }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid347097 \hich\af1\dbch\af37\loch\f1 first \hich\af1\dbch\af37\loch\f1 delivery}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16333144 \hich\af1\dbch\af37\loch\f1 + of the Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6889448 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid19617 \hich\af1\dbch\af37\loch\f1 specified }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid347097 \hich\af1\dbch\af37\loch\f1 in the Order }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4331811 \hich\af1\dbch\af37\loch\f1 (or, Splunk +\hich\f1 \rquote \loch\f1 s other initial delivery of the Software to Customer) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6889448 \hich\af1\dbch\af37\loch\f1 and will remain}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 in effect }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6889448 \hich\af1\dbch\af37\loch\f1 until the expira}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 tion of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6965042 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10228178 \hich\af1\dbch\af37\loch\f1 Software }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 license t}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6889448 \hich\af1\dbch\af37\loch\f1 erm}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 unless earli}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 er terminated pursuant to Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 + REF _Ref279994107 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200370039003900390034003100300037000000}}}{\fldrslt { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 16}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 (the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ).}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 {\*\bkmkend _Ref291500928}\hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid10228178 \hich\af1\dbch\af37\loch\f1 For the avoidance of doubt, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2033692 \hich\af1\dbch\af37\loch\f1 +termination of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9139365 \hich\af1\dbch\af37\loch\f1 a license term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2033692 +\hich\af1\dbch\af37\loch\f1 shall not affect the term of any other license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9139365 \hich\af1\dbch\af37\loch\f1 s applicable to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid621719 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2033692 \hich\af1\dbch\af37\loch\f1 other Splunk products and \hich\af1\dbch\af37\loch\f1 services}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9139365 \hich\af1\dbch\af37\loch\f1 that Customer has purchased}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2033692 .}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6911381 \hich\af1\dbch\af37\loch\f1 Fur}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid353871 \hich\af1\dbch\af37\loch\f1 ther, termination of a Content S}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6911381 \hich\af1\dbch\af37\loch\f1 ubscription shall not affect the term of the base license applicable to the Software that Customer has purchased.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid945876\charrsid7218431 +\par {\*\bkmkstart _Ref280369880}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 15.1\tab}}\pard \ltrpar\qj \fi-630\li990\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\ilvl1\adjustright\rin0\lin990\itap0\pararsid4875164 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid8672582 \hich\af1\dbch\af37\loch\f1 , etc}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid945876 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 Unless otherwise indicated in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid19617 +\hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 Order, the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 for }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 +\hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 Free Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 \hich\af1\dbch\af37\loch\f1 +, Splunk Extensions and Splunk Developer Tools}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8391001 \hich\af1\dbch\af37\loch\f1 , if applicable, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 will }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 continue indefinitely, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 unless}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 and until }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 terminated pursuant to Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 REF _Ref279994107 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200370039003900390034003100300037000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 16}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 . If }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid19617 \hich\af1\dbch\af37\loch\f1 the }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 Order }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 indicates a }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 +\hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 of a specific duration for any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16333144 \hich\af1\dbch\af37\loch\f1 +of the foregoing}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 licenses granted to Customer for such }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 or Free Software will terminate automatically upon expiration of such }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid945876\charrsid13519154 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 Upon }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 expiration of any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 +\hich\af1\dbch\af37\loch\f1 , the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6889448 \hich\af1\dbch\af37\loch\f1 applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 will stop working automatically.{\*\bkmkend _Ref280369880} +\par {\*\bkmkstart _Ref280369891}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid945876\charrsid7218431 \hich\af1\dbch\af37\loch\f1 15.2\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid945876\charrsid7218431 +\hich\af1\dbch\af37\loch\f1 Evaluation Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 If Customer is granted a license }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid347097 \hich\af1\dbch\af37\loch\f1 for Evaluation Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 +\hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 then the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 +\hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9464847 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid347097 +\hich\af1\dbch\af37\loch\f1 for such Evaluation Software }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid8343654 \hich\af1\dbch\af37\loch\f1 will be specified in the Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15933975 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid8343654 \hich\af1\dbch\af37\loch\f1 or with the license +\hich\af1\dbch\af37\loch\f1 key.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 +\hich\af1\dbch\af37\loch\f1 If no such term is specified, the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid347097 \hich\af1\dbch\af37\loch\f1 for Evaluation Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 is thirty (30) days from }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9255140 \hich\af1\dbch\af37\loch\f1 the date the license key is delivered}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 .}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid1859867 \hich\af1\dbch\af37\loch\f1 Any license keys provided for }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid347097\charrsid1859867 \hich\af1\dbch\af37\loch\f1 Evaluation Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7765876\charrsid1859867 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid1859867 \hich\af1\dbch\af37\loch\f1 will automatically expire and cause the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid5259472\charrsid1859867 \hich\af1\dbch\af37\loch\f1 Evaluation }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid1859867 \hich\af1\dbch\af37\loch\f1 +Software to become non-operational at the end of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613\charrsid1859867 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid1859867 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid1859867 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid1859867 \hich\af1\dbch\af37\loch\f1 If Customer wishes to use the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5259472\charrsid1859867 \hich\af1\dbch\af37\loch\f1 +Evaluation }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid1859867 \hich\af1\dbch\af37\loch\f1 S}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid8343654 +\hich\af1\dbch\af37\loch\f1 oftware after the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid8343654 \hich\af1\dbch\af37\loch\f1 expires, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid347097 \hich\af1\dbch\af37\loch\f1 then }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid8343654 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 must}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid8343654 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid347097 \hich\af1\dbch\af37\loch\f1 obtain}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid8343654 \hich\af1\dbch\af37\loch\f1 the applicable }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid347097 \hich\af1\dbch\af37\loch\f1 paid }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid8343654 \hich\af1\dbch\af37\loch\f1 license.}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14837237 {\*\bkmkend _Ref280369891}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid945876\charrsid7218431 +\par {\*\bkmkstart _Ref279994107}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 16.\tab}}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid5776441 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 TERMINATION.}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 Either party}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 may terminate this Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 + by written notice to the other party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5259472 +\hich\af1\dbch\af37\loch\f1 if}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 +\hich\af1\dbch\af37\loch\f1 the other party}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8672582 \hich\af1\dbch\af37\loch\f1 materially }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 breach}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 es}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 this Agreement and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8672582 \hich\af1\dbch\af37\loch\f1 does}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 not cure the breach }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 +within thirty (30) days of receiving }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 written }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 +\hich\af1\dbch\af37\loch\f1 notice of the breach}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 pursuant to Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 REF _Ref478980383 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400370038003900380030003300380033000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 23.2}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 below}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 In addition}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5259472 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 + may immediately terminate this Agreement (in whole or in part, including with respect to any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 ) by written notice to Customer (a) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5259472 \hich\af1\dbch\af37\loch\f1 if Customer }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 material}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5259472 \hich\af1\dbch\af37\loch\f1 ly}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 breach}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5259472 \hich\af1\dbch\af37\loch\f1 es}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 Section } +{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 REF _Ref418068232 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 +{\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000360038003200330032000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 3 +}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 , and (b) as set forth in Section }{\field{\*\fldinst { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 REF _Ref280375279 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380030003300370035003200370039000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 6}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876\charrsid7218431 \hich\af1\dbch\af37\loch\f1 Splunk may }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 also }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16327572 \hich\af1\dbch\af37\loch\f1 terminate \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid16327572 \hich\af1\dbch\af37\loch\f1 s }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876\charrsid7218431 \hich\af1\dbch\af37\loch\f1 license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 +\hich\af1\dbch\af37\loch\f1 to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16327572 \hich\af1\dbch\af37\loch\f1 any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 \hich\af1\dbch\af37\loch\f1 Evaluation }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876\charrsid7218431 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8596824 +\hich\af1\dbch\af37\loch\f1 at any time with}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16327572 \hich\af1\dbch\af37\loch\f1 or without cause by}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876\charrsid7218431 +\hich\af1\dbch\af37\loch\f1 notice to Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 If }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 \hich\af1\dbch\af37\loch\f1 Customer is}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3813645 \hich\af1\dbch\af37\loch\f1 the Government}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3813645 \hich\af1\dbch\af37\loch\f1 then }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 termination terms and conditions }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 be governed by 48 C.F.R. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876 +\loch\af1\dbch\af37\hich\f1 \'a7\~}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 52.212-4.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Upon any expiration or termination of this Agreement, the rights and licenses granted }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid16327572 \hich\af1\dbch\af37\loch\f1 to Customer }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +hereunder will automatically terminate, and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 agree}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1400857 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 to cease }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1400857\charrsid11476353 \hich\af1\dbch\af37\loch\f1 immediately }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 using the Splunk Materials and to return or destroy all copies of the Splunk \hich\af1\dbch\af37\loch\f1 +Materials and other Splunk }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 C}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 onfidential }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 I}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 nformation in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 possession or control}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11620541 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 and certify in writing the completion of such return or destruction}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 +\hich\af1\dbch\af37\loch\f1 in accordance with Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 REF _Ref280370643 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380030003300370030003600340033000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 14.4}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2513994 \hich\af1\dbch\af37\loch\f1 Upon}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + termination of this Agreement, Splunk will have no obligation to refund any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 Fees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2513994 \hich\af1\dbch\af37\loch\f1 or other amounts}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid11476353 \hich\af1\dbch\af37\loch\f1 received from }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876 \hich\af1\dbch\af37\loch\f1 Customer during the Term}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12987900 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4466969 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13121505 \hich\af1\dbch\af37\loch\f1 notwithsta}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4522545 \hich\af1\dbch\af37\loch\f1 nd}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13121505 \hich\af1\dbch\af37\loch\f1 ing any early}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4466969 \hich\af1\dbch\af37\loch\f1 termination }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2950394 \hich\af1\dbch\af37\loch\f1 above}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13121505 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid4466969 \hich\af1\dbch\af37\loch\f1 Customer }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13121505 \hich\af1\dbch\af37\loch\f1 shall still be required}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid21172 \hich\af1\dbch\af37\loch\f1 to pay all F}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4466969 \hich\af1\dbch\af37\loch\f1 ees payable under an Order}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2950394 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \i\f1\fs18\lang9\langfe1033\langnp9\insrsid2950394\charrsid1727288 \hich\af1\dbch\af37\loch\f1 i.e.,}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2950394 \hich\af1\dbch\af37\loch\f1 no}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1665187 \hich\af1\dbch\af37\loch\f1 such}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2950394 \hich\af1\dbch\af37\loch\f1 early termination shall relieve Customer of its obligations to pay all Fees payable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1665187 \hich\af1\dbch\af37\loch\f1 under an Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2950394 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12987900 \hich\af1\dbch\af37\loch\f1 unless otherwise }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12987900\charrsid3892541 \hich\af1\dbch\af37\loch\f1 provided in this Agreement}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11414789\charrsid3892541 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159\charrsid3892541 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 +\hich\af1\dbch\af37\loch\f1 Termination of Support\hich\af1\dbch\af37\loch\f1 and Maintenance Terms and Conditions due to Splunk\hich\f1 \rquote \loch\f1 s breach is provided in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 REF _Ref292348096 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390032003300340038003000390036000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 3.2}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\ul\insrsid1859867\charrsid1859867 +\hich\af1\dbch\af37\loch\f1 Exhibit C}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 REF _Ref280370660 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2513994\charrsid3892541 \hich\af1\dbch\af37\loch\f1 \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380030003300370030003600360030000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 1}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (Definitions), Section }{\field{\*\fldinst { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 REF _Ref203558538 \\w \\h \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200300033003500350038003500330038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 5}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (Ownership), Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 REF _Ref203558592 \\w \\h \\* MERGEFO\hich\af1\dbch\af37\loch\f1 RMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200300033003500350038003500390032000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 9}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (Software Verification and Audit), Section } +{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 REF _Ref203558605 \\w \\h \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200300033003500350038003600300035000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 11}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (Warranty Disclaimer), Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 REF _Ref291501021 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2513994\charrsid3892541 \hich\af1\dbch\af37\loch\f1 \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003500300031003000320031000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 12}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (Limitation of Liability), Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 REF _Ref20355\hich\af1\dbch\af37\loch\f1 8672 \\w \\h \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200300033003500350038003600370032000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 13}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (Indemnity), }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 \hich\af1\dbch\af37\loch\f1 Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 REF _Ref291501055 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2513994\charrsid3892541 \hich\af1\dbch\af37\loch\f1 \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003500300031003000350035000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 14}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (Confidentiality), }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 Section } +{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 REF _Ref279994107 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2513994\charrsid3892541 \hich\af1\dbch\af37\loch\f1 \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200370039003900390034003100300037000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 16}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (Termination) and Sections}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 } +{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3892541 \hich\af1\dbch\af37\loch\f1 REF _Ref292096586 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3892541 +{\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390032003000390036003500380036000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 +17}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3892541 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid1926692\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 Export}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 ) through }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 REF _Ref291501104 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2513994\charrsid3892541 \hich\af1\dbch\af37\loch\f1 \\* MERGEFORMAT }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003500300031003100300034000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 23}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 (General}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid3892541 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7942271\charrsid3892541 \hich\af1\dbch\af37\loch\f1 will}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid945876\charrsid3892541 \hich\af1\dbch\af37\loch\f1 survive any expiration or termination of this Agreement.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid3892541 {\*\bkmkend _Ref279994107}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid95977\charrsid3892541 {\*\bkmkend _Ref203555325} +\par {\*\bkmkstart _Ref292096586}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 17.\tab}}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 EXPORT.}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 will comply fully with all relevant export laws and regulations of the United States and any other country (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Export Laws}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) where }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 use}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11828462 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7027006\charrsid11476353 \hich\af1\dbch\af37\loch\f1 of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691420\charrsid11476353 \hich\af1\dbch\af37\loch\f1 S}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8939863\charrsid11476353 \hich\af1\dbch\af37\loch\f1 plunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11828462 \hich\af1\dbch\af37\loch\f1 certifies}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3416406 \hich\af1\dbch\af37\loch\f1 Customer is}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + not on any of the relevant U.S. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3813645 \hich\af1\dbch\af37\loch\f1 g}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 overnment }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3813645 \hich\af1\dbch\af37\loch\f1 l}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ists of prohibited persons, including the Treasury Department}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 s List of}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3813645 \hich\af1\dbch\af37\loch\f1 Specially Designated Nationals}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 and the Commerce Department}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 s List of Denied Persons or Entity List.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11828462 \hich\af1\dbch\af37\loch\f1 + further certifies}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 not export, re-export, ship, transfer or otherwise use the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8939863\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 in any country subject to an embargo or other sanction by the United States, including}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Iran, Syria, Cuba, Sudan and North Korea and that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Custo +\hich\af1\dbch\af37\loch\f1 mer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 not use the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8939863\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk Materials}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid2691138\charrsid11476353 \hich\af1\dbch\af37\loch\f1 for any purpose prohibited by the Export Laws, including, but not limited to, nuclear, chemical, missile or biological weapons related end uses.}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8289653 {\*\bkmkend _Ref292096586} +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 18.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 GOVERNMENT END USER RIGHTS}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15486501\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 acknowledge}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2832898 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 that all Splunk Materia\hich\af1\dbch\af37\loch\f1 ls were developed entirely at private expense and that no part of the Splunk Materials w}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14222922 \hich\af1\dbch\af37\loch\f1 as}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + first produced in the performance of a }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9060416 \hich\af1\dbch\af37\loch\f1 g}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 overnment contract.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 agree}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid2832898 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + that all Splunk Materials and any derivatives thereof are }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14222922 \hich\af1\dbch\af37\loch\f1 C}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ommercial }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14222922 \hich\af1\dbch\af37\loch\f1 I}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 tems}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 as defined in 48 C.F.R. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13176864 \loch\af1\dbch\af37\hich\f1 \'a7\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 2.101, and if }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3416406 \hich\af1\dbch\af37\loch\f1 Customer is}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3813645 \hich\af1\dbch\af37\loch\f1 the Government}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1712392 \hich\af1\dbch\af37\loch\f1 , then }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 such}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\delrsid15814846\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 \hich\f1 use, duplication, reproduction, release, modification, disclosure or transfer of this commercial product and data, is restricted in accordance with 48 C.F.R. \'a7}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13176864 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 12.211, 48 C.F.R.\hich\af1\dbch\af37\loch\f1 \hich\f1 \'a7}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13176864 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 \hich\f1 12.212, 48 C.F.R. \'a7}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid13176864 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 \hich\f1 227.7102-2, and 48 C.F.R. \'a7}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13176864 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 227.7202, as applicable.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 \hich\f1 Consistent with 48 C.F.R. \'a7}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13176864 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 \hich\f1 12.211, 48 C.F.R. \'a7}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13176864 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 \hich\f1 12.212, 48 C.F.R. \'a7}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13176864 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 \hich\f1 227.7102-1 through 48 C.F.R. \'a7}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13176864 \~}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 \hich\f1 227.7102-3, and 48 C.F.R. \'a7\'a7}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13176864 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 227.7202-1 through 227.7202-4, as applicable, the Sp\hich\af1\dbch\af37\loch\f1 lunk Materials are licensed to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3813645 \hich\af1\dbch\af37\loch\f1 G}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 overnment end users (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4875164 +\hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) only as Commercial Items and (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4875164 +\hich\af1\dbch\af37\loch\f1 b}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +) with only those rights as are granted to all other users pursuant to this Agreement and any related agreement(s), as applicable.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Accordingly, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 will have no rig\hich\af1\dbch\af37\loch\f1 hts in the Splunk Materials except as expressly agreed to in writing by }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15749283 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15486501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 and Splunk.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12585441\charrsid11476353 \~}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8289653\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid10494223 \hich\af1\dbch\af37\loch\f1 19.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid10494223 \hich\af1\dbch\af37\loch\f1 PUBLICITY.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid10494223 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid10494223 +\hich\af1\dbch\af37\loch\f1 agree}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11828462\charrsid10494223 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid10494223 \hich\af1\dbch\af37\loch\f1 that Splunk may }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11798975\charrsid10494223 \hich\af1\dbch\af37\loch\f1 +publish a brief description }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5259472\charrsid10494223 \hich\af1\dbch\af37\loch\f1 describing }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15749283\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367\charrsid10494223 \loch\af1\dbch\af37\hich\f1 \rquote }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283\charrsid10494223 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11798975\charrsid10494223 +\hich\af1\dbch\af37\loch\f1 deployment of the Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15095098\charrsid10494223 \hich\af1\dbch\af37\loch\f1 and}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid11798975\charrsid10494223 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid10494223 \hich\af1\dbch\af37\loch\f1 identify }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid10494223 +\hich\af1\dbch\af37\loch\f1 as a Splunk customer on }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12795743\charrsid10494223 \hich\af1\dbch\af37\loch\f1 any of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8133367\charrsid10494223 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12795743\charrsid10494223 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid10494223 \hich\af1\dbch\af37\loch\f1 + websites, client lists, press releases, and/or other marketing}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11798975\charrsid10494223 \hich\af1\dbch\af37\loch\f1 materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid10494223 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8289653\charrsid10494223 +\par {\*\bkmkstart _Ref418075629}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 20.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 THIRD PARTY CONTENT DISCLAIMER.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15095098 \hich\af1\dbch\af37\loch\f1 Certain }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Extensions and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8010418 \hich\af1\dbch\af37\loch\f1 other materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5259472 +\hich\af1\dbch\af37\loch\f1 available for download}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 on }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2832898 \hich\af1\dbch\af37\loch\f1 Splunkbase }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 are }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4287477 \hich\af1\dbch\af37\loch\f1 developed}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4524417 \hich\af1\dbch\af37\loch\f1 and}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15095098 \hich\af1\dbch\af37\loch\f1 /or}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4524417 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15095098 \hich\af1\dbch\af37\loch\f1 provided }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 \hich\af1\dbch\af37\loch\f1 by \hich\af1\dbch\af37\loch\f1 +third parties}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8396734 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8396734\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid8396734\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Third-Party Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8396734\charrsid11476353 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15095098 \hich\af1\dbch\af37\loch\f1 +Splunk makes such Third-Party Content available for download on Splunkbase as a convenience to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8010418 \hich\af1\dbch\af37\loch\f1 its customers}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15095098 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 but Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 neither control}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 +\hich\af1\dbch\af37\loch\f1 nor endorse}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 , nor }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 is Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 responsible for, any Third-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 +\hich\af1\dbch\af37\loch\f1 , including\hich\af1\dbch\af37\loch\f1 the accuracy, integrity, quality, legality}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 , usefulness or safety of Third-}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 +\hich\af1\dbch\af37\loch\f1 . Certain Third-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 may, among other things, be inaccurate, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 +nonfunctional, infringing or dangerous}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 . Nothing in this Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 +\hich\af1\dbch\af37\loch\f1 or on Splunkbase}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 will be deemed \hich\af1\dbch\af37\loch\f1 to be a representation or warranty by }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 with respect to any Third-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content, even if a particular E}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 +\hich\af1\dbch\af37\loch\f1 xtension or other item of Third-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 \hich\f1 Party Content is identified as \'93\loch\f1 \hich\f1 certified\'94\loch\f1 for use with Software +}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Splunk has}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 no obligation to monitor Thi}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 rd-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 +\hich\af1\dbch\af37\loch\f1 , and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 may block}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 or disable access to any Third-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Party }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 at any time. In addition}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 , the availability of any Third-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 through }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 +\hich\af1\dbch\af37\loch\f1 Splunkbase}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 does not imply }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Splunk} +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 endorsement of, or affiliation w}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 ith, any provider of such Third-}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Part\hich\af1\dbch\af37\loch\f1 y }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 , nor does such availability create any legal relationship between }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 and any such provider. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 use of Third-}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 is at }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 +\loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 s }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 own risk and }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 may be}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 subject to any additional terms, conditions and po}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 licies applicable to su\hich\af1\dbch\af37\loch\f1 ch Third-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 +Party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 (such as }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 license terms, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 terms of service or privacy policies}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 of the providers of such Third-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 Party }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418\charrsid8010418 \hich\af1\dbch\af37\loch\f1 ).}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15095098 +{\*\bkmkend _Ref418075629}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8261468\charrsid9330256 {\*\bkmkstart _Ref192758921} +\par {\*\bkmkstart _Ref418075667}{\*\bkmkstart _Ref364669318}{\*\bkmkstart _Ref203558516}{\*\bkmkstart _Ref283015078}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 21.\tab} +}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid3570229 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3570229\charrsid4735610 +\hich\af1\dbch\af37\loch\f1 AUTHORIZED PARTNER}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid8926221 \hich\af1\dbch\af37\loch\f1 S}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 . }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 If }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 Customer acquired}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 the Software }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 +through an authorized reseller, partner or OEM of Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 +\'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 Authorized\hich\af1\dbch\af37\loch\f1 Partner}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 ) then, notwithstanding anything to the contrary in this Agreement: (a) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 use of the Software is subject to any additional terms }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 +in the agreement provide}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4735610\charrsid4735610 \hich\af1\dbch\af37\loch\f1 d by the Authorized Partner;}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 +\hich\af1\dbch\af37\loch\f1 (b) Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 agree}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 +\hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 to pay the Authorized Partner the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 +\hich\af1\dbch\af37\loch\f1 Fe\hich\af1\dbch\af37\loch\f1 es}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 +and other applicable fees,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 and }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Customer }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 have no direct }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 Fee }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 +\hich\af1\dbch\af37\loch\f1 payment obligations to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 +\hich\af1\dbch\af37\loch\f1 for }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 such Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4735610\charrsid4735610 \hich\af1\dbch\af37\loch\f1 ; (c) Customer} +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4735610\charrsid4735610 \hich\af1\dbch\af37\loch\f1 +s agreement with the Authorized Partner is between Customer and the Authorized Partner and is not binding on Splunk; and (d) Sp\hich\af1\dbch\af37\loch\f1 lunk may terminate this Agreement (including Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4735610\charrsid4735610 \hich\af1\dbch\af37\loch\f1 s right to use the Software) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 +\hich\af1\dbch\af37\loch\f1 if}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4735610\charrsid4735610 \hich\af1\dbch\af37\loch\f1 Splunk }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8926221 \hich\af1\dbch\af37\loch\f1 does not }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4735610\charrsid4735610 \hich\af1\dbch\af37\loch\f1 receive payment for Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4735610\charrsid4735610 \hich\af1\dbch\af37\loch\f1 s use of the Software from the Authorized Partner or if Customer breaches any term of this Agreement.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 +\hich\af1\dbch\af37\loch\f1 If Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 s}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 warranty and support terms stated in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 +its agreement with the Authorized }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 Partner are different }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 +from those set forth}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 +this Agreement, then }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 such different terms are solely between Customer and the Authorized Partner and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 will have}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 +\hich\af1\dbch\af37\loch\f1 no }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14892695\charrsid4735610 \hich\af1\dbch\af37\loch\f1 obligations to Cu\hich\af1\dbch\af37\loch\f1 stomer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3570229\charrsid4735610 \hich\af1\dbch\af37\loch\f1 under this Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 with respect to such different terms}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3570229\charrsid4735610 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 +Except as set forth in the preceding sentence, if there is }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 \hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 ny}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 \hich\af1\dbch\af37\loch\f1 conflict}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8010418 \hich\af1\dbch\af37\loch\f1 or inconsistency}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 +\hich\af1\dbch\af37\loch\f1 between this Agreement and Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 \hich\af1\dbch\af37\loch\f1 +s agreement with Authorized Partner, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15879770 \hich\af1\dbch\af37\loch\f1 then }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 \hich\af1\dbch\af37\loch\f1 this Agreement }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15879770 +\hich\af1\dbch\af37\loch\f1 con\hich\af1\dbch\af37\loch\f1 trol (and will resolve such inconsistency)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5259472 \hich\af1\dbch\af37\loch\f1 as between Splunk and Customer.}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid3570229\charrsid4735610 {\*\bkmkend _Ref418075667} +\par {\*\bkmkstart _Ref280370731}{\*\bkmkend _Ref364669318}{\*\bkmkend _Ref203558516}{\*\bkmkend _Ref283015078}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 22.\tab} +}\pard \ltrpar\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid13435885 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid8261468\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 CHOICE OF LAW AND DISPUTES.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14564319 +\hich\af1\dbch\af37\loch\f1 Unless Customer is}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3813645 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Government, this Agreement }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + be governed by and construed in accordance with the laws of the State of California, as if performed wholly within the state and without giving effect to the conflict}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15413901 +\hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 of law }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7277709 +\hich\af1\dbch\af37\loch\f1 principles}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7277709\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 of any jurisdiction or the United Nations Convention on Contracts for\hich\af1\dbch\af37\loch\f1 + the International Sale of Goods, the application of which is expressly excluded. Any legal action or proceeding arising under this Agreement will be brought exclusively in the federal or state courts located in San Francisco, California}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7277709 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 and the parties h\hich\af1\dbch\af37\loch\f1 +ereby consent to personal jurisdiction and venue therein}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14564319 \hich\af1\dbch\af37\loch\f1 + (except that Splunk may seek injunctive relief to prevent improper or unauthorized use or disclosure of any Splunk Materials in any court of competent jurisdiction)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8261468\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 If }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3416406 +\hich\af1\dbch\af37\loch\f1 Customer is}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3813645 +\hich\af1\dbch\af37\loch\f1 the G}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6106191 \hich\af1\dbch\af37\loch\f1 overnment}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 this Agreement }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + be governed by and interpreted in accordance with the Contract Disputes Act of 1978, as amended (41 U.S.C. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8396734 \loch\af1\dbch\af37\hich\f1 \'a7\'a7\loch\f1 71}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 01-}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8396734 \hich\af1\dbch\af37\loch\f1 7109}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8261468\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 ).}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Failure of the parties to reach agreement on any request for equitable adjustment, claim, appeal, or action arisin\hich\af1\dbch\af37\loch\f1 g under or relating to this Agreement }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271 +\hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 be a dispute to be resolved in accordance with the clause at 48 C.F.R }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13176864 \loch\af1\dbch\af37\hich\f1 \'a7\~}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8261468\charrsid11476353 \hich\af1\dbch\af37\loch\f1 52.233-1, which is incorporated in this Agreement by reference.}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \b\f1\fs18\insrsid9767610\charrsid13435885 {\*\bkmkstart _Ref203555354}{\*\bkmkend _Ref280370731}\~}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9767610\charrsid13435885 +\par {\*\bkmkstart _Ref291501104}{\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid7959983\charrsid15999650 \hich\af1\dbch\af37\loch\f1 23.\tab}}\pard\plain \ltrpar +\s38\qj \fi-360\li360\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\adjustright\rin0\lin360\itap0\pararsid3892541 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid7959983\charrsid15999650 \hich\af1\dbch\af37\loch\f1 GENERAL}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid15999650 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3892541\charrsid3892541 +\par {\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid15495468\charrsid9139365 \hich\af1\dbch\af37\loch\f1 23.1\tab}}\pard \ltrpar\s38\qj \fi360\li360\ri0\sa200\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls3\ilvl1\adjustright\rin0\lin360\itap0\pararsid3892541 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid15495468\charrsid9139365 \hich\af1\dbch\af37\loch\f1 Purchase Order}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid15495468 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15495468\charrsid3892541 \hich\af1\dbch\af37\loch\f1 Customer\hich\f1 \rquote \loch\f1 s issuance of a purchase order +\hich\af1\dbch\af37\loch\f1 +constitutes acceptance of this Agreement notwithstanding anything to the contrary in such purchase order. If any purchase order contains any terms or conditions that are different from or additional to the terms and conditions set forth in this Agreement, +\hich\af1\dbch\af37\loch\f1 \hich\af1\dbch\af37\loch\f1 +then Splunk expressly rejects such different or additional terms and conditions, and such different or additional terms and conditions will not become a part of the agreement between the parties notwithstanding any subsequent acknowledgement, invoice or l +\hich\af1\dbch\af37\loch\f1 i\hich\af1\dbch\af37\loch\f1 cense key that Splunk may issue}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15495468 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15495468\charrsid8207593 +\par {\*\bkmkstart _Ref478980383}{\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 23.2\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 Notices}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4873569\charrsid15999650 \hich\af1\dbch\af37\loch\f1 +All notices required or permitted under this Agreement will be in writing and delivered in person, by confirmed facsimile transmission, by overnight delivery service, or by registered or certified mail, postage pre\hich\af1\dbch\af37\loch\f1 +paid with return receipt requested, and in each instance will be deemed given upon receipt.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4873569\charrsid15999650 \hich\af1\dbch\af37\loch\f1 All communications will be sent to the addresses set forth in the applicable Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4873569\charrsid15999650 \hich\af1\dbch\af37\loch\f1 or to such other address as may be specified by either party to the other party i\hich\af1\dbch\af37\loch\f1 n accordance with this Section.}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4873569\charrsid15999650 {\*\bkmkend _Ref478980383}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1926692\charrsid1926692 +\par {\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 23.3\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\lang9\langfe1033\langnp9\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 Assignment}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3892541 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15749283\charrsid15999650 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid15999650 \hich\af1\dbch\af37\loch\f1 may }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13710296\charrsid15999650 \hich\af1\dbch\af37\loch\f1 not }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid15999650 +\hich\af1\dbch\af37\loch\f1 assign}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9309775\charrsid15999650 \hich\af1\dbch\af37\loch\f1 , delegate or transfer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid15999650 \hich\af1\dbch\af37\loch\f1 this}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8027180\charrsid15999650 \hich\af1\dbch\af37\loch\f1 + Agreement, in whole or in part}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9309775\charrsid15999650 \hich\af1\dbch\af37\loch\f1 , by agreement, operation of law or otherwise}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid2324239 \hich\af1\dbch\af37\loch\f1 without the prior written consent of Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8027180\charrsid15999650 .}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8027180\charrsid15999650 \hich\af1\dbch\af37\loch\f1 +Splunk may assign this Agreement in \hich\af1\dbch\af37\loch\f1 whole or in part to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8027180\charrsid15999650 \hich\af1\dbch\af37\loch\f1 an Affiliate}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441 \hich\af1\dbch\af37\loch\f1 or }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14703286\charrsid15999650 \hich\af1\dbch\af37\loch\f1 in connection with an internal reorganization or}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14703286\charrsid15999650 +\hich\af1\dbch\af37\loch\f1 a merger, acquisition, or sale of all or substantially all of Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid14703286\charrsid15999650 \hich\af1\dbch\af37\loch\f1 s assets}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12189934 \hich\af1\dbch\af37\loch\f1 to which this Agreement relates}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14703286\charrsid15999650 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441\charrsid15999650 \hich\af1\dbch\af37\loch\f1 Splunk may }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid5776441 \hich\af1\dbch\af37\loch\f1 also }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441\charrsid15999650 \hich\af1\dbch\af37\loch\f1 +assign its rights to receive payment due as a result of performance of this Agreement to a bank, trust company, or other financing institution, including any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441 \hich\af1\dbch\af37\loch\f1 f}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441\charrsid15999650 \hich\af1\dbch\af37\loch\f1 \hich\f1 ederal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. \'a7\~\loch\f1 3727) and may \hich\af1\dbch\af37\loch\f1 +\hich\f1 assign this Agreement in accordance with the provisions at 48 C.F.R \'a7\~\loch\f1 42.12, as applicable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441\charrsid15999650 \hich\af1\dbch\af37\loch\f1 . }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8027180\charrsid15999650 \hich\af1\dbch\af37\loch\f1 A}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid15999650 +\hich\af1\dbch\af37\loch\f1 ny attempt to assign this Agreement other than as permitted }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8027180\charrsid15999650 \hich\af1\dbch\af37\loch\f1 herein}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12259479\charrsid15999650 \hich\af1\dbch\af37\loch\f1 will be null and void}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441 \hich\af1\dbch\af37\loch\f1 . }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15682892\charrsid15999650 \hich\af1\dbch\af37\loch\f1 Subject to the foregoing, this Agreement will bind and inure to the benef\hich\af1\dbch\af37\loch\f1 it of the parties}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15682892\charrsid15999650 \hich\af1\dbch\af37\loch\f1 permitted successors and assigns}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid5642427\charrsid5642427 {\*\bkmkend _Ref192758921}.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 {\*\bkmkend _Ref291501104}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 +\par {\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid1859867 \hich\af1\dbch\af37\loch\f1 23.4\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid1859867 +\hich\af1\dbch\af37\loch\f1 Rights and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 Remedies}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3892541 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441 \hich\af1\dbch\af37\loch\f1 Except as otherwise expressly set forth in this Agreement}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441 \hich\af1\dbch\af37\loch\f1 the}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441\charrsid11476353 \hich\af1\dbch\af37\loch\f1 rights and remedies}{\rtlch\fcs1 \af0\afs20 \ltrch\fcs0 \fs20\dbch\af0\insrsid5776441\charrsid15095098 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441\charrsid15095098 \hich\af1\dbch\af37\loch\f1 of either party as set forth in this Agreement are not exclusive and are in addition to any other \hich\af1\dbch\af37\loch\f1 +rights and remedies now or hereafter provided by law or at equity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid3892541 +\par {\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 23.5\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 +Waiver}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 ; Severability}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid5776441\charrsid15095098 \hich\af1\dbch\af37\loch\f1 The waiver by either party of a breach of or a default under this Agreement }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441\charrsid15095098 \hich\af1\dbch\af37\loch\f1 not be effective unless in writing}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3498425 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid5776441\charrsid15095098 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441\charrsid11476353 \hich\af1\dbch\af37\loch\f1 The failure by either party to enforce any provis\hich\af1\dbch\af37\loch\f1 +ions of this Agreement will not constitute a waiver of any other right hereunder or of any subsequent enforcement of that or any other provisions.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441\charrsid11476353 \hich\af1\dbch\af37\loch\f1 If a court of competent jurisdiction holds any provision of this Agreement invalid or unenforceable, the rema +\hich\af1\dbch\af37\loch\f1 ining provisions of the Agreement will remain in full force and effect, and the provision affected will be construed so as to be enforceable to the maximum extent permissible by law.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid5776441 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 +\par {\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 23.6\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 +Interpretation}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid11759755 \hich\af1\dbch\af37\loch\f1 +For purposes of interpreting this Agreement, (a)\~unless the context otherwise requires, the singular includes the plural, and the plural includes the singular; (b)\~\hich\f1 unless otherwise specifically stated, the words \'93\loch\f1 \hich\f1 herein, +\'94\loch\f1 \hich\f1 \'93\loch\f1 \hich\f1 hereof,\'94\loch\f1 \hich\f1 and \'93\loch\f1 \hich\f1 hereunder\'94\loch\f1 and oth\hich\af1\dbch\af37\loch\f1 e\hich\af1\dbch\af37\loch\f1 +r words of similar import refer to this Agreement as a whole and not to any particular section or paragraph; (c)\~\hich\f1 the words \'93\loch\f1 \hich\f1 include\'94\loch\f1 \hich\f1 and \'93\loch\f1 \hich\f1 including\'94\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid11759755 \hich\af1\dbch\af37\loch\f1 not be construed as terms of limitation, and }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid11759755 \hich\af1\dbch\af37\loch\f1 \hich\f1 therefore mean \'93\loch\f1 \hich\f1 +including but not limited to\'94\loch\f1 \hich\f1 and \'93\loch\f1 i\hich\af1\dbch\af37\loch\f1 \hich\f1 ncluding without limitation\'94\loch\f1 ; (d)\~\hich\f1 unless otherwise specifically stated, the words \'93\loch\f1 \hich\f1 writing\'94\loch\f1 +\hich\f1 or \'93\loch\f1 \hich\f1 written\'94\loch\f1 mean preserved or presented in retrievable or reproducible form, whether electronic (including email but excluding voice mail) or hard copy; }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 (e) t}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid11759755 \hich\af1\dbch\af37\loch\f1 he ca\hich\af1\dbch\af37\loch\f1 +ptions and section and paragraph headings used in this Agreement are inserted for convenience only and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3892541\charrsid11759755 \hich\af1\dbch\af37\loch\f1 not affect the meaning or i}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 nterpretation of this Agreement; }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid11759755 \hich\af1\dbch\af37\loch\f1 and (}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7027423 \hich\af1\dbch\af37\loch\f1 f}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid11759755 +\hich\af1\dbch\af37\loch\f1 )\~the references herein to the parties }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 will }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid11759755 +\hich\af1\dbch\af37\loch\f1 refer to their permitted successors an\hich\af1\dbch\af37\loch\f1 d assigns.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 +\par {\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 23.7\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 +Data Collection; Privacy}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4669405\charrsid5776441 \hich\af1\dbch\af37\loch\f1 +From time to time, Splunk may collect and process technical and related information about Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4669405\charrsid5776441 \hich\af1\dbch\af37\loch\f1 s use of the Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2322792 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4669405\charrsid5776441 +\hich\af1\dbch\af37\loch\f1 which may include }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441 \hich\af1\dbch\af37\loch\f1 I}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4669405\charrsid5776441 \hich\af1\dbch\af37\loch\f1 +nternet protocol address}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12189934\charrsid5776441 \hich\af1\dbch\af37\loch\f1 es}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4669405\charrsid5776441 \hich\af1\dbch\af37\loch\f1 +, hardware identification, operating system, applica\hich\af1\dbch\af37\loch\f1 tion software and other usage information}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2322792 \hich\af1\dbch\af37\loch\f1 , and use this information }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3105619 \hich\af1\dbch\af37\loch\f1 to support and troubleshoot issues, provide updates, invoice}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7036188 \hich\af1\dbch\af37\loch\f1 , analyze trends}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2322792 \hich\af1\dbch\af37\loch\f1 and}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4669405\charrsid5776441 \hich\af1\dbch\af37\loch\f1 improve Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4669405\charrsid5776441 \hich\af1\dbch\af37\loch\f1 s products or services.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441 +\hich\af1\dbch\af37\loch\f1 Such information will be }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4669405\charrsid5776441 \hich\af1\dbch\af37\loch\f1 subject to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441 +\hich\af1\dbch\af37\loch\f1 the }{\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 \hich\af0\dbch\af37\loch\f0 HYPERLINK "http://www.splunk.com/en_us/legal/privacy/privacy-policy.html" }}{\fldrslt {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \cs22\f1\fs18\ul\cf2\insrsid4669405\charrsid8596824 \hich\af1\dbch\af37\loch\f1 Splunk Privacy Policy}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid5776441 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16347156 \hich\af1\dbch\af37\loch\f1 which }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441 \hich\af1\dbch\af37\loch\f1 policy is}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441\charrsid15992736 \hich\af1\dbch\af37\loch\f1 hereby incorporated by reference }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441 \hich\af1\dbch\af37\loch\f1 +and made a part of this Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441\charrsid15992736 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5776441 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3892541 +\par {\listtext\pard\plain\ltrpar \s38 \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 23.8\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 +Integration}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid2324239 \hich\af1\dbch\af37\loch\f1 ; Entire Agreement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid3892541 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6231352\charrsid3892541 \hich\af1\dbch\af37\loch\f1 This Agreement along with any addit}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5991859\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 ional \hich\af1\dbch\af37\loch\f1 terms incorporated herein}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6231352\charrsid3892541 \hich\af1\dbch\af37\loch\f1 by reference, including }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441\charrsid3892541 \hich\af1\dbch\af37\loch\f1 the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6231352\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid3892541 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6231352\charrsid3892541 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5776441\charrsid3892541 \hich\af1\dbch\af37\loch\f1 the}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6231352\charrsid3892541 \hich\af1\dbch\af37\loch\f1 Exhibits hereto, constitute the complete and exclusive understanding and agreement between the parties and supersede}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid674069\charrsid3892541 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6231352\charrsid3892541 \hich\af1\dbch\af37\loch\f1 + any and all prior or contemporaneous agreements, communications and understandings, written or oral, relating to their subject matter.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid3892541 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6582692\charrsid3892541 \hich\af1\dbch\af37\loch\f1 Any}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6231352\charrsid3892541 \hich\af1\dbch\af37\loch\f1 waiver, modification or amendment of any provision of this Agreement will be effective only if in writing and signed\hich\af1\dbch\af37\loch\f1 + by duly authorized representatives of both parties.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159\charrsid3892541 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3675690\charrsid3892541 \hich\af1\dbch\af37\loch\f1 +Any terms and conditions contained or referenced by either party in a quote, purchase order, acceptance, invoice or any similar document purporting to modify the terms and conditions contained in this Ag\hich\af1\dbch\af37\loch\f1 reement }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271\charrsid3892541 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3675690\charrsid3892541 \~\hich\af1\dbch\af37\loch\f1 be disregarded}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid7881183\charrsid3892541 \hich\af1\dbch\af37\loch\f1 and have no effect}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3675690\charrsid3892541 \hich\af1\dbch\af37\loch\f1 unless otherwise expressly agreed to by the parties in }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3675690\charrsid10494223 \hich\af1\dbch\af37\loch\f1 accordance with the preceding sentence.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10639240\charrsid10494223 {\*\bkmkend _Ref203555354} +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3892541\charrsid10494223 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8480377\charrsid10494223 +\par }\pard\plain \ltrpar\qj \li720\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin720\itap0\pararsid11951442 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8335957\charrsid11951442 +\par }\pard \ltrpar\qc \li0\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\ul\lang9\langfe1033\langnp9\insrsid10494223 +\par +\par }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\ul\lang9\langfe1033\langnp9\insrsid3019033 +\par +\par +\par +\par +\par +\par +\par +\par +\par }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\ul\lang9\langfe1033\langnp9\insrsid11226265 +\par +\par +\par +\par }\pard \ltrpar\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\ul\lang9\langfe1033\langnp9\insrsid11302461 \page +\par }\pard \ltrpar\qc \li0\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\ul\lang9\langfe1033\langnp9\insrsid6227274\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 EXHIBIT A}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\ul\lang9\langfe1033\langnp9\insrsid6040746\charrsid11476353 +\par }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 DEFINITIONS}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\lang9\langfe1033\langnp9\insrsid15746505\charrsid11476353 + +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865\charrsid4080865 \hich\af1\dbch\af37\loch\f1 1.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865\charrsid4080865 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid4080865\charrsid4080865 \hich\af1\dbch\af37\loch\f1 Affiliate}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865\charrsid4080865 \loch\af1\dbch\af37\hich\f1 ,\'94\loch\f1 + with respect to a party, means a corporation, partnership or other entity controlling, controlled by or under common control with such party, but only so long as such control continues to exist. For purposes of this }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 definition}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865\charrsid4080865 \hich\af1\dbch\af37\loch\f1 \hich\f1 , \'93\loch\f1 \hich\f1 control\'94\loch\f1 means ownership +\hich\af1\dbch\af37\loch\f1 , dir}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 ectly or indirectly, of greater than}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865\charrsid4080865 +\hich\af1\dbch\af37\loch\f1 fifty percent (50%) of the voting rights in such entity (or, in the case of a noncorpo}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 rate entity, equivalent rights)}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 2.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid11828462 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid7931169\charrsid7931169 \hich\af1\dbch\af37\loch\f1 Authorized Partner}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 has the meaning set forth in Section }{\field{\*\fldinst { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 REF _Ref418075667 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000370035003600360037000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 21}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 . +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 3.\tab}\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid7931169\charrsid7931169 +\hich\af1\dbch\af37\loch\f1 Claim}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 has the meaning set forth in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 +\hich\af1\dbch\af37\loch\f1 REF _Ref418075546 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000370035003500340036000000}} +}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 13}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 . +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 4.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid2625492 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid11828462\charrsid11828462 \hich\af1\dbch\af37\loch\f1 Confidential Information}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11828462\charrsid11828462 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 has}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11828462\charrsid11828462 +\hich\af1\dbch\af37\loch\f1 the meaning set forth in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11828462\charrsid11828462 \hich\af1\dbch\af37\loch\f1 REF _Ref280473218 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11828462\charrsid11828462 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380030003400370033003200310038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 +\hich\af1\dbch\af37\loch\f1 14.1}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11828462\charrsid11828462 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7487258 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7487258\charrsid7487258 \hich\af1\dbch\af37\loch\f1 5.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7487258\charrsid7487258 \loch\af1\dbch\af37\hich\f1 \'93}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid7487258\charrsid1727288 \hich\af1\dbch\af37\loch\f1 Content Subscription}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12407223 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 means certain }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7487258\charrsid7487258 \hich\af1\dbch\af37\loch\f1 entit}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7487258 \hich\af1\dbch\af37\loch\f1 l}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid7487258\charrsid7487258 \hich\af1\dbch\af37\loch\f1 ement for Customer to receive a collection of updated contents applicable to the Purchased Software }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5387267\charrsid7487258 +\hich\af1\dbch\af37\loch\f1 (such as models, rules and configurations}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5387267 ,}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5387267\charrsid5387267 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5387267\charrsid5387267 \hich\af1\dbch\af37\loch\f1 as }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5387267 \hich\af1\dbch\af37\loch\f1 further described }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid5387267\charrsid5387267 \hich\af1\dbch\af37\loch\f1 in th}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5387267 \hich\af1\dbch\af37\loch\f1 e relevant end user documentation for the Purchased Software}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid5387267\charrsid7487258 \hich\af1\dbch\af37\loch\f1 )}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5387267 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2762772 +\hich\af1\dbch\af37\loch\f1 on a periodic basis }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7487258\charrsid7487258 \hich\af1\dbch\af37\loch\f1 for t\hich\af1\dbch\af37\loch\f1 +he duration of the subscription period. This can be purchased as an add-on service to the term license or perpetual license to the applicable Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7761403 \hich\af1\dbch\af37\loch\f1 + as identified in the Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7487258\charrsid7487258 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8859568 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8859568 \hich\af1\dbch\af37\loch\f1 6.\tab}\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid8859568\charrsid1727288 +\hich\af1\dbch\af37\loch\f1 Content Subscription Fees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8859568 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 has the meaning set forth in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8859568 \hich\af1\dbch\af37\loch\f1 REF _Ref280375279 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8859568 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380030003300370035003200370039000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 6}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8859568 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3938240 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \hich\af1\dbch\af37\loch\f1 7.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid11828462 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Customer Extension}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid3938240\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3938240 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 has}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3938240\charrsid11828462 \hich\af1\dbch\af37\loch\f1 + the meaning set forth in Section}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 \hich\af1\dbch\af37\loch\f1 }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 \hich\af1\dbch\af37\loch\f1 REF _Ref291500589 \\r +\\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003500300030003500380039000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 2.7}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3938240 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13065494 \hich\af1\dbch\af37\loch\f1 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 8.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid13065494\charrsid13065494 \hich\af1\dbch\af37\loch\f1 Delivery}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13065494 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 means}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13177476 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid10177295 \hich\af1\dbch\af37\loch\f1 the date of Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10177295 +\hich\af1\dbch\af37\loch\f1 s initial delivery}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13177476 \hich\af1\dbch\af37\loch\f1 of the license key }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 for}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13177476 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5650183 \hich\af1\dbch\af37\loch\f1 applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12190962 +\hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13177476 \hich\af1\dbch\af37\loch\f1 or otherwise making the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid5650183 \hich\af1\dbch\af37\loch\f1 applicable }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13177476 \hich\af1\dbch\af37\loch\f1 available for download by Customer.}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid6968650 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 9.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid6968650\charrsid6968650 \hich\af1\dbch\af37\loch\f1 Disabled Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 means}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 + certain materials (including programs, modules or components, functionality}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 +\hich\af1\dbch\af37\loch\f1 features, documentation, content or other materials) that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11025635 \hich\af1\dbch\af37\loch\f1 may be }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 +\hich\af1\dbch\af37\loch\f1 contained in}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16584802 \hich\af1\dbch\af37\loch\f1 or provided with}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 the Software }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11025635 \hich\af1\dbch\af37\loch\f1 as part of}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1053074 +\hich\af1\dbch\af37\loch\f1 delivery}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 mechanism used by Spl\hich\af1\dbch\af37\loch\f1 unk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1670465 ,}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 but }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1670465 \hich\af1\dbch\af37\loch\f1 that }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 +\hich\af1\dbch\af37\loch\f1 are disabled or hidden in Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 s}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650\charrsid7556751 \hich\af1\dbch\af37\loch\f1 setting, because }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 Customer either}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid12061734 \hich\af1\dbch\af37\loch\f1 :}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 (a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650\charrsid7556751 +\hich\af1\dbch\af37\loch\f1 ) do}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 es}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650\charrsid7556751 \hich\af1\dbch\af37\loch\f1 not have the relevant\~ +licens}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 e}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13067628 +\hich\af1\dbch\af37\loch\f1 or license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 key}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12061734 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 +\hich\af1\dbch\af37\loch\f1 or (b) has}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650\charrsid7556751 \hich\af1\dbch\af37\loch\f1 not paid the applicable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 +\hich\af1\dbch\af37\loch\f1 F}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 ees, for those materials.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11828462\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 10.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid7949383\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Enhancements}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid7949383\charrsid11476353 \hich\af1\dbch\af37\loch\f1 means any }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7949383\charrsid11476353 \hich\af1\dbch\af37\loch\f1 updates}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid946540\charrsid11476353 \hich\af1\dbch\af37\loch\f1 , upgrades, releases, \hich\af1\dbch\af37\loch\f1 fixes, enh}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7949383\charrsid11476353 \hich\af1\dbch\af37\loch\f1 a}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid946540\charrsid11476353 \hich\af1\dbch\af37\loch\f1 n}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7949383\charrsid11476353 \hich\af1\dbch\af37\loch\f1 cements or modifications }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid3891189 \hich\af1\dbch\af37\loch\f1 to the}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid13067628 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6189273 \hich\af1\dbch\af37\loch\f1 made generally commercially available by Splunk to}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12599565 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid1670465 \hich\af1\dbch\af37\loch\f1 its support customers }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12599565 +\hich\af1\dbch\af37\loch\f1 under the terms and cond}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid8396734 \hich\af1\dbch\af37\loch\f1 i}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11828462 +\hich\af1\dbch\af37\loch\f1 tions }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4080865 \hich\af1\dbch\af37\loch\f1 set forth}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11828462 +\hich\af1\dbch\af37\loch\f1 in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\ul\lang9\langfe1033\langnp9\insrsid11828462\charrsid11828462 \hich\af1\dbch\af37\loch\f1 Exhibit C}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7949383\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9264272\charrsid9264272 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \hich\af1\dbch\af37\loch\f1 11.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid14573035 \hich\af1\dbch\af37\loch\f1 Evaluation Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15929691 \hich\af1\dbch\af37\loch\f1 means }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15929691 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid19617 \hich\af1\dbch\af37\loch\f1 that is specified in an }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15929691\charrsid15929691 \hich\af1\dbch\af37\loch\f1 Order }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15929691 \hich\af1\dbch\af37\loch\f1 as }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15929691\charrsid15929691 \hich\af1\dbch\af37\loch\f1 provided under an evaluation license or a free trial license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 .}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid7949383\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 12.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 Excluded Matters}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 has the meaning set forth in Section }{\field{\*\fldinst {\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 REF _Ref418075546 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000370035003500340036000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 13}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 . +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 13.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Extension}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 mean}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12326275 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 any separate}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12326275 \hich\af1\dbch\af37\loch\f1 ly}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 downloadable suite, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid15164339 \hich\af1\dbch\af37\loch\f1 configuration file, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 add-on, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4875164 +\hich\af1\dbch\af37\loch\f1 technical add-on, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12599565 \hich\af1\dbch\af37\loch\f1 example module, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13783288 \hich\af1\dbch\af37\loch\f1 +command, function}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 or application}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6425283\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 that}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 extends the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 features or functionality\hich\af1\dbch\af37\loch\f1 of the applicable}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15162976 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Software. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 14.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid2240671 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 Feedback}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 means }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid2240671 +\hich\af1\dbch\af37\loch\f1 all suggestions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 for improvement or enhancement}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid2240671 +\hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 recommendations, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid2240671 \hich\af1\dbch\af37\loch\f1 +comments, opinions, code, input, ideas, reports, information, know-how o}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 r other feedback provided by Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2240671\charrsid2240671 \hich\af1\dbch\af37\loch\f1 (whether in oral, electronic or wr\hich\af1\dbch\af37\loch\f1 itten form) t}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 +o Splunk in connection with Splunk\hich\f1 \rquote \loch\f1 s Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid2240671 \hich\af1\dbch\af37\loch\f1 . Feedback does not include any data, results or output create}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13306007 \hich\af1\dbch\af37\loch\f1 d or generated by Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 using the}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2240671\charrsid2240671 \hich\af1\dbch\af37\loch\f1 Software, unless }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 specifically submitted or communicated by Customer}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid2240671 \hich\af1\dbch\af37\loch\f1 to Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 as part of the Feedb\hich\af1\dbch\af37\loch\f1 ack}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid2240671 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671\charrsid7931169 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 15.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid9264272\charrsid14573035 \hich\af1\dbch\af37\loch\f1 Free Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 means }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 t}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid19617 \hich\af1\dbch\af37\loch\f1 hat is specified in an }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 +Order as provided to Customer without charge (other than Evaluation Software)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4865158\charrsid10494223 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3813645 \hich\af1\dbch\af37\loch\f1 16.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3813645 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid3813645\charrsid3813645 \hich\af1\dbch\af37\loch\f1 Government}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3813645 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 means an }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid3813645 \hich\af1\dbch\af37\loch\f1 agency, department, or instrumentality of the United States government.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3813645 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 17.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid6968650\charrsid6968650 \hich\af1\dbch\af37\loch\f1 Intellectual \hich\af1\dbch\af37\loch\f1 Property Rights}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14041768 \hich\af1\dbch\af37\loch\f1 means}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6968650\charrsid11476353 \hich\af1\dbch\af37\loch\f1 all }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650\charrsid11476353 \hich\af1\dbch\af37\loch\f1 patent}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid225954 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650\charrsid11476353 \hich\af1\dbch\af37\loch\f1 copyright}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11085823 +\hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 \hich\af1\dbch\af37\loch\f1 trademark}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid225954 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12326275 +\hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650\charrsid11476353 \hich\af1\dbch\af37\loch\f1 trade secret}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid225954 \hich\af1\dbch\af37\loch\f1 rights}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4947407 \hich\af1\dbch\af37\loch\f1 and other }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 intellectual property and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4947407 \hich\af1\dbch\af37\loch\f1 proprietary rights, whether registered or unregistered}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6968650 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13833537 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 18.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid13894301\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Internal Business Purpose}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13894301\charrsid11476353 \hich\af1\dbch\af37\loch\f1 means }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13894301 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 +\loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13894301 \hich\af1\dbch\af37\loch\f1 s use for its own internal business \hich\af1\dbch\af37\loch\f1 operations on Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13894301 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13894301\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 systems, networks}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13894301 \hich\af1\dbch\af37\loch\f1 and}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13894301\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + devices }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13894301 \hich\af1\dbch\af37\loch\f1 with Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13894301 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13894301\charrsid11476353 \~\hich\af1\dbch\af37\loch\f1 data.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2504121\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Such use}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12530970\charrsid11476353 \~\hich\af1\dbch\af37\loch\f1 +does not include use\~}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11760010 \hich\af1\dbch\af37\loch\f1 by Customer on a service bureau basis or otherwise to provide services to, or process data for, any third party}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid12530970\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11426514 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 19.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11426514 \hich\af1\dbch\af37\loch\f1 + means the maxim\hich\af1\dbch\af37\loch\f1 um }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4947436 \hich\af1\dbch\af37\loch\f1 usage of the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4947436 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11426514 \hich\af1\dbch\af37\loch\f1 (e.g., aggregate daily volume of data}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid14635628 \hich\af1\dbch\af37\loch\f1 indexed}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11426514 \hich\af1\dbch\af37\loch\f1 , number of Nodes, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7437740 +\hich\af1\dbch\af37\loch\f1 number of us}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4947436 \hich\af1\dbch\af37\loch\f1 ers, etc.)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7437740 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 that is }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4947436 \hich\af1\dbch\af37\loch\f1 permitted under}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11426514 +\hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4947436 \hich\af1\dbch\af37\loch\f1 type of license incl}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid19617 \hich\af1\dbch\af37\loch\f1 uded in the applicable }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4947436 \hich\af1\dbch\af37\loch\f1 Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11426514 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4947436 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15929691 \hich\af1\dbch\af37\loch\f1 The available types of license and the associated }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed +\hich\af1\dbch\af37\loch\f1 Capacity}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15929691 \hich\af1\dbch\af37\loch\f1 for each are set forth in }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\ul\insrsid15929691\charrsid15929691 \hich\af1\dbch\af37\loch\f1 Exhibit B}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15929691 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid15999650 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 20.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid15999650\charrsid15999650 \hich\af1\dbch\af37\loch\f1 License Fees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15999650 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 has}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15999650 \hich\af1\dbch\af37\loch\f1 the meaning set forth in Section } +{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15999650 \hich\af1\dbch\af37\loch\f1 REF _Ref280375279 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15999650 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200380030003300370035003200370039000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 6}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15999650 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid9264272 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 21.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid4352155\charrsid10774811 \hich\af1\dbch\af37\loch\f1 Open Source}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid11145 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4352155\charrsid4352155 \hich\af1\dbch\af37\loch\f1 + means software or similar subject matter that is distributed under an open source license such as (by way of example only) the GNU General Public License, GNU Lesser \hich\af1\dbch\af37\loch\f1 +General Public License, Apache License, Mozilla Public License, BSD License, MIT License, Common Public License, any derivative of any of the foregoing licenses, or any other license approved as an open source license by the Open Source Initiative}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10774811 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12530970 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413\charrsid4080865 \hich\af1\dbch\af37\loch\f1 22.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413\charrsid4080865 \loch\af1\dbch\af37\hich\f1 \'93}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid6227274\charrsid4080865 \hich\af1\dbch\af37\loch\f1 Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413\charrsid4080865 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid4080865 \hich\af1\dbch\af37\loch\f1 mean}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8065428\charrsid4080865 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid6227274\charrsid4080865 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 Splunk\hich\f1 \rquote \loch\f1 s quote}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2324239 \hich\af1\dbch\af37\loch\f1 , statement of work}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7687692 ,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2324239 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid4522545 \hich\af1\dbch\af37\loch\f1 or ordering document }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 accepted by Customer or Customer\hich\f1 \rquote \loch\f1 s}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid4080865 \hich\af1\dbch\af37\loch\f1 purchase order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15413851\charrsid4080865 \hich\af1\dbch\af37\loch\f1 or other}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid4080865 \hich\af1\dbch\af37\loch\f1 ordering document}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 submitted to Splunk }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9139365 \hich\af1\dbch\af37\loch\f1 (directly or indirectly through an Authorized Partner) }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 to order Splunk Materials or services, }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1859867 \hich\af1\dbch\af37\loch\f1 wh\hich\af1\dbch\af37\loch\f1 ich }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4522545 \hich\af1\dbch\af37\loch\f1 references the products, services,}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 pricing and other applicable terms set forth in an applicable Splunk quote}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4522545 \hich\af1\dbch\af37\loch\f1 + or ordering document}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13305099\charrsid4080865 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9264272 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 23.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid9264272\charrsid13391126 \hich\af1\dbch\af37\loch\f1 Professional Services}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid9264272 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7942271 \hich\af1\dbch\af37\loch\f1 has}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272\charrsid11828462 \hich\af1\dbch\af37\loch\f1 + the meaning set forth in Section}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 \hich\af1\dbch\af37\loch\f1 }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 \hich\af1\dbch\af37\loch\f1 REF _Ref291500791 \\r +\\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003500300030003700390031000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 8}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid14961841 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 24.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid15929691 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid5902613 \hich\af1\dbch\af37\loch\f1 Purchased Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2309988 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4458084 \hich\af1\dbch\af37\loch\f1 means }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid13067628 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9852312 \hich\af1\dbch\af37\loch\f1 that is licensed to Customer and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15929691 +\hich\af1\dbch\af37\loch\f1 for which Customer has paid a License Fee to Splunk, whether directly or through an}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4458084 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid4080865 \hich\af1\dbch\af37\loch\f1 Authorized Partner}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid4458084 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid9264272\charrsid15929691 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12198352\delrsid12198352 \hich\af1\dbch\af37\loch\f1 25.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid9264272 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12198352\delrsid12198352 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid7931169\charrsid7931169 \hich\af1\dbch\af37\loch\f1 Service \hich\af1\dbch\af37\loch\f1 Providers}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 has the meaning set forth in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 REF _Ref418075408 \\r \\h }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000370035003400300038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 4}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 . +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 26.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid9264272\charrsid8263922 \hich\af1\dbch\af37\loch\f1 Splunkbase}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 +\hich\af1\dbch\af37\loch\f1 means }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272\charrsid10180768 \hich\af1\dbch\af37\loch\f1 Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272\charrsid10180768 \hich\af1\dbch\af37\loch\f1 s online directory of or platform for }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 \hich\af1\dbch\af37\loch\f1 Extensions,}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272\charrsid9264272 \hich\af1\dbch\af37\loch\f1 currently located at }{\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 \hich\af0\dbch\af37\loch\f0 + HYPERLINK "https://splunkbase.splunk.com/" }}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \cs22\f1\fs18\ul\cf2\insrsid9264272\charrsid14316664 \hich\af1\dbch\af37\loch\f1 https://splunkbase.splunk.com/}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9264272\charrsid9264272 +\hich\af1\dbch\af37\loch\f1 any and all\hich\af1\dbch\af37\loch\f1 successors, replacements, new versions, derivatives, updates and upgrades thereto. +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 27.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid7097561 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \ab\ai\af1\afs18 +\ltrch\fcs0 \b\i\f1\fs18\insrsid11426514\charrsid14961841 \hich\af1\dbch\af37\loch\f1 Splunk Developer Tool}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11426514\charrsid14961841 \hich\af1\dbch\af37\loch\f1 means the standard application programming interface }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid279047 \hich\af1\dbch\af37\loch\f1 or configuration }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid11426514\charrsid14961841 \hich\af1\dbch\af37\loch\f1 and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8209141 \hich\af1\dbch\af37\loch\f1 related}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11426514\charrsid14961841 \hich\af1\dbch\af37\loch\f1 materials }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1138390 \hich\af1\dbch\af37\loch\f1 identified and provided by Splunk for and with}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11426514\charrsid14961841 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8391001 \hich\af1\dbch\af37\loch\f1 appli\hich\af1\dbch\af37\loch\f1 cable }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11426514\charrsid14961841 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10177295\charrsid14961841 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11566684\charrsid14961841 \hich\af1\dbch\af37\loch\f1 to }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10177295\charrsid14961841 \hich\af1\dbch\af37\loch\f1 enable the creation of Extensions or otherwise }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid11566684\charrsid14961841 \hich\af1\dbch\af37\loch\f1 support }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10177295\charrsid14961841 \hich\af1\dbch\af37\loch\f1 interoperability between }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid8209141 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10177295\charrsid14961841 \hich\af1\dbch\af37\loch\f1 Software and }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid11566684\charrsid14961841 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11566684\charrsid14961841 +\hich\af1\dbch\af37\loch\f1 s }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10177295\charrsid14961841 \hich\af1\dbch\af37\loch\f1 system or environment}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11426514\charrsid14961841 .}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11426514\charrsid7097561 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \hich\af1\dbch\af37\loch\f1 28.\tab}}\pard \ltrpar +\qj \fi-360\li360\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\ls5\adjustright\rin0\lin360\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk Extensions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 +\'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 mean}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11760010 \hich\af1\dbch\af37\loch\f1 +s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Extensions}{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9656713\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \ab\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11760010 \hich\af1\dbch\af37\loch\f1 made available }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6227274\charrsid11476353 \hich\af1\dbch\af37\loch\f1 through }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 \hich\af1\dbch\af37\loch\f1 Splunkbase}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11760010 \hich\af1\dbch\af37\loch\f1 that are identified on Splunkbase as published by Splunk (and not by any third party)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid6227274\charrsid11476353 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6227274\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \hich\af1\dbch\af37\loch\f1 29.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid9330996\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk Materials}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9330996\charrsid11476353 \hich\af1\dbch\af37\loch\f1 mean the Software, }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14041181 \hich\af1\dbch\af37\loch\f1 Software license keys,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11828462 \hich\af1\dbch\af37\loch\f1 Splunk Developer Tools,}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9330996\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk Extensions}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15164339 \hich\af1\dbch\af37\loch\f1 and } +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid4542988 \hich\af1\dbch\af37\loch\f1 end user }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15164339 \hich\af1\dbch\af37\loch\f1 documentation}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11828462 \hich\af1\dbch\af37\loch\f1 relating to the foregoing}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9330996\charrsid11476353 .}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid15999650\charrsid15999650 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \hich\af1\dbch\af37\loch\f1 30.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid205423\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 means the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid205423\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid205423 \hich\af1\dbch\af37\loch\f1 products }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid205423\charrsid11476353 \hich\af1\dbch\af37\loch\f1 listed in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid19617 \hich\af1\dbch\af37\loch\f1 an }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid205423\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Order}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid205423 \hich\af1\dbch\af37\loch\f1 + and any Enhancements }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9399028 \hich\af1\dbch\af37\loch\f1 thereto made available to Customer by Splunk}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid205423\charrsid11476353 .}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid16067760 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid205423\charrsid205423 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \hich\af1\dbch\af37\loch\f1 31.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid15999650\charrsid15999650 \hich\af1\dbch\af37\loch\f1 Support Fees}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999650 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7942271 \hich\af1\dbch\af37\loch\f1 has}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999650 \hich\af1\dbch\af37\loch\f1 the meaning set forth in }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\ul\lang9\langfe1033\langnp9\insrsid1859867\charrsid1859867 \hich\af1\dbch\af37\loch\f1 Exhibit C}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid15999650 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid15999650\charrsid15999650 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 32.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\i\f1\fs18\insrsid7931169\charrsid7931169 \hich\af1\dbch\af37\loch\f1 Support Services}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 has the meaning set forth in Section }{\field{\*\fldinst { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 REF _Ref418075450 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000370035003400350030000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9896659 \hich\af1\dbch\af37\loch\f1 7}}}\sectd \ltrsect +\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2240671 \hich\af1\dbch\af37\loch\f1 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \hich\af1\dbch\af37\loch\f1 33.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid6767501\charrsid15999650 \hich\af1\dbch\af37\loch\f1 Term}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6767501 \hich\af1\dbch\af37\loch\f1 ha}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid8209141 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid6767501 \hich\af1\dbch\af37\loch\f1 the meaning set forth in Section}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 \hich\af1\dbch\af37\loch\f1 }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 \hich\af1\dbch\af37\loch\f1 REF _Ref291500928 \\r \\h }{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9264272 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003200390031003500300030003900320038000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 15}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid15999650 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14837237 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14837237\charrsid5258355 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14837237 \hich\af1\dbch\af37\loch\f1 34.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14837237 +\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid14837237\charrsid5258355 \hich\af1\dbch\af37\loch\f1 Test and Development Software}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14837237 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 means Software that is specified in an }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14837237\charrsid15929691 +\hich\af1\dbch\af37\loch\f1 Order }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14837237 \hich\af1\dbch\af37\loch\f1 as provided under a test and development }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid14837237\charrsid15929691 \hich\af1\dbch\af37\loch\f1 license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid14837237 \hich\af1\dbch\af37\loch\f1 . }{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid7931169\charrsid7931169 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7931169 \hich\af1\dbch\af37\loch\f1 35.\tab}}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7931169 +\loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\lang9\langfe1033\langnp9\insrsid7931169\charrsid7931169 \hich\af1\dbch\af37\loch\f1 Third-Party Content}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\lang9\langfe1033\langnp9\insrsid7931169 \loch\af1\dbch\af37\hich\f1 \'94\loch\f1 has the meaning set forth in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7931169 +\hich\af1\dbch\af37\loch\f1 REF _Ref418075629 \\r \\h }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7931169 {\*\datafield +08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003400310038003000370035003600320039000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid9896659 \hich\af1\dbch\af37\loch\f1 20}}} +\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid7931169 .}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\lang9\langfe1033\langnp9\insrsid11828462 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid11828462\charrsid11828462 +\par }\pard \ltrpar\qj \li0\ri0\sa240\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid8209141 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7297141\charrsid7297141 +\par }\pard \ltrpar\qc \li0\ri0\sa200\sl276\slmult1\nowidctlpar\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\outlinelevel0\rin0\lin0\itap0\pararsid1455894 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid1455894 \page }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\ul\insrsid1455894\charrsid11476353 \hich\af1\dbch\af37\loch\f1 EXHIBIT }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\ul\insrsid1455894 \hich\af1\dbch\af37\loch\f1 B}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\ul\insrsid1455894\charrsid11476353 +\par }\pard \ltrpar\qc \li0\ri0\sa240\nowidctlpar\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\outlinelevel0\rin0\lin0\itap0\pararsid1455894 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid1138390 +\hich\af1\dbch\af37\loch\f1 LICENSE}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid554500 \hich\af1\dbch\af37\loch\f1 D}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid1138390 \hich\af1\dbch\af37\loch\f1 CAPACITY}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \b\f1\fs17\insrsid1455894 +\par }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid11559763\charrsid11476353 +\par \ltrrow}\trowd \irow0\irowband0\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 +\clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572\clvertalt +\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\pard\plain \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\b\f1\fs18\insrsid1119707\charrsid7887901 \hich\af1\dbch\af37\loch\f1 Product\cell \hich\af1\dbch\af37\loch\f1 License Type\cell }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid554500 \hich\af1\dbch\af37\loch\f1 Licensed Capacity}{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid1119707\charrsid7887901 \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid13976316\charrsid7887901 \trowd \irow0\irowband0\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 +\trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 +\clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572\clvertalt +\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\trowd \irow1\irowband1\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl +\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvmgf\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb +\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572 +\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\pard\plain \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 Splunk Enterprise & Splunk Light \cell \hich\af1\dbch\af37\loch\f1 Paid license\cell }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6172601 \loch\af1\dbch\af37\hich\f1 \'93\loch\f1 \hich\f1 +Daily Indexing Volume\'94\loch\f1 means the m}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 aximum\hich\af1\dbch\af37\loch\f1 + daily aggregate volume of uncompressed data for indexing as set forth in the Order Document +\par }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910\charrsid2053910 \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid13976316 \trowd \irow1\irowband1\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb +\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvmgf\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb +\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572 +\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\trowd \irow2\irowband2\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 +\trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvmrg\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb +\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572 +\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\pard\plain \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2053910 \cell \hich\af1\dbch\af37\loch\f1 Free license\cell \hich\af1\dbch\af37\loch\f1 500MB }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3287093 \hich\af1\dbch\af37\loch\f1 of }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 uncompressed data for indexing per day\cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid13976316 \trowd \irow2\irowband2\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb +\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvmrg\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb +\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572 +\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\pard\plain \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2053910 \cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid7931169 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 +Evaluation or }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7931169 \hich\af1\dbch\af37\loch\f1 t}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 rial license\cell }\pard \ltrpar +\ql \li0\ri0\sa240\sl276\slmult1\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid5258355 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 Daily }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid10040263 \hich\af1\dbch\af37\loch\f1 I}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 ndexing }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10040263 \hich\af1\dbch\af37\loch\f1 V}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 olume }{\rtlch\fcs1 \ai\af1\afs18 \ltrch\fcs0 \i\fs18\cf18\loch\af1\hich\af1\dbch\af31501\insrsid2053910 \cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid13976316 \trowd \irow3\irowband3\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvmrg\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb +\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572 +\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\trowd \irow4\irowband4\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 +\trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvmgf\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb +\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572 +\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\pard\plain \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid3830700 \hich\af1\dbch\af37\loch\f1 Splunk Analytics for Hadoop}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 \cell \hich\af1\dbch\af37\loch\f1 Paid license\cell \hich\af1\dbch\af37\loch\f1 +Maximum number of Nodes or Fractional Use of Nodes from which data can be sourced to be analyzed and visualized, as identified in the }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910\charrsid14694974 \hich\af1\dbch\af37\loch\f1 +applicable Order Document}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid3830700 \hich\af1\dbch\af37\loch\f1 (NOTE: Data in a Node that has already been indexed by Splunk Enterprise (or Splunk Light or Spl\hich\af1\dbch\af37\loch\f1 +unk Cloud) will not be counted toward the paid volume.)}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 +\par }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1119707 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \b\i\f1\fs18\insrsid2053910\charrsid149281 \hich\af1\dbch\af37\loch\f1 Node}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2053910\charrsid149281 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \ab\af0\afs18 \ltrch\fcs0 \f4\fs18\lang9\langfe1033\langnp9\insrsid2053910\charrsid149281 \hich\af4\dbch\af37\loch\f4 +means a 64 bit Linux operating system or any other operating system identifie}{\rtlch\fcs1 \ab\af0\afs18 \ltrch\fcs0 \f4\fs18\lang9\langfe1033\langnp9\insrsid2053910\charrsid8138548 \hich\af4\dbch\af37\loch\f4 +d in the documentation that runs Hadoop TaskTracker or Node Manager to execute Splunk jobs}{\rtlch\fcs1 \ab\af0\afs18 \ltrch\fcs0 \f4\fs18\lang9\langfe1033\langnp9\insrsid3830700 \hich\af4\dbch\af37\loch\f4 on Hadoop nodes}{\rtlch\fcs1 \ab\af0\afs18 +\ltrch\fcs0 \f4\fs18\lang9\langfe1033\langnp9\insrsid2053910\charrsid8138548 . +\par }{\rtlch\fcs1 \ab\af0\afs18 \ltrch\fcs0 \i\f4\fs18\lang9\langfe1033\langnp9\insrsid9927413\charrsid8138548 \loch\af4\dbch\af37\hich\f4 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid2053910\charrsid8138548 \hich\af1\dbch\af37\loch\f1 Fracti} +{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid2053910\charrsid15169589 \hich\af1\dbch\af37\loch\f1 onal Use of Nodes}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \i\f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 means the greater of compute load or applicable storage of the number of Nodes in }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910\charrsid9639001 \hich\af1\dbch\af37\loch\f1 +Cluster(s) for a specific use case or business unit, }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 as }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910\charrsid9639001 \hich\af1\dbch\af37\loch\f1 +identified in an Order Document.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 +\par }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid2053910\charrsid11828462 \hich\af1\dbch\af37\loch\f1 Cluster}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 means a group of Nodes administered by one Hadoop JobTracker or Hadoop Resource Manager.\cell +}\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 +\ltrch\fcs0 \insrsid13976316 \trowd \irow4\irowband4\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvmgf\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb +\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572 +\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\trowd \irow5\irowband5\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 +\trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvmrg\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb +\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572 +\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\pard\plain \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid2053910 \cell \hich\af1\dbch\af37\loch\f1 Evaluation or Trial license\cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid5258355 {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid2053910 \hich\af1\dbch\af37\loch\f1 Maximum of five (5) Nodes from which data can be sourced to be analyzed and visualized}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14837237 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\ai\af1\afs18 \ltrch\fcs0 \i\fs18\cf18\loch\af1\hich\af1\dbch\af31501\insrsid2053910 \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid13976316 \trowd \irow5\irowband5\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb +\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvmrg\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb +\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572 +\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\trowd \irow6\irowband6\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 +\trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 +\clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572\clvertalt +\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\pard\plain \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid13976316 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid13976316 \hich\af1\dbch\af37\loch\f1 Splunk Enterprise Security }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1119707 \cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid7887901 \hich\af1\dbch\af37\loch\f1 Paid license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1119707 +\cell }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6172601 \hich\af1\dbch\af37\loch\f1 Daily \hich\af1\dbch\af37\loch\f1 Indexing Volume}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid1119707 \cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid13976316 \trowd \irow6\irowband6\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 +\clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572\clvertalt +\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\pard\plain \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid13976316 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid13976316 \hich\af1\dbch\af37\loch\f1 Splunk IT Service Intelligence (Splunk ITSI)\cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 { +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13976316 \hich\af1\dbch\af37\loch\f1 Paid license\cell }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid10040263 \hich\af1\dbch\af37\loch\f1 Daily Indexing Volume}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid13976316 \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid13976316 \trowd \irow7\irowband7\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb +\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 +\clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572\clvertalt +\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\pard\plain \ltrpar\ql \li0\ri0\sb200\sa240\sl276\slmult1\keep\keepn\widctlpar\intbl +\tqc\tx4680\tqr\tx9360\wrapdefault\aspalpha\aspnum\faauto\outlinelevel1\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid13976316\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Splunk }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14956530\charrsid10494223 \hich\af1\dbch\af37\loch\f1 User Behavior}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid10620334 \hich\af1\dbch\af37\loch\f1 Analytics (U}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13976316\charrsid10494223 \hich\af1\dbch\af37\loch\f1 BA)\cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13976316\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Paid license\cell }\pard \ltrpar +\ql \li0\ri0\sa240\sl276\slmult1\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid4865158 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13976316\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Number of }{\rtlch\fcs1 +\af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid14956530\charrsid10494223 \hich\af1\dbch\af37\loch\f1 User Behavior}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13976316\charrsid10494223 \hich\af1\dbch\af37\loch\f1 \hich\f1 Analytics Monitored Accounts. +\'93}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid13976316\charrsid5258355 \hich\af1\dbch\af37\loch\f1 Number of}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid14956530\charrsid5258355 \hich\af1\dbch\af37\loch\f1 User Behavior}{ +\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\i\f1\fs18\insrsid13976316\charrsid5258355 \hich\af1\dbch\af37\loch\f1 Analytics Monitored Accounts}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid13976316\charrsid10494223 \loch\af1\dbch\af37\hich\f1 \'94 +\loch\f1 means the number of user and system accounts in Microsoft Active Directory, Lightweight Directory Access Protocol (LDAP) or any similar service that is used to authenticate users inside the network. }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid16067760\charrsid10494223 \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid13976316 \trowd \irow8\irowband8\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb +\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 +\clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572\clvertalt +\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\pard\plain \ltrpar\ql \li0\ri0\sb200\sa240\sl276\slmult1\keep\keepn\widctlpar\intbl +\tqc\tx4680\tqr\tx9360\wrapdefault\aspalpha\aspnum\faauto\outlinelevel1\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid12352200\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Splunk App for PCI}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6911381 \hich\af1\dbch\af37\loch\f1 Compliance}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12352200\charrsid10494223 \cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12352200 +\hich\af1\dbch\af37\loch\f1 Paid license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\highlight7\insrsid12352200\charrsid13976316 \cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid4865158 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12352200 \hich\af1\dbch\af37\loch\f1 Daily Inde\hich\af1\dbch\af37\loch\f1 xing Volume}{\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\highlight7\insrsid12352200\charrsid13976316 \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid12352200 \trowd \irow9\irowband9\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb +\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 +\clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572\clvertalt +\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\pard\plain \ltrpar\ql \li0\ri0\sb200\sa240\sl276\slmult1\keep\keepn\widctlpar\intbl +\tqc\tx4680\tqr\tx9360\wrapdefault\aspalpha\aspnum\faauto\outlinelevel1\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 +\ltrch\fcs0 \f1\fs18\insrsid12352200\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Splunk App for }{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12352200 \hich\af1\dbch\af37\loch\f1 Microsoft}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid14172912 \hich\af1\dbch\af37\loch\f1 Exchange}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12352200\charrsid10494223 \cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12352200 \hich\af1\dbch\af37\loch\f1 Paid license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\highlight7\insrsid12352200\charrsid13976316 \cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid4865158 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12352200 \hich\af1\dbch\af37\loch\f1 Daily Indexing Volume}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\highlight7\insrsid12352200\charrsid13976316 \cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid12352200 \trowd \irow10\irowband10\ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 +\clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572\clvertalt +\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row \ltrrow}\pard\plain \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12352200\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Splunk App for VMware}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\highlight7\insrsid12352200 \cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid1917023 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid12352200 \hich\af1\dbch\af37\loch\f1 Paid license}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\highlight7\insrsid12352200\charrsid13976316 \cell }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\pararsid4865158 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 +\f1\fs18\insrsid12352200 \hich\af1\dbch\af37\loch\f1 Daily Indexing Volume}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\highlight7\insrsid12352200\charrsid13976316 \cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid12352200 \trowd \irow11\irowband11\lastrow \ltrrow\ts24\trgaph108\trleft-108\trbrdrt\brdrs\brdrw10 \trbrdrl\brdrs\brdrw10 \trbrdrb\brdrs\brdrw10 \trbrdrr\brdrs\brdrw10 \trbrdrh\brdrs\brdrw10 \trbrdrv\brdrs\brdrw10 +\trftsWidth1\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2053910\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind0\tblindtype3 \clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 +\clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1368\clshdrawnil \cellx1260\clvertalt\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth1312\clshdrawnil \cellx2572\clvertalt +\clbrdrt\brdrs\brdrw10 \clbrdrl\brdrs\brdrw10 \clbrdrb\brdrs\brdrw10 \clbrdrr\brdrs\brdrw10 \cltxlrtb\clftsWidth3\clwWidth6896\clshdrawnil \cellx9468\row }\pard \ltrpar\ql \li0\ri0\sa240\sl276\slmult1 +\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid14694974 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8674892 +\par }\pard \ltrpar\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid8674892 \page +\par }\pard \ltrpar\qc \li0\ri0\sa200\sl276\slmult1\nowidctlpar\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\outlinelevel0\rin0\lin0\itap0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\f1\fs17\ul\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 E{\*\bkmkstart _Ref193278264}{\*\bkmkend _Ref193278264}XHIBIT }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\ul\insrsid1455894 \hich\af1\dbch\af37\loch\f1 C}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \b\f1\fs17\ul\insrsid10492054\charrsid11476353 +\par }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 S{\*\bkmkstart _Ref192560279}{\*\bkmkstart _Ref192560486}{\*\bkmkstart _Ref192564064}{\*\bkmkstart _Ref192564087}{\*\bkmkstart _Ref192564129} +{\*\bkmkend _Ref192560279}{\*\bkmkend _Ref192560486}{\*\bkmkend _Ref192564064}{\*\bkmkend _Ref192564087}{\*\bkmkend _Ref192564129}PLUNK INC. +\par }\pard \ltrpar\qc \li0\ri0\sa240\nowidctlpar\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\outlinelevel0\rin0\lin0\itap0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 SUPPORT AND MAINTENANCE TERMS AND CONDITIONS +\par }\pard \ltrpar\qj \li0\ri0\sa240\nowidctlpar\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\itap0\pararsid9715860 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 agree}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 that the following terms and conditions (}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \b\i\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Terms and Conditions}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 govern the delivery of any support and/or maintenance services by Splunk (}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\i\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Support}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 ) listed on an Order}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12338951 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +entered into pursuant to the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12190962 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + License Agreement (the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\i\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Agreement}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ) to whic\hich\af1\dbch\af37\loch\f1 +h these Terms and Conditions are attached and made a part thereof.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Subject to }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + termination rights set forth in the Agreement, ordering any Support from Splunk or any authorized reseller indicates }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 acceptance of these Terms and Condition\hich\af1\dbch\af37\loch\f1 s.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 These Terms and Conditions are effective upon receipt and confirmation of acceptance of }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 +Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 purchase order by Splunk or an }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8154834 \hich\af1\dbch\af37\loch\f1 A}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 uthorized }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8154834 \hich\af1\dbch\af37\loch\f1 Partner}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 (the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\i\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Effective Date}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ).}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\par {\*\bkmkstart _Ref192564047}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f4\fs18\insrsid10492054\charrsid11476353 \hich\af4\dbch\af37\loch\f4 1.\tab}}\pard \ltrpar +\qj \fi-540\li540\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\outlinelevel0\rin0\lin540\itap0\pararsid14501514 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 DEFINITIONS.}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Unless otherwise defined in these Terms and Conditions, capitalized terms }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid7942271 \hich\af1\dbch\af37\loch\f1 ha}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid2050835 \hich\af1\dbch\af37\loch\f1 +ve}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 the meanings set forth in the Agreement. }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +{\*\bkmkend _Ref192564047} +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f4\fs18\insrsid10492054\charrsid11476353 \hich\af4\dbch\af37\loch\f4 2.\tab}\hich\af1\dbch\af37\loch\f1 SUPPORT AND MAINTENANCE.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.1\tab}}\pard \ltrpar +\qj \fi-720\li1260\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\ilvl1\outlinelevel0\rin0\lin1260\itap0\pararsid12995408 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Services.}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Subject to }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 timely payment of the applicable annual Support fees set forth in }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5965557 +\hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Order}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 (the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\i\f1\fs17\insrsid10492054\charrsid12338951 \hich\af1\dbch\af37\loch\f1 Support Fees}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ), Splunk will provide the level of Support identified in }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5965557 \hich\af1\dbch\af37\loch\f1 the }{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid12338951 \hich\af1\dbch\af37\loch\f1 Order}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + in accordance with the Support descriptions set forth below. No other maintenance or support for the Software is included.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.2\tab}\hich\af1\dbch\af37\loch\f1 Support Fees.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Support Fees will be due and pay\hich\af1\dbch\af37\loch\f1 +able in accordance with the Order. Splunk will notify (electronic}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3615011 \hich\af1\dbch\af37\loch\f1 ally}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 + or otherwise) Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 of the then-current annual Support Fee for }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 level of Support in each notice of term renewal. Support Fees }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5965557 \hich\af1\dbch\af37\loch\f1 are }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 non-refundable once paid.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\f1\fs17\insrsid10492054\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.3\tab}\hich\af1\dbch\af37\loch\f1 Exclusions.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk will have no obligation of any kind to provide Support for }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid3352585 \hich\af1\dbch\af37\loch\f1 issues}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3352585\charrsid11476353 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 caused by or arising out of any of the following (each, a }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\i\f1\fs17\insrsid10492054\charrsid12338951 \hich\af1\dbch\af37\loch\f1 Licensee-Generated Error}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ): (i) modifications to the Software not made by Splunk; (ii) use of the Software other than as aut\hich\af1\dbch\af37\loch\f1 +horized in the Agreement or as provided in the documentation for the Software; (iii) damage to the machine on which the Software is installed; (iv) }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 Customer}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 +s continued failure to use the Software without reference to the documentation}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ; (v) versions of the\hich\af1\dbch\af37\loch\f1 + Software other than the most recent version or the Supported Prior Version (defined in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid220955 \hich\af1\dbch\af37\loch\f1 REF _Ref364672445 \\r \\h }{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid220955 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003300360034003600370032003400340035000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9896659 +\hich\af1\dbch\af37\loch\f1 2.6.8}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +); (vi) third-party products not expressly supported by Splunk}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3352585 \hich\af1\dbch\af37\loch\f1 and described} +{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid13319085 \hich\af1\dbch\af37\loch\f1 in the documentation}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +; or (vii) conflicts related to replacing or installing hardware, drivers, and software that}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 ar\hich\af1\dbch\af37\loch\f1 e not expressly supported by }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3352585 \hich\af1\dbch\af37\loch\f1 and described}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid3222951\charrsid13319085 \hich\af1\dbch\af37\loch\f1 in the documentation}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 .}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 If Splunk determines that }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3352585 \hich\af1\dbch\af37\loch\f1 +support }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 for }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3352585 \hich\af1\dbch\af37\loch\f1 an issue}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 caused by a Licensee-Generat}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 ed Error, Splunk will notify Customer}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid3352585 \hich\af1\dbch\af37\loch\f1 as soon as reasonably po}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12338951 \hich\af1\dbch\af37\loch\f1 ssible under the circumstances.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 If Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 agr +\hich\af1\dbch\af37\loch\f1 ee}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 + that Splunk should provide support for the Licensee-Generated Error via a confirming email, then }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk wi}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 ll have the right to invoice Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid11476353 \hich\af1\dbch\af37\loch\f1 at Splunk}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid11476353 \hich\af1\dbch\af37\loch\f1 s then-current time and materials rates for any }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 such support provided by Splunk}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 .}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 2.4\tab}}\pard \ltrpar +\qj \fi-720\li1260\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\ilvl1\outlinelevel0\rin0\lin1260\itap0\pararsid3222951 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 Support for \hich\af1\dbch\af37\loch\f1 +Splunk Extensions.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid9858382 \hich\af1\dbch\af37\loch\f1 Subject to }{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 +\hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid9858382 \hich\af1\dbch\af37\loch\f1 payment of}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid11476353 \hich\af1\dbch\af37\loch\f1 the applicable annual Support fees}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 , if Customer}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 are a licensee of a Splunk Extension supported by Splunk, }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid1904115 \hich\af1\dbch\af37\loch\f1 +Splunk will provide an Initial Response and Acknowledgement }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 in }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid1904115 +\hich\af1\dbch\af37\loch\f1 accordance with P3 terms as describ\hich\af1\dbch\af37\loch\f1 ed in Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 REF _Ref192560496 \\r \\h }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003100390032003500360030003400390036000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9896659 +\hich\af1\dbch\af37\loch\f1 2.6.3}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid3222951\charrsid1904115 \hich\af1\dbch\af37\loch\f1 below.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid1904115 +\hich\af1\dbch\af37\loch\f1 Updates for the Software will be provided when made available.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 +\hich\af1\dbch\af37\loch\f1 No other sections in these Terms and Conditions apply to Splunk \hich\af1\dbch\af37\loch\f1 Extensions.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid3222951\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.5\tab}}\pard \ltrpar +\qj \fi-720\li1260\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\ilvl1\outlinelevel0\rin0\lin1260\itap0\pararsid14501514 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Restrictions.}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Support is delivered }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid6057856 \hich\af1\dbch\af37\loch\f1 only in English}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 unless Customer is}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 in a location where Splunk has made localized Support available. }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.6\tab}\hich\af1\dbch\af37\loch\f1 Support Descriptions. +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.6.1\tab}}\pard \ltrpar +\qj \fi-720\li1980\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\ilvl2\outlinelevel0\rin0\lin1980\itap0\pararsid14501514 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\ul\insrsid3222951\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk Support.}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1138390 \hich\af1\dbch\af37\loch\f1 Customer\hich\f1 \rquote \loch\f1 s Order will identify one of}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 \hich\af1\dbch\af37\loch\f1 + three levels of Support: Standa}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1138390 \hich\af1\dbch\af37\loch\f1 rd, Enterprise or}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3016834 \hich\af1\dbch\af37\loch\f1 Global}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3222951 .}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 +Every level of Splunk Support\~provides telephone support, online documentation, web forums, email and a web-based portal for submitting cases and tracking case status.\~Support cases are handled based on case priority leve}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid1011594 \hich\af1\dbch\af37\loch\f1 ls as \hich\af1\dbch\af37\loch\f1 described in Section\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594 \hich\af1\dbch\af37\loch\f1 REF _Ref192560280 \\w \\h +}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003100390032003500360030003200380030000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid9896659 \hich\af1\dbch\af37\loch\f1 2.6.2}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 . W}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594 \hich\af1\dbch\af37\loch\f1 hen submitting a case, Customer will}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 + select the priority for initial response by logging the case online, in accordance with the priori\hich\af1\dbch\af37\loch\f1 ty guidelines set forth in Section\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594 +\hich\af1\dbch\af37\loch\f1 REF _Ref192560280 \\w \\h }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003100390032003500360030003200380030000000}} +}{\fldrslt {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9896659 \hich\af1\dbch\af37\loch\f1 2.6.2}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 . When the case is received, Splunk Support may change the priority if the issue does not conform to the criteria for the se\hich\af1\dbch\af37\loch\f1 +lected priority and will provide Customer with notice (electronic or otherwise) of such change.\~\~Splunk Standard Support means in the first forty-five (45) days from delivery of the\~Purchased\~ +Software, Splunk will provide an Initial Response and Acknowled\hich\af1\dbch\af37\loch\f1 g\hich\af1\dbch\af37\loch\f1 ement\~for\~P3\~issues only\~and\~will provide Software updates, when available}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1011594\charrsid7031491 .\~}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid4998677\charrsid4079296 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730\charrsid15081904 \hich\af1\dbch\af37\loch\f1 +Splunk will provide }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid989329\charrsid15081904 \hich\af1\dbch\af37\loch\f1 to Customers of Test and Development Software }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730\charrsid15081904 +\hich\af1\dbch\af37\loch\f1 P4 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid6577841\charrsid15081904 \hich\af1\dbch\af37\loch\f1 upport through a web-based portal only.}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \f1\fs18\insrsid6577841 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 For Splunk Enterprise or Splunk Global}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594 +\hich\af1\dbch\af37\loch\f1 Supports}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 ,\~\hich\af1\dbch\af37\loch\f1 Splunk will respond to }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594 +\hich\af1\dbch\af37\loch\f1 support}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 requests and will provide workarounds or fixes in accordance with the guide}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1011594 \hich\af1\dbch\af37\loch\f1 lines set forth in Section\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594 \hich\af1\dbch\af37\loch\f1 REF _Ref192560496 \\w \\h }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1011594 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003100390032003500360030003400390036000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9896659 \hich\af1\dbch\af37\loch\f1 +2.6.3}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 . Splunk Global Support\~\hich\af1\dbch\af37\loch\f1 +also provides a }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730 \hich\af1\dbch\af37\loch\f1 primary}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 contact }{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid5653730 \hich\af1\dbch\af37\loch\f1 to set up}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 meetings}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730 ,}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 as frequently as weekly}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730 ,}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 to monitor Customer\hich\f1 \rquote \loch\f1 +s support issues; to provide additional status reports and metrics; and to coordinate and execute a quarterly account status review at a mutually agreeable tim\hich\af1\dbch\af37\loch\f1 e.\~\~For a }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1859867 \hich\af1\dbch\af37\loch\f1 summary}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 of the different support programs}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1859867 \hich\af1\dbch\af37\loch\f1 , please visit}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 \~}{\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid9843213 \hich\af0\dbch\af37\loch\f0 + HYPERLINK "http://www.splunk.com/en_us/support-and-services/support-programs.html" }}{\fldrslt {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \cs22\f1\fs17\ul\cf2\insrsid1011594\charrsid1011594 \hich\af1\dbch\af37\loch\f1 +http://www.splunk.com/en_us/support-and-services/support-programs.html}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1011594\charrsid1011594 .}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\par {\*\bkmkstart _Ref192560280}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.6.2\tab}}\pard \ltrpar +\qj \fi-720\li1980\ri0\sa240\keep\keepn\nowidctlpar\wrapdefault\faauto\ls6\ilvl2\outlinelevel0\rin0\lin1980\itap0\pararsid14501514 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\ul\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Case Priority Levels.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Case priorities are assigned based on the technical i}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid12994275\charrsid11476353 \hich\af1\dbch\af37\loch\f1 mportance of the problem on }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Splunk environment.{\*\bkmkend _Ref192560280} }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\par \ltrrow}\trowd \irow0\irowband0\ltrrow\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 +\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth7560\clshdrawnil \cellx9450\pard\plain \ltrpar\qj \li0\ri0\sa240\nowidctlpar\intbl +\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx5600\wrapdefault\faauto\rin0\lin0\pararsid14501514 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid87762 \hich\af1\dbch\af37\loch\f1 P1 = }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid2718300 \hich\af1\dbch\af37\loch\f1 Purchased }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Software is completely inaccessible or the majority of its functionality is unusable. \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 +\af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid10492054\charrsid11476353 \trowd \irow0\irowband0\ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth7560\clshdrawnil \cellx9450\row \ltrrow}\pard\plain \ltrpar\qj \li0\ri0\sa240\nowidctlpar\intbl +\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P2 = One}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid87762 \hich\af1\dbch\af37\loch\f1 or more key features of }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid2718300 \hich\af1\dbch\af37\loch\f1 Purchased }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Software are unusable. \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid10492054\charrsid11476353 \trowd \irow1\irowband1\ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth7560\clshdrawnil \cellx9450\row \ltrrow}\pard\plain \ltrpar\qj \li0\ri0\sa240\nowidctlpar\intbl +\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P3 =}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid87762 +\hich\af1\dbch\af37\loch\f1 Any other case where a }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid2718300 \hich\af1\dbch\af37\loch\f1 Purchased }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid87762 \hich\af1\dbch\af37\loch\f1 S}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 oftware feature is not operating as documented. }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054 +\par }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730 \hich\af1\dbch\af37\loch\f1 P4 = }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid2036461 \hich\af1\dbch\af37\loch\f1 G}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730 +\hich\af1\dbch\af37\loch\f1 eneral questions and}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730\charrsid5653730 \hich\af1\dbch\af37\loch\f1 requests for enhancements to the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730 +\hich\af1\dbch\af37\loch\f1 Purchased}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730\charrsid5653730 \hich\af1\dbch\af37\loch\f1 Software}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12198352 .}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid5653730\charrsid11476353 \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid10492054\charrsid11476353 \trowd \irow2\irowband2\lastrow \ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth7560\clshdrawnil \cellx9450\row {\*\bkmkstart _Ref192560496}{\*\bkmkstart _Ref364673632}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.6.3\tab}}\pard \ltrpar\qj \fi-720\li1980\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\ilvl2\outlinelevel0\rin0\lin1980\itap0\pararsid14501514 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\ul\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Target Fix, Workaround, Escalation and Response \hich\af1\dbch\af37\loch\f1 Times.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +{\*\bkmkend _Ref192560496}{\*\bkmkend _Ref364673632} +\par \ltrrow}\trowd \irow0\irowband0\ltrrow\ts11\trgaph108\trrh585\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2713871\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 +\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl +\cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\pard\plain \ltrpar\ql \li0\ri0\nowidctlpar\intbl +\tx560\tx1120\tx1680\tx2240\tx2800\tx3492\tx3582\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\outlinelevel0\rin0\lin0\pararsid1777042 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Initial Response & Acknowledgment, +\par }\pard \ltrpar\ql \li0\ri252\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3492\tx3582\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\outlinelevel0\rin252\lin0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 by case priority\cell }\pard \ltrpar\ql \li0\ri0\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 { +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Targeted Fix Date or Workaround, +\par \hich\af1\dbch\af37\loch\f1 by case priority\cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid10492054\charrsid11476353 \trowd \irow0\irowband0\ltrrow +\ts11\trgaph108\trrh585\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid2713871\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row \ltrrow +}\trowd \irow1\irowband1\ltrrow\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt +\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450 +\pard\plain \ltrpar\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3492\tx3582\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P1:\tab 4 hours \cell }\pard \ltrpar +\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 P1:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 1 day \cell +}\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 +\ltrch\fcs0 \insrsid10492054\charrsid11476353 \trowd \irow1\irowband1\ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl +\clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row \ltrrow +}\pard\plain \ltrpar\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3492\tx3582\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P2:\tab Next business day \cell }\pard \ltrpar +\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 P2:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 1 week \cell +}\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 +\ltrch\fcs0 \insrsid10492054\charrsid11476353 \trowd \irow2\irowband2\ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl +\clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row \ltrrow +}\pard\plain \ltrpar\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3492\tx3582\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P3:\tab Two business days\cell }\pard \ltrpar +\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 P3:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Next release \cell +}\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 +\ltrch\fcs0 \insrsid10492054\charrsid11476353 \trowd \irow3\irowband3\ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl +\clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row \ltrrow +}\pard\plain \ltrpar\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3492\tx3582\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P4:\tab Two business days\cell }\pard \ltrpar +\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 P4:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 At Splunk}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 s discretion \cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid10492054\charrsid11476353 \trowd \irow4\irowband4\lastrow \ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl +\clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row }\pard \ltrpar +\ql \li0\ri0\sa120\nowidctlpar\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\itap0\pararsid9505875 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\par \ltrrow}\trowd \irow0\irowband0\ltrrow\ts11\trgaph108\trrh729\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband +\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl +\cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\pard\plain \ltrpar\ql \li0\ri0\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 \rtlch\fcs1 +\af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Escalation, +\par \hich\af1\dbch\af37\loch\f1 by case priority \cell \hich\af1\dbch\af37\loch\f1 Email Status Updates for Open Cases, +\par \hich\af1\dbch\af37\loch\f1 by case priority}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid10492054\charrsid11476353 \trowd \irow0\irowband0\ltrrow +\ts11\trgaph108\trrh729\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl +\clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row \ltrrow +}\trowd \irow1\irowband1\ltrrow\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 +\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl +\cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\pard\plain \ltrpar\ql \fi-371\li342\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid3743693 +\rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P1:}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Manager: Immediate / VP: 1 business day}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \cell }\pard \ltrpar\ql \li0\ri0\sa120\nowidctlpar\intbl +\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P1:}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Daily\cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid10492054\charrsid11476353 \trowd \irow1\irowband1\ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row \ltrrow +}\pard\plain \ltrpar\ql \fi-362\li342\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid3743693 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P2:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Manager: 1 business day / VP: 1 week\cell }\pard \ltrpar\ql \li0\ri0\sa120\nowidctlpar\intbl +\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P2:}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Weekly \cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid10492054\charrsid11476353 \trowd \irow2\irowband2\ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row \ltrrow +}\pard\plain \ltrpar\ql \fi-360\li342\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid3743693 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P3:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 VP Product Management reviews all open\hich\af1\dbch\af37\loch\f1 bugs quarterly\cell }\pard \ltrpar +\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 P3:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 None \cell +}\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 +\ltrch\fcs0 \insrsid10492054\charrsid11476353 \trowd \irow3\irowband3\ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row \ltrrow +}\pard\plain \ltrpar\ql \fi-360\li342\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid3743693 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P4:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 VP Product Management reviews all enhancement requests quarterly}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid8336779\charrsid11476353 \cell }\pard \ltrpar\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid1777042 {\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P4:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 None \cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid10492054\charrsid11476353 \trowd \irow4\irowband4\lastrow \ltrrow +\ts11\trgaph108\trleft1890\trftsWidth3\trwWidth7560\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid1777042\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind1998\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4230\clshdrawnil \cellx6120\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3330\clshdrawnil \cellx9450\row }\pard \ltrpar +\qj \li1987\ri0\sa120\nowidctlpar\tx-180\tx3920\tx4480\tx5040\tx6160\tx6720\wrapdefault\faauto\outlinelevel0\rin0\lin1987\itap0\pararsid11476353 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid1777042\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.6.4\tab}}\pard \ltrpar +\qj \fi-720\li1980\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\ilvl2\outlinelevel0\rin0\lin1980\itap0\pararsid9639001 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\ul\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Authorized Support Contacts.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Support will be provided solely to the authorize}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 +\hich\af1\dbch\af37\loch\f1 d individual(s) specified by Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 that Splunk will communicate with }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid2718300 \hich\af1\dbch\af37\loch\f1 that individual(s) }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 when providing Support (}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\i\f1\fs17\insrsid10492054\charrsid12338951 \hich\af1\dbch\af37\loch\f1 Support Contacts}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 +\loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ). Splunk strongly recommends that }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Support Contact(s) be trained on the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid2718300 \hich\af1\dbch\af37\loch\f1 Purchased }{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Software. }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 +\loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + Order will indicate a maximum number of author\hich\af1\dbch\af37\loch\f1 ized Support Contacts for }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 + license level.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 will be asked to designate }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 authorized support contacts, including their primary email address and Splunk.com login ID, following Splunk}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 s acknowledgment of }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Order. }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid11476353\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.6.5\tab}}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\ul\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Defect \hich\af1\dbch\af37\loch\f1 Resolution.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Should Splunk in its sole judgment determine that there is a defect in the }{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid2718300 \hich\af1\dbch\af37\loch\f1 Purchased }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Software, it will, at its sole option, repair that defect in the vers}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 ion of the Software that Customer is currently using or instruct Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 to install a new\hich\af1\dbch\af37\loch\f1 er version of the Software with that defect repaired. Splunk r}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 +eserves the right to provide Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + with a workaround in lieu of fixing a defect should it in its sole judgment determine that it is more effective to do so. }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.6.6\tab}}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\ul\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Support Hours.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Support is provide\hich\af1\dbch\af37\loch\f1 d via telephone, email and web portal. Support will be delivered by a member of Splunk} +{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +s technical support team during the regional hours of operation listed below.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid14506794\charrsid11476353 +\par \ltrrow}\trowd \irow0\irowband0\ltrrow +\ts11\trgaph108\trleft2250\trftsWidth3\trwWidth8079\trftsWidthB3\trftsWidthA3\trwWidthA495\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid9639001\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind2358\tblindtype3 \clvertalt +\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4050\clshdrawnil \cellx6300\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3534\clshdrawnil +\cellx9834\pard\plain \ltrpar\ql \li0\ri0\sa240\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid11476353 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid12347501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Enterprise Support\cell }\pard \ltrpar +\ql \li-18\ri0\sa240\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin-18\pararsid11476353 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Global Support\cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid12347501\charrsid11476353 \trowd \irow0\irowband0\ltrrow +\ts11\trgaph108\trleft2250\trftsWidth3\trwWidth8079\trftsWidthB3\trftsWidthA3\trwWidthA495\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid9639001\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind2358\tblindtype3 \clvertalt +\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4050\clshdrawnil \cellx6300\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth3534\clshdrawnil +\cellx9834\row \ltrrow}\trowd \irow1\irowband1\ltrrow +\ts11\trgaph108\trleft2250\trftsWidth3\trwWidth8079\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid9639001\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind2358\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4050\clshdrawnil \cellx6300\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4029\clshdrawnil \cellx10329\pard\plain \ltrpar +\ql \li0\ri0\sa120\nowidctlpar\intbl\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin0\pararsid11476353 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12347501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P1:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12347501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 24 x 7\cell }\pard \ltrpar\ql \li-18\ri0\sa120\nowidctlpar\intbl +\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin-18\pararsid11476353 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P1:}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 24 x 7\cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid12347501\charrsid11476353 \trowd \irow1\irowband1\ltrrow +\ts11\trgaph108\trleft2250\trftsWidth3\trwWidth8079\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid9639001\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind2358\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4050\clshdrawnil \cellx6300\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4029\clshdrawnil \cellx10329\row \ltrrow +}\pard\plain \ltrpar\ql \fi-360\li342\ri0\sa120\nowidctlpar\intbl\tx1120\tx1680\tx2240\tx2800\tx3360\tx3582\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid11476353 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12347501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P2:}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12347501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Monday through Friday by \hich\af1\dbch\af37\loch\f1 +region (North America, APAC and EMEA) during standard business hours (8 am to 5 pm); excluding Splunk holidays\cell }\pard \ltrpar\ql \fi-360\li342\ri0\sa120\nowidctlpar\intbl +\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid11476353 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P2:}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +24 hours per day during the five business days (Monday through Friday), excluding Splunk holidays\cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid12347501\charrsid11476353 \trowd \irow2\irowband2\ltrrow +\ts11\trgaph108\trleft2250\trftsWidth3\trwWidth8079\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid9639001\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind2358\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4050\clshdrawnil \cellx6300\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4029\clshdrawnil \cellx10329\row \ltrrow +}\trowd \irow3\irowband3\ltrrow\ts11\trgaph108\trrh270\trleft2250\trftsWidth3\trwWidth8079\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid9639001\tbllkhdrrows\tbllkhdrcols\tbllknocolband +\tblind2358\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4050\clshdrawnil \cellx6300\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl +\cltxlrtb\clftsWidth3\clwWidth4029\clshdrawnil \cellx10329\pard\plain \ltrpar\ql \fi-360\li342\ri0\sa120\nowidctlpar\intbl\tx1120\tx1680\tx2240\tx2800\tx3360\tx3582\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid11476353 \rtlch\fcs1 +\af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12347501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P3:}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12347501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Monday through Friday by region (North America, APAC and EMEA) during standard business hours (8 am to 5 pm); excluding Splunk holidays\cell }\pard \ltrpar\ql \fi-360\li342\ri0\sa120\nowidctlpar\intbl +\tx432\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid11476353 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P3:}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +24 hours per day during the five business days (Monday through Friday), excluding Splunk holidays\cell }\pard\plain \ltrpar\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 +\fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid12347501\charrsid11476353 \trowd \irow3\irowband3\ltrrow +\ts11\trgaph108\trrh270\trleft2250\trftsWidth3\trwWidth8079\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid9639001\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind2358\tblindtype3 \clvertalt\clbrdrt\brdrtbl +\clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4050\clshdrawnil \cellx6300\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4029\clshdrawnil \cellx10329\row +\ltrrow}\trowd \irow4\irowband4\lastrow \ltrrow\ts11\trgaph108\trleft2250\trftsWidth3\trwWidth8079\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid9639001\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind2358 +\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4050\clshdrawnil \cellx6300\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl +\cltxlrtb\clftsWidth3\clwWidth4029\clshdrawnil \cellx10329\pard\plain \ltrpar\ql \fi-360\li342\ri0\sa120\nowidctlpar\intbl\tx1120\tx1680\tx2240\tx2800\tx3360\tx3582\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid11476353 \rtlch\fcs1 +\af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12347501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P4:}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12347501\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Monday \hich\af1\dbch\af37\loch\f1 +through Friday by region (North America, APAC and EMEA) during standard business hours (8 am to 5 pm); excluding Splunk holidays\cell }\pard \ltrpar\ql \fi-360\li342\ri0\sa60\nowidctlpar\intbl +\tx432\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\rin0\lin342\pararsid11476353 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 P4:}{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Monday through Friday by region (North America, APAC and EMEA) during standard business hours (8 am to 5 pm); excluding Spl\hich\af1\dbch\af37\loch\f1 unk holidays\cell }\pard\plain \ltrpar +\ql \li0\ri0\widctlpar\intbl\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs24\lang1033\langfe1033\loch\af0\hich\af0\dbch\af37\cgrid\langnp1033\langfenp1033 {\rtlch\fcs1 \af0 \ltrch\fcs0 +\insrsid12347501\charrsid11476353 \trowd \irow4\irowband4\lastrow \ltrrow +\ts11\trgaph108\trleft2250\trftsWidth3\trwWidth8079\trftsWidthB3\trautofit1\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\tblrsid9639001\tbllkhdrrows\tbllkhdrcols\tbllknocolband\tblind2358\tblindtype3 \clvertalt\clbrdrt\brdrtbl \clbrdrl +\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4050\clshdrawnil \cellx6300\clvertalt\clbrdrt\brdrtbl \clbrdrl\brdrtbl \clbrdrb\brdrtbl \clbrdrr\brdrtbl \cltxlrtb\clftsWidth3\clwWidth4029\clshdrawnil \cellx10329\row }\pard \ltrpar +\qj \li1886\ri0\sa120\nowidctlpar\tx560\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\wrapdefault\faauto\outlinelevel0\rin0\lin1886\itap0\pararsid9505875 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid9715860\charrsid11476353 + +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 2.6.7\tab}}\pard \ltrpar +\qj \fi-720\li1980\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\ilvl2\outlinelevel0\rin0\lin1980\itap0\pararsid10232415 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\ul\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\ul\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\ul\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\ul\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 Obligation to Assist.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 Should Customer}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 report a purported defect in the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid2718300 \hich\af1\dbch\af37\loch\f1 Purchased }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Software t}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 o Splunk, Splunk may require Customer}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + to provide them with the following information: (a) a general description of the operating environment, (b) a list of all hardware components, operating systems and networks, (c) a reproducible test case, and (d) any log files, trace and systems files. } +{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Cu\hich\af1\dbch\af37\loch\f1 stomer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + failure to provide this information may prevent Splunk from identifying and fixing that purported defect. }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\par {\*\bkmkstart _Ref364672445}{\*\bkmkstart _Ref193276014}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 2.6.8\tab}}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\ul\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Software Upgrades and Software End of Life Policy.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 + When available, Splunk provides updates, upgrades, maintenance releases and reset keys on\hich\af1\dbch\af37\loch\f1 ly to Splunk Support custom}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid87762\charrsid10494223 \hich\af1\dbch\af37\loch\f1 ers.}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159\charrsid10494223 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Software comes with a }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9178332 \hich\af1\dbch\af37\loch\f1 three-}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 digit number version.\~ +The first digit represents the major release (i.e. upgrade), the second digit identifies the minor releases (i.e.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1859867\charrsid10494223 ,}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 updates) and the third digit identifies the maintenance rel\hich\af1\dbch\af37\loch\f1 eases.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159\charrsid10494223 +\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 With a new major version, the number to the left of the\~ +decimal is changed and for minor releases, the number to the right of the decimal point is increased.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159\charrsid10494223 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Subject to the foregoing, Splunk provides full Support, including, when available, bug fixe\hich\af1\dbch\af37\loch\f1 s, }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid16086670 \hich\af1\dbch\af37\loch\f1 only on the current major release and (a) the immediately prior major release or (b) twenty-four months from the then current major release}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid2621760\charrsid10494223 \hich\af1\dbch\af37\loch\f1 , whichever period is }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730 \hich\af1\dbch\af37\loch\f1 longer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413\charrsid10494223 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\i\f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 Supported Prior Versions}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413\charrsid10494223 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid10494223 \hich\af1\dbch\af37\loch\f1 ).}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid4865158\charrsid10494223 {\*\bkmkend _Ref364672445}\hich\af1\dbch\af37\loch\f1 + Notwithstanding the foregoing, Splunk will provide support for the first annual term for }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10620334 \hich\af1\dbch\af37\loch\f1 U}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid4865158\charrsid10494223 \hich\af1\dbch\af37\loch\f1 BA in accordance with the following terms: Support will be provided only for use }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10494223\charrsid10494223 +\hich\af1\dbch\af37\loch\f1 of the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid4865158\charrsid10494223 \hich\af1\dbch\af37\loch\f1 most current version of }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10620334 \hich\af1\dbch\af37\loch\f1 +U}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid4865158\charrsid10494223 \hich\af1\dbch\af37\loch\f1 BA plus the prior two releases, whether a minor or\hich\af1\dbch\af37\loch\f1 major release, or}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10620334 \hich\af1\dbch\af37\loch\f1 one year from delivery of U}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid4865158\charrsid10494223 \hich\af1\dbch\af37\loch\f1 BA}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid16067760 +{\*\bkmkend _Ref193276014}\hich\af1\dbch\af37\loch\f1 , whichever }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid5653730 \hich\af1\dbch\af37\loch\f1 period }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid16067760 \hich\af1\dbch\af37\loch\f1 +is longer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9071595\charrsid10494223 .}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid14054746 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\f1\fs17\insrsid10492054\charrsid10494223 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 2.7\tab}}\pard \ltrpar +\qj \fi-740\li1260\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\ilvl1\outlinelevel0\rin0\lin1260\itap0\pararsid12995408 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 +Changes in Support and Software}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 .}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid9663787 \hich\af1\dbch\af37\loch\f1 Subject to Section }{\field{\*\fldinst {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9663787 \hich\af1\dbch\af37\loch\f1 REF _Ref364672445 \\r \\h }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid9663787 {\*\datafield 08d0c9ea79f9bace118c8200aa004ba90b02000000080000000e0000005f005200650066003300360034003600370032003400340035000000}}}{\fldrslt {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9896659 \hich\af1\dbch\af37\loch\f1 +2.6.8}}}\sectd \ltrsect\linex0\headery456\endnhere\sectdefaultcl\sectrsid11476353\sftnbj {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8673657 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 +\hich\af1\dbch\af37\loch\f1 Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 acknowledge}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 s}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 that Splunk has the right to discontinue the manufacture and development of any Software and the Supp}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1859867 \hich\af1\dbch\af37\loch\f1 ort for any Software, including}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 the distribution of older Software \hich\af1\dbch\af37\loch\f1 +versions, at any time in its sole discretion, provided that Splunk agrees not to discontinue Support for the Software during the current annual term of these Terms and Conditions, subject to the termination provisions herein.}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk reserves the right to a\hich\af1\dbch\af37\loch\f1 +lter Support from time to time, using reasonable discretion but in no event }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 such alterations result in (i) diminished support from the level of Support set forth herein; (ii) materially diminished obligations for Splunk; (iii) materially diminished }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid15749283 \hich\af1\dbch\af37\loch\f1 Cu\hich\af1\dbch\af37\loch\f1 stomer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid15749283 +\hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 rights; or (iv) higher Support Fees during the then-curren}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 t term.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 Splunk }{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 provide Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 with thirty (30) days}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8133367 \loch\af1\dbch\af37\hich\f1 \rquote }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 prior written notice (delivered electronically or otherwise) of any permitted material changes to the Support contemplated herein.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f4\fs18\insrsid10492054\charrsid11476353 \hich\af4\dbch\af37\loch\f4 3.\tab}}\pard \ltrpar +\qj \fi-540\li540\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\outlinelevel0\rin0\lin540\itap0\pararsid12995408 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 TERM AND TERMINATION. }{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \i\f1\fs17\insrsid10492054\charrsid11476353 +\par {\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 3.1\tab}}\pard \ltrpar +\qj \fi-360\li1260\ri0\sa240\nowidctlpar\wrapdefault\faauto\ls6\ilvl1\rin0\lin1260\itap0\pararsid9639001 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Term.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 These Terms and Conditions will commence on the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 Delivery date}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 and, unless terminated earlier i\hich\af1\dbch\af37\loch\f1 +n accordance with the terms of the Agreement, for a period of one }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3615011 \hich\af1\dbch\af37\loch\f1 (1) }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\hich\af1\dbch\af37\loch\f1 year }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid87762\charrsid1904115 \hich\af1\dbch\af37\loch\f1 (or for term purchased if different than one year) }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 thereafter (the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\b\i\f1\fs17\insrsid10492054\charrsid12338951 \hich\af1\dbch\af37\loch\f1 Initial Term}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ). The agreement will automatically renew for additional one}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3615011 \hich\af1\dbch\af37\loch\f1 (1)}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 -year terms }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid87762 \hich\af1\dbch\af37\loch\f1 (}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid87762\charrsid1904115 \hich\af1\dbch\af37\loch\f1 or for term purchased if different than one year) }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 (each, a }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\i\f1\fs17\insrsid10492054\charrsid12338951 \hich\af1\dbch\af37\loch\f1 Renewal Term}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid3615011 ,}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3615011 \hich\af1\dbch\af37\loch\f1 and the Initial Term}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid1923934 \hich\af1\dbch\af37\loch\f1 , collectively with any and all Renewal Terms}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3615011 \hich\af1\dbch\af37\loch\f1 , }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid7942271 \hich\af1\dbch\af37\loch\f1 will}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1923934 \hich\af1\dbch\af37\loch\f1 be referred to as }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid3615011 \hich\af1\dbch\af37\loch\f1 +the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'93}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\i\f1\fs17\insrsid3615011\charrsid12338951 \hich\af1\dbch\af37\loch\f1 Support Term}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid9927413 \loch\af1\dbch\af37\hich\f1 \'94}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 ), unless either party provides the other (or if p}{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 urchased through a rese\hich\af1\dbch\af37\loch\f1 ller, Customer}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 provide}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10641471 \hich\af1\dbch\af37\loch\f1 s}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 + reseller) with written notice of its intent not to renew the agreement at least thirty (30) days prior to the end of the then current }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 Initial Term or Renewal Term.} +{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 Customer must purchase and/or renew Support for all of the licenses +\hich\af1\dbch\af37\loch\f1 for a particular Software product.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid11487845 \hich\af1\dbch\af37\loch\f1 +If the Support Term lapses, Customer }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 may seek to re-activate Support by submitting a purchase order that includes fees for the lapsed period}{ +\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid87762\charrsid87762 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid2718300 \hich\af1\dbch\af37\loch\f1 plus a re}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid87762\charrsid1904115 \hich\af1\dbch\af37\loch\f1 instatement fee}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10177295 .}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 +\par {\*\bkmkstart _Ref192564020}{\*\bkmkstart _Ref292348096}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid2718300 \hich\af1\dbch\af37\loch\f1 3.2\tab}}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid2718300 +\hich\af1\dbch\af37\loch\f1 Termination}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 .}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12091159 {\*\bkmkend _Ref192564020}\hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 +\af1\afs17 \ltrch\fcs0 \f1\fs17\lang9\langfe1033\langnp9\insrsid1918168\charrsid3892541 \hich\af1\dbch\af37\loch\f1 Either party may terminate this Agreement\hich\af1\dbch\af37\loch\f1 + by written notice to the other party if the other party materially breaches this Agreement and does not cure the breach within thirty (30) days of receiving notice of the breach. }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1918168\charrsid3892541 \hich\af1\dbch\af37\loch\f1 If Customer terminates the }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid8154834 \hich\af1\dbch\af37\loch\f1 A}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid1918168\charrsid3892541 \hich\af1\dbch\af37\loch\f1 greement for Splunk\hich\f1 \rquote \loch\f1 s uncured material breach of\hich\af1\dbch\af37\loch\f1 the support and maintenance terms set forth here in Exhibit }{\rtlch\fcs1 \af1\afs17 +\ltrch\fcs0 \f1\fs17\insrsid8154834 \hich\af1\dbch\af37\loch\f1 C}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid1918168\charrsid3892541 \hich\af1\dbch\af37\loch\f1 , then Splunk will refund any unused prepaid fees to Customer as Customer\hich\f1 +\rquote \loch\f1 s sole and exclusive remedy.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid3892541 {\*\bkmkend _Ref292348096} +\par {\*\bkmkstart _Ref193278266}{\listtext\pard\plain\ltrpar \rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \b\f4\fs18\insrsid10492054\charrsid11476353 \hich\af4\dbch\af37\loch\f4 4.\tab}}\pard \ltrpar +\qj \fi-540\li540\ri0\nowidctlpar\wrapdefault\faauto\ls6\rin0\lin540\itap0\pararsid10232415 {\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \b\f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 FORCE MAJEURE.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 +\f1\fs17\insrsid12091159 \hich\af1\dbch\af37\loch\f1 }{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid10492054\charrsid11476353 \hich\af1\dbch\af37\loch\f1 Splunk will not be responsible for any failure or delay in its performance +\hich\af1\dbch\af37\loch\f1 +under these Terms and Conditions due to causes beyond its reasonable control, including, but not limited to, labor disputes, strikes, lockouts, shortages of or inability to obtain labor, energy, raw materials or supplies, war, acts of terror, riot, acts o +\hich\af1\dbch\af37\loch\f1 f\hich\af1\dbch\af37\loch\f1 God or governmental action.}{\rtlch\fcs1 \af1\afs17 \ltrch\fcs0 \f1\fs17\insrsid12989213\charrsid11476353 {\*\bkmkend _Ref193278266} +\par }{\*\themedata 504b030414000600080000002100e9de0fbfff0000001c020000130000005b436f6e74656e745f54797065735d2e786d6cac91cb4ec3301045f748fc83e52d4a +9cb2400825e982c78ec7a27cc0c8992416c9d8b2a755fbf74cd25442a820166c2cd933f79e3be372bd1f07b5c3989ca74aaff2422b24eb1b475da5df374fd9ad +5689811a183c61a50f98f4babebc2837878049899a52a57be670674cb23d8e90721f90a4d2fa3802cb35762680fd800ecd7551dc18eb899138e3c943d7e503b6 +b01d583deee5f99824e290b4ba3f364eac4a430883b3c092d4eca8f946c916422ecab927f52ea42b89a1cd59c254f919b0e85e6535d135a8de20f20b8c12c3b0 +0c895fcf6720192de6bf3b9e89ecdbd6596cbcdd8eb28e7c365ecc4ec1ff1460f53fe813d3cc7f5b7f020000ffff0300504b030414000600080000002100a5d6 +a7e7c0000000360100000b0000005f72656c732f2e72656c73848fcf6ac3300c87ef85bd83d17d51d2c31825762fa590432fa37d00e1287f68221bdb1bebdb4f +c7060abb0884a4eff7a93dfeae8bf9e194e720169aaa06c3e2433fcb68e1763dbf7f82c985a4a725085b787086a37bdbb55fbc50d1a33ccd311ba548b6309512 +0f88d94fbc52ae4264d1c910d24a45db3462247fa791715fd71f989e19e0364cd3f51652d73760ae8fa8c9ffb3c330cc9e4fc17faf2ce545046e37944c69e462 +a1a82fe353bd90a865aad41ed0b5b8f9d6fd010000ffff0300504b0304140006000800000021006b799616830000008a0000001c0000007468656d652f746865 +6d652f7468656d654d616e616765722e786d6c0ccc4d0ac3201040e17da17790d93763bb284562b2cbaebbf600439c1a41c7a0d29fdbd7e5e38337cedf14d59b +4b0d592c9c070d8a65cd2e88b7f07c2ca71ba8da481cc52c6ce1c715e6e97818c9b48d13df49c873517d23d59085adb5dd20d6b52bd521ef2cdd5eb9246a3d8b +4757e8d3f729e245eb2b260a0238fd010000ffff0300504b030414000600080000002100215aa28421070000db1d0000160000007468656d652f7468656d652f +7468656d65312e786d6cec594f6f1b4514bf23f11d467b2fb113274da23a55ecd80db469a3d82dea71bc3bf64e33bbb39a1927f10db547242444411ca8c48d03 +022ab51297f269024550a47e05deccecae77e271939400153487d63bfb7b6fdefbbd3ff367af5c3d4a183a2042529e3683fa7bb5009134e4114d47cde076bf7b +69354052e134c28ca7a4194c880cae6ebcfbce15bcae62921004f2a95cc7cd20562a5b5f5890210c63f91ecf480aef865c2458c1a3182d44021f82de842d2cd6 +6a2b0b09a66980529c80da5bc3210d09ea6b95c146a1bcc3e03155520f844cf4b46ae248186cb45fd70839916d26d00166cd00e689f8619f1ca900312c15bc68 +0635f3172c6c5c59c0ebb9105373642b725df397cbe502d1fea299538c06e5a4f56e63edf256a9df00989ac5753a9d76a75eea33001c86e0a9b5a5aab3d15dad +b70a9d1590fd39abbb5d5bae355c7c45ffd28ccd6bad566b792db7c52a3520fbb331835fadad3436171dbc0159fcf20cbed1da6cb7571cbc0159fcca0cbe7b79 +6da5e1e20d286634dd9f41eb8076bbb9f61232e46cdb0b5f05f86a2d874f51900d6576e929863c55f3722dc1f7b8e8024003195634456a9291210e218bdb98d1 +81a07a02bc4e70e58d1d0ae5cc909e0bc950d04c35830f320c1531d5f7f2d9772f9f3d41c7f79f1edffff1f8c183e3fb3f58458ed4364e4755a917df7cfac7a3 +8fd0ef4fbe7ef1f0733f5e56f1bf7cfff1cf3f7de60742f94ccd79fec5e35f9f3e7efee527bf7dfbd003df14785085f7694224ba490ed11e4fc031c38a6b3919 +88f349f4634cab129be948e214eb593cfa3b2a76d0372798610fae455c06ef08681f3ee0b5f13dc7e05e2cc62a8fb7e3d9f53871803b9cb316175e16aeebb92a +34f7c7e9c83fb91857717b181ff8e66ee3d4896f679c41dfa43e95ed983866ee329c2a3c22295148bfe3fb8478f8ba4ba9c3eb0e0d05977ca8d05d8a5a987a29 +e9d381934d53a16d9a405c263e0321de0e373b77508b339fd75be4c045425560e631be4f9843e3353c5638f1a9ece3845509bf8155ec33b237116115d7910a22 +3d228ca34e44a4f4c9dc12e06f25e8d7a175f8c3bec326898b148aeefb74dec09c57915b7cbf1de324f3617b348dabd8f7e53ea42846bb5cf9e03bdcad10fd0c +71c0e9dc70dfa1c409f7e9dde0361d39264d1344bf190b4f2caf11eee46f6fc286989856034ddde9d5094d5fd5b813e8dbb9e317d7b8a1553effea91c7ee37b5 +656f0209be9ad93ed1a8e7e14eb6e73617117df3bbf3161ea7bb040a6276897adb9cdf36e7e03fdf9ce7d5f3c5b7e469178606adb74c76a36db6ddc9dc5df790 +32d65313466e48b3f196b0f6445d18d472e6c449ca535816c34f5dc93081831b096c6490e0ea43aae25e8c33d8b4d703ad642473d52389322ee1b06886bdba35 +1e36feca1e3597f521c4760e89d50e8fecf0921e2ece1aa51a63d5c81c688b8996b482b34eb67439570abebdce64756dd49967ab1bd34c5374662b5dd6149b43 +39505eba0683259bb0a941b015029657e0ccafa786c30e6624d2bcdb1815613151f87b42947b6d1d8971446c889ce10a9b7513bb228566fcd3eed91c391f9b25 +6b40dae94698b4989f3f6724b950302519044f56134babb5c55274d80cd69617970314e2ac190ce1980b3f930c8226f53610b311dc15854ad8ac3db5164d914e +3d5ef367551d6e2ee6148c53c699906a0bcbd8c6d0bcca43c5523d93b57f71b9a193ed621cf03493b359b1b40a29f2af5901a176434b864312aa6ab02b239a3b +fb9877423e5644f4e2e8100dd858ec61083f70aafd89a884db0a53d0fa01aed634dbe695db5bf34e53bdd032383b8e5916e3bc5beaab99a2e22cdcf493d206f3 +54310f7cf3da6e9c3bbf2bbae22fca956a1affcf5cd1cb015c1e2c453a0221dcec0a8c74a534032e54cca10b65310dbb02d67dd33b205be07a165e03f970bf6c +fe17e440ff6f6bceea30650d6740b547474850584e542c08d985b664b2ef1465f57ce9b12a59aec86454c55c9959b307e480b0beee812bba070728865437dd24 +6f03067732ffdce7bc820623bd47a9d69bd3c9caa5d3d6c03fbd71b1c50c4e9dd84be8fc2df82f4d2c57f7e9ea67e58d78b146561dd12fa6bba4465115cee2b7 +b6964ff59a269c6501aeacb5b663cd78bcb85c1807519cf51806cbfd4c06574048ff03eb1f1521b31f2bf482dae77bd05b117c7bb0fc21c8ea4bbaab4106e906 +697f0d60df63076d32695596da7ce7a3592b16eb0bdea896f39e205b5b7696789f93ec7213e54ee7d4e245929d33ec706dc7e6520d913d59a230342cce212630 +e62b57f543141fdc83406fc195ff98d94f533283275307d9ae30d935e0d124ffc9a45d706dd6e9338c46b2748f0c118d8e8af347c9842d21fb79a4d8221bb416 +d389560a2ef90e0dae608ed7a276b52c85174f172e25ccccd0b24b617397e653001fc7f2c6ad8f7680b74dd67aad8bab608aa57f85b23318efa7cc7bf2392b65 +f6a0f8ca40bd0665eae8d594e54c0179b389079f370586a357cff45f58746ca69b94ddf8130000ffff0300504b0304140006000800000021000dd1909fb60000 +001b010000270000007468656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d6c2e72656c73848f4d0ac2301484f78277086f6fd3ba +109126dd88d0add40384e4350d363f2451eced0dae2c082e8761be9969bb979dc9136332de3168aa1a083ae995719ac16db8ec8e4052164e89d93b64b060828e +6f37ed1567914b284d262452282e3198720e274a939cd08a54f980ae38a38f56e422a3a641c8bbd048f7757da0f19b017cc524bd62107bd5001996509affb3fd +381a89672f1f165dfe514173d9850528a2c6cce0239baa4c04ca5bbabac4df000000ffff0300504b01022d0014000600080000002100e9de0fbfff0000001c02 +00001300000000000000000000000000000000005b436f6e74656e745f54797065735d2e786d6c504b01022d0014000600080000002100a5d6a7e7c000000036 +0100000b00000000000000000000000000300100005f72656c732f2e72656c73504b01022d00140006000800000021006b799616830000008a0000001c000000 +00000000000000000000190200007468656d652f7468656d652f7468656d654d616e616765722e786d6c504b01022d0014000600080000002100215aa2842107 +0000db1d00001600000000000000000000000000d60200007468656d652f7468656d652f7468656d65312e786d6c504b01022d00140006000800000021000dd1 +909fb60000001b01000027000000000000000000000000002b0a00007468656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d6c2e72656c73504b050600000000050005005d010000260b00000000} +{\*\colorschememapping 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d22796573223f3e0d0a3c613a636c724d +617020786d6c6e733a613d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f64726177696e676d6c2f323030362f6d6169 +6e22206267313d226c743122207478313d22646b3122206267323d226c743222207478323d22646b322220616363656e74313d22616363656e74312220616363 +656e74323d22616363656e74322220616363656e74333d22616363656e74332220616363656e74343d22616363656e74342220616363656e74353d22616363656e74352220616363656e74363d22616363656e74362220686c696e6b3d22686c696e6b2220666f6c486c696e6b3d22666f6c486c696e6b222f3e} +{\*\latentstyles\lsdstimax267\lsdlockeddef0\lsdsemihiddendef1\lsdunhideuseddef1\lsdqformatdef0\lsdprioritydef99{\lsdlockedexcept \lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority0 \lsdlocked0 Normal; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority9 \lsdlocked0 heading 1;\lsdqformat1 \lsdpriority9 \lsdlocked0 heading 2;\lsdqformat1 \lsdpriority9 \lsdlocked0 heading 3;\lsdqformat1 \lsdpriority9 \lsdlocked0 heading 4; +\lsdqformat1 \lsdpriority9 \lsdlocked0 heading 5;\lsdqformat1 \lsdpriority9 \lsdlocked0 heading 6;\lsdqformat1 \lsdpriority9 \lsdlocked0 heading 7;\lsdqformat1 \lsdpriority9 \lsdlocked0 heading 8;\lsdqformat1 \lsdpriority9 \lsdlocked0 heading 9; +\lsdpriority39 \lsdlocked0 toc 1;\lsdpriority39 \lsdlocked0 toc 2;\lsdpriority39 \lsdlocked0 toc 3;\lsdpriority39 \lsdlocked0 toc 4;\lsdpriority39 \lsdlocked0 toc 5;\lsdpriority39 \lsdlocked0 toc 6;\lsdpriority39 \lsdlocked0 toc 7; +\lsdpriority39 \lsdlocked0 toc 8;\lsdpriority39 \lsdlocked0 toc 9;\lsdpriority0 \lsdlocked0 header;\lsdpriority0 \lsdlocked0 footer;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority0 \lsdlocked0 caption;\lsdpriority0 \lsdlocked0 page number; +\lsdpriority0 \lsdlocked0 List;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority10 \lsdlocked0 Title;\lsdpriority1 \lsdlocked0 Default Paragraph Font;\lsdpriority0 \lsdlocked0 Body Text; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority11 \lsdlocked0 Subtitle;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority22 \lsdlocked0 Strong;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority20 \lsdlocked0 Emphasis; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority59 \lsdlocked0 Table Grid;\lsdsemihidden0 \lsdunhideused0 \lsdpriority62 \lsdlocked0 Placeholder Text;\lsdsemihidden0 \lsdunhideused0 \lsdpriority63 \lsdlocked0 No Spacing; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority64 \lsdlocked0 Light Shading;\lsdsemihidden0 \lsdunhideused0 \lsdpriority65 \lsdlocked0 Light List;\lsdsemihidden0 \lsdunhideused0 \lsdlocked0 Light Grid; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority34 \lsdlocked0 Medium Shading 1;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority29 \lsdlocked0 Medium Shading 2; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority30 \lsdlocked0 Medium List 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority66 \lsdlocked0 Medium List 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority67 \lsdlocked0 Medium Grid 1; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority68 \lsdlocked0 Medium Grid 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority69 \lsdlocked0 Medium Grid 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority70 \lsdlocked0 Dark List; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority71 \lsdlocked0 Colorful Shading;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority72 \lsdlocked0 Colorful List;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority73 \lsdlocked0 Colorful Grid; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority60 \lsdlocked0 Light Shading Accent 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority61 \lsdlocked0 Light List Accent 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority62 \lsdlocked0 Light Grid Accent 1; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority63 \lsdlocked0 Medium Shading 1 Accent 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority64 \lsdlocked0 Medium Shading 2 Accent 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority65 \lsdlocked0 Medium List 1 Accent 1; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority66 \lsdlocked0 Revision;\lsdsemihidden0 \lsdunhideused0 \lsdpriority67 \lsdlocked0 List Paragraph;\lsdsemihidden0 \lsdunhideused0 \lsdpriority68 \lsdlocked0 Quote; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority69 \lsdlocked0 Intense Quote;\lsdsemihidden0 \lsdunhideused0 \lsdpriority70 \lsdlocked0 Medium List 2 Accent 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority71 \lsdlocked0 Medium Grid 1 Accent 1; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority72 \lsdlocked0 Medium Grid 2 Accent 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority73 \lsdlocked0 Medium Grid 3 Accent 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority60 \lsdlocked0 Dark List Accent 1; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority61 \lsdlocked0 Colorful Shading Accent 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority62 \lsdlocked0 Colorful List Accent 1;\lsdsemihidden0 \lsdunhideused0 \lsdpriority63 \lsdlocked0 Colorful Grid Accent 1; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority64 \lsdlocked0 Light Shading Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority65 \lsdlocked0 Light List Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority66 \lsdlocked0 Light Grid Accent 2; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority67 \lsdlocked0 Medium Shading 1 Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority68 \lsdlocked0 Medium Shading 2 Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority69 \lsdlocked0 Medium List 1 Accent 2; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority70 \lsdlocked0 Medium List 2 Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority71 \lsdlocked0 Medium Grid 1 Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority72 \lsdlocked0 Medium Grid 2 Accent 2; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority73 \lsdlocked0 Medium Grid 3 Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority60 \lsdlocked0 Dark List Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority61 \lsdlocked0 Colorful Shading Accent 2; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority62 \lsdlocked0 Colorful List Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority63 \lsdlocked0 Colorful Grid Accent 2;\lsdsemihidden0 \lsdunhideused0 \lsdpriority64 \lsdlocked0 Light Shading Accent 3; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority65 \lsdlocked0 Light List Accent 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority66 \lsdlocked0 Light Grid Accent 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority67 \lsdlocked0 Medium Shading 1 Accent 3; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority68 \lsdlocked0 Medium Shading 2 Accent 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority69 \lsdlocked0 Medium List 1 Accent 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority70 \lsdlocked0 Medium List 2 Accent 3; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority71 \lsdlocked0 Medium Grid 1 Accent 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority72 \lsdlocked0 Medium Grid 2 Accent 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority73 \lsdlocked0 Medium Grid 3 Accent 3; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority60 \lsdlocked0 Dark List Accent 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority61 \lsdlocked0 Colorful Shading Accent 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority62 \lsdlocked0 Colorful List Accent 3; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority63 \lsdlocked0 Colorful Grid Accent 3;\lsdsemihidden0 \lsdunhideused0 \lsdpriority64 \lsdlocked0 Light Shading Accent 4;\lsdsemihidden0 \lsdunhideused0 \lsdpriority65 \lsdlocked0 Light List Accent 4; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority66 \lsdlocked0 Light Grid Accent 4;\lsdsemihidden0 \lsdunhideused0 \lsdpriority67 \lsdlocked0 Medium Shading 1 Accent 4;\lsdsemihidden0 \lsdunhideused0 \lsdpriority68 \lsdlocked0 Medium Shading 2 Accent 4; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority69 \lsdlocked0 Medium List 1 Accent 4;\lsdsemihidden0 \lsdunhideused0 \lsdpriority70 \lsdlocked0 Medium List 2 Accent 4;\lsdsemihidden0 \lsdunhideused0 \lsdpriority71 \lsdlocked0 Medium Grid 1 Accent 4; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority72 \lsdlocked0 Medium Grid 2 Accent 4;\lsdsemihidden0 \lsdunhideused0 \lsdpriority73 \lsdlocked0 Medium Grid 3 Accent 4;\lsdsemihidden0 \lsdunhideused0 \lsdpriority60 \lsdlocked0 Dark List Accent 4; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority61 \lsdlocked0 Colorful Shading Accent 4;\lsdsemihidden0 \lsdunhideused0 \lsdpriority62 \lsdlocked0 Colorful List Accent 4;\lsdsemihidden0 \lsdunhideused0 \lsdpriority63 \lsdlocked0 Colorful Grid Accent 4; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority64 \lsdlocked0 Light Shading Accent 5;\lsdsemihidden0 \lsdunhideused0 \lsdpriority65 \lsdlocked0 Light List Accent 5;\lsdsemihidden0 \lsdunhideused0 \lsdpriority66 \lsdlocked0 Light Grid Accent 5; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority67 \lsdlocked0 Medium Shading 1 Accent 5;\lsdsemihidden0 \lsdunhideused0 \lsdpriority68 \lsdlocked0 Medium Shading 2 Accent 5;\lsdsemihidden0 \lsdunhideused0 \lsdpriority69 \lsdlocked0 Medium List 1 Accent 5; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority70 \lsdlocked0 Medium List 2 Accent 5;\lsdsemihidden0 \lsdunhideused0 \lsdpriority71 \lsdlocked0 Medium Grid 1 Accent 5;\lsdsemihidden0 \lsdunhideused0 \lsdpriority72 \lsdlocked0 Medium Grid 2 Accent 5; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority73 \lsdlocked0 Medium Grid 3 Accent 5;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority19 \lsdlocked0 Dark List Accent 5; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority21 \lsdlocked0 Colorful Shading Accent 5;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority31 \lsdlocked0 Colorful List Accent 5; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority32 \lsdlocked0 Colorful Grid Accent 5;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority33 \lsdlocked0 Light Shading Accent 6; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority37 \lsdlocked0 Light List Accent 6;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority39 \lsdlocked0 Light Grid Accent 6; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority72 \lsdlocked0 Medium Shading 1 Accent 6;\lsdsemihidden0 \lsdunhideused0 \lsdpriority73 \lsdlocked0 Medium Shading 2 Accent 6; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority19 \lsdlocked0 Medium List 1 Accent 6;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority21 \lsdlocked0 Medium List 2 Accent 6; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority31 \lsdlocked0 Medium Grid 1 Accent 6;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority32 \lsdlocked0 Medium Grid 2 Accent 6; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority33 \lsdlocked0 Medium Grid 3 Accent 6;\lsdsemihidden0 \lsdunhideused0 \lsdpriority37 \lsdlocked0 Dark List Accent 6; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority39 \lsdlocked0 Colorful Shading Accent 6;\lsdsemihidden0 \lsdunhideused0 \lsdpriority72 \lsdlocked0 Colorful List Accent 6; +\lsdsemihidden0 \lsdunhideused0 \lsdpriority73 \lsdlocked0 Colorful Grid Accent 6;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority19 \lsdlocked0 Subtle Emphasis; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority21 \lsdlocked0 Intense Emphasis;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority31 \lsdlocked0 Subtle Reference; +\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority32 \lsdlocked0 Intense Reference;\lsdsemihidden0 \lsdunhideused0 \lsdqformat1 \lsdpriority33 \lsdlocked0 Book Title;\lsdpriority37 \lsdlocked0 Bibliography; +\lsdqformat1 \lsdpriority39 \lsdlocked0 TOC Heading;}}{\*\datastore 0105000002000000180000004d73786d6c322e534158584d4c5265616465722e362e3000000000000000000000940000 +d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000200000003000000feffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff +ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff +ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff +ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff +fffffffffffffffffdffffff040000001d00000005000000070000000600000008000000090000000a0000000c0000000b0000000d0000000f0000000e000000100000001100000012000000140000001300000015000000170000001600000018000000190000001a0000001c0000001b0000001e000000200000003700 +00001f0000002100000022000000230000002500000024000000260000002800000027000000290000002a0000002b0000002d0000002c0000002e000000300000002f0000003100000032000000330000003500000034000000360000003900000038000000feffffff3a0000003b0000003c0000003e0000003d000000 +3f0000004100000040000000420000004300000044000000460000004500000047000000feffffff48000000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff +ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff +ffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff010000000c6ad98892f1d411a65f0040963251e500000000000000000000000070d3 +b6b446aed2010300000000550000000000004d0073006f004400610074006100530074006f0072006500000000000000000000000000000000000000000000000000000000000000000000000000000000001a000101ffffffffffffffff2f000000000000000000000000000000000000000000000060acb6b446aed201 +70d3b6b446aed2010000000000000000000000003000c300d800d600c8005400570044005300c800de00c400d500d800c8004200dc00ca00c5003300340041003d003d000000000000000000000000000000000032000101ffffffffffffffff03000000000000000000000000000000000000000000000060acb6b446ae +d20160acb6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff04000000ffffffff000000000000000000000000000000000000000000000000 +00000000000000000000000000000000d800000000000000010000000200000003000000feffffff0500000006000000070000000800000009000000feffffff0b0000000c0000000d000000feffffff0f00000010000000110000001200000013000000feffffff150000001600000017000000feffffff190000001a00 +00001b0000001c0000001d000000feffffff1f0000002000000021000000feffffff2300000024000000250000002600000027000000feffffff290000002a0000002b000000feffffff2d0000002e0000002f0000003000000031000000feffffff330000003400000035000000feffffff370000003800000039000000 +3a0000003b000000feffffff3d0000003e0000003f000000feffffff4100000042000000430000004400000045000000feffffff470000004800000049000000feffffff4b0000004c0000004d0000004e0000004f000000feffffff510000005200000053000000feffffff550000005600000057000000580000005900 +0000feffffff5b0000005c0000005d000000feffffff5f00000060000000610000006200000063000000feffffff650000006600000067000000feffffff690000006a0000006b0000006c0000006d000000feffffff6f0000007000000071000000feffffff7300000074000000750000007600000077000000feffffff +790000007a0000007b000000feffffff7d0000007e0000007f000000800000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f7267 +2f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e00000000 +0000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b41313336 +334536412d383333352d384634412d413444372d3841303146324139354437387d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c +64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000 +00000000000000000000000000000000000000000000000000000000000004000000550100000000000031005800d900cf005400c200da004e0054005300c2005900490042005a004e00d5004a004d00d300550051003d003d00000000000000000000000000000000003200010102000000080000000600000000000000 +0000000000000000000000000000000060acb6b446aed20160acb6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff07000000ffffffff0000 +000000000000000000000000000000000000000000000000000000000000000000000a000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff +0000000000000000000000000000000000000000000000000000000000000000000000000e0000005501000000000000786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f +72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e +6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879 +223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f7265497465 +6d2064733a6974656d49443d227b34453646374536442d384432452d323834442d393832302d3136344444343933333335317d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c +223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f +64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a +2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269 +626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003200c3004b00dd00350056004400c4005200da004300590052003300c400c200cb00c600d400d000c100c0003d003d000000000000000000000000000000 +000032000101ffffffffffffffff09000000000000000000000000000000000000000000000060acb6b446aed20160acb6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +000000000a000201ffffffff0a000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000014000000d800000000000000500072006f0070006500720074006900650073000000000000000000000000000000000000000000000000000000000000000000000000000000 +00000000000016000200ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000001800000055010000000000003200df004f004f004b0041005100d6005200ca00d2003400c200cb004f00c100cc0053004b00da00c40041003d003d000000000000000000 +00000000000000003200010105000000110000000c000000000000000000000000000000000000000000000060acb6b446aed20160acb6b446aed2010000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e +0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b37444244333237322d453435302d413034372d393834352d4439323241453644333038367d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d +656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e +3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d2241 +50412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879224900740065006d000000000000000000000000000000000000000000000000000000000000000000000000000000 +0000000000000000000000000000000000000a000201ffffffff0d000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000001e000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000 +000000000000000000000000000000000000000016000200ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000002200000055010000000000003300c10041005500c5005400c300450054004400c2004b004400d800cc00de00d500d500d3004d004400 +51003d003d000000000000000000000000000000000032000101ffffffffffffffff0f000000000000000000000000000000000000000000000060acb6b446aed20160acb6b446aed2010000000000000000000000004900740065006d000000000000000000000000000000000000000000000000000000000000000000 +0000000000000000000000000000000000000000000000000a000201ffffffff10000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000028000000d80000000000000020786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e +6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822 +207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b32383845463337332d333630342d414334362d394538412d4233413142313232424139307d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d61 +74732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f3230 +30362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f415041 +2e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e78 +6d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f6469 +6e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b39353134313037362d433433382d333834432d384130462d3842334544373543434330447d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70 +656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e500072006f0070006500720074006900650073000000 +00000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000002c00000055010000000000003300d900cd00d1004500df003300ca00dd00d400 +ca004200d900d300c600570032003100cb00c200c40041003d003d0000000000000000000000000000000000320001010e0000001400000012000000000000000000000000000000000000000000000060acb6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000 +000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff13000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000032000000d800000000000000500072006f0070006500720074006900 +65007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000360000005501000000000000786d6c666f726d6174732e6f7267 +2f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053 +656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d226874 +74703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c207665 +7273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b31333731394237372d364146372d344146372d383145372d3339393637314241453239307d2220786d6c6e733a64733d +22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c66 +6f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c62 +3a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f67726170687922 +20786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e0000000000000000000000000000000000000000000000000000000000000000000000000000 +0000350052005100db00c100c8005a00da005300320053004e00cc0031004700d900d6004800c00050003200c0003d003d000000000000000000000000000000000032000101ffffffffffffffff15000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000 +000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff16000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000003c000000d800 +000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000040000000 +550100000000000041004d00dc004400c00049005800d200de00550034003200c200cf004d003200dd00c300cd004200330041003d003d0000000000000000000000000000000000320001000b0000002300000018000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000 +000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b38363342313437442d374138362d433434392d384442312d423142394438 +3738304637327d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a +2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000 +000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f +323030362f6269626c696f677261706879224900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff19000000ffffffff00000000000000000000000000000000000000000000000000000000 +000000000000000046000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000 +000000000000000000004a000000550100000000000042003400c700d1004d00c300d300c2005400c900d6004200d100460047004b0035004800d400c600db00d0003d003d000000000000000000000000000000000032000101ffffffffffffffff1b000000000000000000000000000000000000000000000070d3b6b4 +46aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff1c000000ffffffff00000000000000000000000000000000000000000000 +000000000000000000000000000050000000d80000000000000020786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000 +000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b38303033434630302d463238 +352d343746392d394338412d4633314346363342343137347d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d +615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000 +000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f +72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e0000 +00000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b3332 +4631453930352d453233432d394434452d383143342d3531384137433744323645467d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d6152656673 +3e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff00000000 +00000000000000000000000000000000000000000000000000000000000000005400000055010000000000004600df004400d900450043005800ce00540042005300d0004e00c800c30047005600d500d30054003400d0003d003d0000000000000000000000000000000000320001011a000000200000001e0000000000 +00000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff1f000000ffffffff +0000000000000000000000000000000000000000000000000000000000000000000000005a000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffff +ffff0000000000000000000000000000000000000000000000000000000000000000000000005e0000005501000000000000786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173 +746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61 +732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f67726170 +6879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f726549 +74656d2064733a6974656d49443d227b31304639463031372d454532352d313434432d423033362d3838433635373543443337427d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d58 +6d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e +3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474 +703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f +6269626c696f677261706879223e3c2f623a536f75726365733e0000000000000000000000000000000000000000000000000000000000000000000000000000000048004800590033005700cd00c800c9005300d600c600c1003300c3005800560030004a005700cc00340041003d003d00000000000000000000000000 +0000000032000101ffffffffffffffff21000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +0000000000000a000201ffffffff22000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000064000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000 +000000000000000016000200ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000006800000055010000000000004b00d0004d00df0045004700d90030005300dc00d600d500d600df00490050004900d7004b00cc00d40051003d003d00000000000000 +00000000000000000000320001011d0000002900000024000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f22 +3f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b35413144373631432d323944412d363934422d413137362d3335443536383935414337387d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63 +756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f67726170687922 +2f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d +224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879224900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000 +00000000000000000000000000000000000000000a000201ffffffff25000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000006e000000d800000000000000500072006f00700065007200740069006500730000000000000000000000000000000000000000000000 +0000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000007200000055010000000000005000c500c5004300c4004b00c200de0051005400d6005900ce00ca00590055004c00520042004d00 +5800d0003d003d000000000000000000000000000000000032000101ffffffffffffffff27000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d00000000000000000000000000000000000000000000000000000000000000 +00000000000000000000000000000000000000000000000000000a000201ffffffff28000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000078000000d80000000000000020786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174 +732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d +3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b31303346303332422d354136452d434434422d423544422d4632304632333732414344317d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f72 +6d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f +323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f41 +50412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f7065 +6e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f +64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b39303432353933452d424541382d334434312d393842412d4136313432443130344335467d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e +6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e500072006f007000650072007400690065007300 +000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000007c000000550100000000000058004900cb00d600340058003000d7005400 +4a00da00c800c700cd00500050003400df0057004100de00d0003d003d000000000000000000000000000000000032000101260000002c0000002a000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d000000000000000000 +0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff2b000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000082000000d800000000000000500072006f007000650072007400 +690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000086000000550100000000000081000000feffffff83000000 +8400000085000000feffffff8700000088000000890000008a0000008b000000feffffff8d0000008e0000008f000000feffffff9100000092000000930000009400000095000000feffffff970000009800000099000000feffffff9b0000009c0000009d0000009e0000009f000000feffffffa1000000a2000000a300 +0000feffffffa5000000a6000000a7000000a8000000a9000000feffffffab000000ac000000ad000000feffffffaf000000b0000000b1000000b2000000b3000000feffffffb5000000b6000000b7000000feffffffb9000000ba000000bb000000bc000000bd000000feffffffbf000000c0000000c1000000feffffff +c3000000c4000000c5000000c6000000c7000000feffffffc9000000ca000000cb000000feffffffcd000000ce000000cf000000d0000000d1000000feffffffd3000000d4000000d5000000feffffffd7000000d8000000d9000000da000000db000000feffffffdd000000de000000df000000feffffffe1000000e200 +0000e3000000e4000000e5000000feffffffe7000000e8000000e9000000feffffffeb000000ec000000ed000000ee000000ef000000fefffffff1000000f2000000f3000000fefffffff5000000f6000000f7000000f8000000f9000000fefffffffb000000fc000000fd000000feffffffff00000000010000786d6c66 +6f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c62 +3a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f67726170687922 +20786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e0000000000000000000000000000000000000000000000000000000000000000000000000000 +00003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b37394636384135432d423737362d394534432d413839452d4433434637424635383046427d22 +20786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61 +732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e0000000000000000000000000000000000000000000000000000000000000000000000 +00000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f626962 +6c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e00000000000000000000000000000000000000000000000000000000 +0000000000000000000000005800c200cf00ca00c6004200de00cd00510055005300c800d8003200cf004a00460059004900dd00c000d0003d003d000000000000000000000000000000000032000101ffffffffffffffff2d000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446ae +d2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff2e000000ffffffff0000000000000000000000000000000000000000000000000000000000000000 +000000008c000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000 +000000000000900000005501000000000000c000d5004d0057004c005900c00053005400da0053004b00d400510048003100dc0045004c004c00d70041003d003d000000000000000000000000000000000032000101170000004700000030000000000000000000000000000000000000000000000070d3b6b446aed201 +70d3b6b446aed2010000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b39384541324235452d414431462d343434312d41 +3845312d4342433931353832334438337d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a +7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e0000000000000000000000000000000000 +00000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f66666963 +65446f63756d656e742f323030362f6269626c696f677261706879224900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff31000000ffffffff000000000000000000000000000000000000 +00000000000000000000000000000000000096000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff00000000000000000000000000000000 +00000000000000000000000000000000000000009a0000005501000000000000c100d300d5005500d8003000db00df0054005100ce005300c2004b003000da0053004c005300da00460051003d003d000000000000000000000000000000000032000101ffffffffffffffff330000000000000000000000000000000000 +00000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff34000000ffffffff000000000000000000000000 +000000000000000000000000000000000000000000000000a0000000d80000000000000020786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e0000 +00000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b3244 +3136353338332d313238382d413434462d384144312d3031444246303432434244437d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d6152656673 +3e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d +3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d +6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a +536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a69 +74656d49443d227b45313534334438372d464641452d304234442d393238382d4136424134384234424131357d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a +736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffff +ffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000a40000005501000000000000c400de004b005700d700c300c900cc005300da00c20032004b0044003000d30041004500c600d800ca00d0003d003d00000000000000000000000000000000003200010132000000 +3800000036000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffff +ffff37000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000aa000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200 +ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000ae0000005501000000000000786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e +3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474 +703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f +6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a +6461746173746f72654974656d2064733a6974656d49443d227b44453936453239332d364333412d413834422d394332382d3336423330303439423841427d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f3230 +30362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a73 +6368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d +6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f6375 +6d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e00000000000000000000000000000000000000000000000000000000000000000000000000000000c600d60031004a0030005700d800dd005400c400ce00cc004f00d700d500dd00c100570045005a004b0041003d003d000000 +000000000000000000000000000032000101ffffffffffffffff39000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000 +000000000000000000000000000000000a000201ffffffff3a000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000b4000000d800000000000000500072006f0070006500720074006900650073000000000000000000000000000000000000000000000000000000 +00000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000b80000005501000000000000c900de005000cb00c8005800db003400510031003000340045004400cf00cb00c60053004900cd004a00c000 +3d003d00000000000000000000000000000000003200010135000000410000003c000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64 +616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b36394339363639422d334436452d344234452d414333422d3744374438353631313932387d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f7267 +2f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f626962 +6c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c2220 +5374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879224900740065006d000000000000000000000000000000000000000000000000000000 +0000000000000000000000000000000000000000000000000000000000000a000201ffffffff3d000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000be000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000 +000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000c20000005501000000000000cd004b004f00cf00d0004500ce00c50052005a00ca005100d0005700d900 +d90033004600c3004200500041003d003d000000000000000000000000000000000032000101ffffffffffffffff3f000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d000000000000000000000000000000000000000000 +0000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff40000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000c8000000d80000000000000020786d6c6e733d22687474703a2f2f736368656d61732e6f7065 +6e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f +64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b41314542453341372d444537452d423634312d394531302d3342454239393232324432367d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e +6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f66666963 +65446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465 +645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f73 +6368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d +22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b43304146413342342d413534422d394134352d393043312d3645373937343538433133437d2220786d6c6e733a64733d22687474703a +2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e500072006f0070006500 +72007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000cc0000005501000000000000ce00da00d9004b00 +dd004a004800510051004400c6003300490045005100d400df00dc0044005300cc00d0003d003d0000000000000000000000000000000000320001013e0000004400000042000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed201000000000000000000000000490074006500 +6d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff43000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000d2000000d80000000000000050007200 +6f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000d60000005501000000000000786d +6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +3c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068 +792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000 +000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b46343441414542422d443039312d333934302d394432302d343433344646433044324233 +7d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f73636865 +6d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000 +000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f62 +69626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e0000000000000000000000000000000000000000000000000000 +0000000000000000000000000000d00032004a00dd0041004d00de00c3005100d6004300da004d0043004100d400da00d70043004900c700c0003d003d000000000000000000000000000000000032000101ffffffffffffffff45000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b4 +46aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff46000000ffffffff000000000000000000000000000000000000000000000000000000000000 +000000000000dc000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000 +0000000000000000e00000005501000000000000d000c100d300dc004a004700320055005100520030004c00db00cb0030004700ca00c300da003200d60051003d003d0000000000000000000000000000000000320001003b0000005300000048000000000000000000000000000000000000000000000070d3b6b446ae +d20170d3b6b446aed2010000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b30303744433243312d413343462d36303433 +2d424133302d3230333445423730383839457d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064 +733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000 +000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666 +696365446f63756d656e742f323030362f6269626c696f677261706879224900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff49000000ffffffff00000000000000000000000000000000 +0000000000000000000000000000000000000000e6000000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff0000000000000000000000000000 +00000000000000000000000000000000000000000000ea0000005501000000000000d30041003000db00cd00df0044005a005200460034005700c30044004100dc00c0004e005400da00d10041003d003d000000000000000000000000000000000032000101ffffffffffffffff4b000000000000000000000000000000 +000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff4c000000ffffffff00000000000000000000 +0000000000000000000000000000000000000000000000000000f0000000d80000000000000020786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e +000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b +32344643314343322d313436372d313634312d384245452d4236383641413345394344397d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d615265 +66733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974 +656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e +786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f +623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d206473 +3a6974656d49443d227b42374242303643432d443946302d353734342d393638432d3330334338304434464143347d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64 +733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffff +ffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000f40000005501000000000000d300dd003100d100ca00db0044004b0051004300da00c4005a0046004700cc00cf003100cb00cc004d0051003d003d0000000000000000000000000000000000320001014a00 +0000500000004e000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201 +ffffffff4f000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000fa000000d800000000000000500072006f00700065007200740069006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001600 +0200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000fe0000005501000000000000786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566 +733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d2268 +7474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030 +362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64 +733a6461746173746f72654974656d2064733a6974656d49443d227b41424631443643462d434142302d324534302d413436342d3531414342444241454333317d2220786d6c010100000201000003010000feffffff050100000601000007010000feffffff090100000a0100000b0100000c0100000d010000feffffff +0f0100001001000011010000feffffff1301000014010000150100001601000017010000feffffff190100001a0100001b010000feffffff1d0100001e0100001f0100002001000021010000feffffff230100002401000025010000feffffff2701000028010000290100002a0100002b010000feffffff2d0100002e01 +00002f010000feffffff3101000032010000330100003401000035010000feffffff370100003801000039010000feffffff3b0100003c0100003d0100003e0100003f010000feffffff410100004201000043010000feffffff4501000046010000470100004801000049010000feffffff4b0100004c0100004d010000 +feffffff4f01000050010000510100005201000053010000feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff +ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f666669636544 +6f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068 +79222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d +653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f +6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e00000000000000000000000000000000000000000000000000000000000000000000000000000000d4005a005600df00d000d50058004e0052003400de00de00ca004e00d900d5004700d200ca004500 +4f00d0003d003d000000000000000000000000000000000032000101ffffffffffffffff51000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d00000000000000000000000000000000000000000000000000000000000000 +00000000000000000000000000000000000000000000000000000a000201ffffffff52000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000004010000d800000000000000500072006f00700065007200740069006500730000000000000000000000000000000000 +0000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000080100005501000000000000d500c2004400dc00c900cf00da0046005400da00d6004100300035004a004200c300 +56003200da004f0051003d003d0000000000000000000000000000000000320001014d0000005900000054000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554 +462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b43333746393544312d434435352d454634352d424541382d4445373531423241383433427d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c66 +6f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e +742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d22 +2f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879224900740065006d0000000000000000000000000000000000 +000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff55000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000e010000d800000000000000500072006f0070006500720074006900650073000000 +00000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000120100005501000000000000d500c9004a00d90030004b004100c9005100c000 +57003400ce005a00d300cb00df00c500d0005a00d000d0003d003d000000000000000000000000000000000032000101ffffffffffffffff57000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000 +000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff58000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000018010000d80000000000000020786d6c6e733d22687474703a2f2f73 +6368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d +22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b41364643323044362d383546452d414434462d383036392d4632343138443537334133397d2220786d6c6e733a64733d22687474703a +2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d617473 +2e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f757263 +65732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e73 +3d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d +6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b36383739393244362d323941302d303534322d394542392d3943454246453543313943337d2220786d6c6e73 +3a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e +500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000001c010000550100000000 +0000d6004d005a00db00d200d600cb004b0053004700d60042003100d000dd003200d800c30045004200570041003d003d000000000000000000000000000000000032000101560000005f0000005a000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000 +000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff5b000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000022010000d800 +000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000026010000 +5501000000000000786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000 +000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f62 +69626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e0000000000000000000000000000000000000000000000000000 +00000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b43423742433644382d434136412d364434382d383136462d3046 +354345323331303135387d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d2268 +7474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e0000000000000000000000000000000000000000000000 +00000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d +656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e00000000000000000000000000000000 +000000000000000000000000000000000000000000000000d600cc00d500db00c1005000d800c500510045004300c300d800dd00570044004b00c700d700c9004f0051003d003d000000000000000000000000000000000032000101ffffffffffffffff5d000000000000000000000000000000000000000000000070d3 +b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff5e000000ffffffff0000000000000000000000000000000000000000 +000000000000000000000000000000002c010000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff000000000000000000000000000000000000 +000000000000000000000000000000000000300100005501000000000000d80057005300c800db00c900c20058005400d6005300330059004800dd00cd00c900c700d6003300c800c0003d003d0000000000000000000000000000000000320001005c000000620000006000000000000000000000000000000000000000 +0000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b3834374243444441 +2d323546452d343034302d413345332d4435383332413744453933397d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a73 +6368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e0000000000 +00000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d61 +74732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879224900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff61000000ffffffff000000000000 +00000000000000000000000000000000000000000000000000000000000036010000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000200ffffffffffffffffffffffff00000000 +00000000000000000000000000000000000000000000000000000000000000003a0100005501000000000000d900d0004800c9005000dd00ce00d3005200dd00de004900c9004800cc00490048004100d80057004300c0003d003d000000000000000000000000000000000032000101ffffffff65000000630000000000 +00000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000201ffffffff64000000ffffffff +00000000000000000000000000000000000000000000000000000000000000000000000040010000d80000000000000020786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879223e3c2f +623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a6461746173746f72654974656d206473 +3a6974656d49443d227b45454138363445312d393739382d363434462d394436302d3746364441363744394441327d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573746f6d586d6c223e3c64 +733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f64733a736368656d61526566733e3c2f64733a64 +61746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220786d6c6e733a623d22687474703a2f2f7363 +68656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f +677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f223f3e0d0a3c64733a646174617374 +6f72654974656d2064733a6974656d49443d227b33464539303145372d423344422d444634372d383841342d3742303831433045313630417d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f637573 +746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +000016000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000440100005501000000000000db00cd00df005500cd005500d600c1005400d0005700d500c0004400d8005600cd00dd00d1005000c50051003d003d00000000000000000000000000 +0000000032000100ffffffffffffffff66000000000000000000000000000000000000000000000070d3b6b446aed20170d3b6b446aed2010000000000000000000000004900740065006d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +0000000000000a000201ffffffff67000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000004a010000d800000000000000500072006f007000650072007400690065007300000000000000000000000000000000000000000000000000000000000000000000000000 +000000000000000016000200ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000004e0100005501000000000000786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261706879222f3e3c2f6473 +3a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c623a536f75726365732053656c65637465645374796c653d222f4150412e58534c22205374796c654e616d653d224150412220 +786d6c6e733a623d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f6772617068792220786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f +63756d656e742f323030362f6269626c696f677261706879223e3c2f623a536f75726365733e000000000000000000000000000000000000000000000000000000000000000000000000000000003c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d +226e6f223f3e0d0a3c64733a6461746173746f72654974656d2064733a6974656d49443d227b42354434444645452d413134442d303534462d423538302d3345313542374443344639357d2220786d6c6e733a64733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f66666963 +65446f63756d656e742f323030362f637573746f6d586d6c223e3c64733a736368656d61526566733e3c64733a736368656d615265662064733a7572693d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f6f6666696365446f63756d656e742f323030362f6269626c696f677261 +706879222f3e3c2f64733a736368656d61526566733e3c2f64733a6461746173746f72654974656d3e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 +000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000105000000000000}} \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/license-eula.txt b/deps/apps/Splunk_SA_CIM/license-eula.txt new file mode 100644 index 000000000..2b00914cf --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/license-eula.txt @@ -0,0 +1,709 @@ +SOFTWARE LICENSE AGREEMENT + +THIS SOFTWARE LICENSE AGREEMENT ("AGREEMENT") GOVERNS THE LICENSING, INSTALLATION AND USE OF SPLUNK +SOFTWARE. BY DOWNLOADING AND/OR INSTALLING SPLUNK SOFTWARE: (A) YOU ARE INDICATING THAT YOU HAVE +READ AND UNDERSTAND THIS AGREEMENT, AND AGREE TO BE LEGALLY BOUND BY IT ON BEHALF OF THE COMPANY, +GOVERNMENT, OR OTHER ENTITY FOR WHICH YOU ARE ACTING (FOR EXAMPLE, AS AN EMPLOYEE OR GOVERNMENT +OFFICIAL) OR, IF THERE IS NO COMPANY, GOVERNMENT OR OTHER ENTITY FOR WHICH YOU ARE ACTING, ON BEHALF OF +YOURSELF AS AN INDIVIDUAL; AND (B) YOU REPRESENT AND WARRANT THAT YOU HAVE THE AUTHORITY TO ACT ON +BEHALF OF AND BIND SUCH COMPANY, GOVERNMENT OR OTHER ENTITY (IF ANY). +WITHOUT LIMITING THE FOREGOING, YOU (AND YOUR ENTITY, IF ANY) ACKNOWLEDGE THAT BY SUBMITTING AN ORDER +FOR THE SPLUNK SOFTWARE, YOU (AND YOUR ENTITY (IF ANY)) HAVE AGREED TO BE BOUND BY THIS AGREEMENT. +As used in this Agreement, "Splunk," refers to Splunk Inc., a Delaware corporation, with its principal place of business at 270 Brannan +Street, San Francisco, California 94107, U.S.A.; and "Customer" refers to the company, government, or other entity on whose behalf +you have entered into this Agreement or, if there is no such entity, you as an individual. +1. DEFINITIONS. Capitalized terms used but not otherwise defined in this Agreement have the meanings set forth in Exhibit A. +2. LICENSE GRANTS + 2.1 Purchased Software. Subject to Customer's compliance with this Agreement, including Customer's timely payment +of all License Fees, Splunk grants to Customer a nonexclusive, worldwide, nontransferable, nonsublicensable license during the +applicable Term to install and use the Purchased Software within the Licensed Capacity solely for Customer's Internal Business +Purposes. + 2.2 Evaluation Software. If the applicable Order specifies that any Software is provided under an evaluation license or a +free trial license, then subject to Customer's compliance with this Agreement, Splunk grants to Customer a nonexclusive, +worldwide, nontransferable, nonsublicensable license during the applicable Term to install and use the Evaluation Software within +the Licensed Capacity solely for evaluating whether Customer wishes to purchase a commercial license for such Software. +Notwithstanding anything to the contrary in this Agreement, Splunk does not provide maintenance and support (Section 7), +warranty (Section 10), or indemnification (Section 13) with respect to Evaluation Software. + 2.3 Test and Development Software. If the applicable Order specifies that any Software is provided under a test and +development license, then subject to Customer's compliance with this Agreement, Splunk grants to Customer a nonexclusive, +worldwide, nontransferable, nonsublicensable license during the applicable Term to install and use the Test and Development +Software within the Licensed Capacity in a non-production system used for software product migration testing, software product +pre-production staging, testing new data sources, types or use cases, or other non-production use. In no way should the Test and +Development Software be used for any revenue generation, commercial activity or other productive business or purpose. +Notwithstanding anything to the contrary in this Agreement, Splunk does not provide warranty (Section 10), or indemnification +(Section 13) with respect to the Test and Development Software. + 2.4 Free Software. Splunk may make certain Software available for license without charge, and such Free Software may +have limited features, functions, or other limitations of any kind. Subject to Customer's compliance with this Agreement, Splunk +grants to Customer a nonexclusive, worldwide, nontransferable, nonsublicensable license during the applicable Term to install and +use the Free Software within the Licensed Capacity solely for Customer's Internal Business Purposes. Notwithstanding anything to +the contrary in this Agreement, Splunk does not provide maintenance and support (Section 7), warranty (Section 10), or +indemnification (Section 13) with respect to Free Software. + 2.5 Content Subscription. When the applicable Order specifies a Content Subscription service as elected by Customer, +Splunk will deliver or otherwise make available the applicable Content Subscription service to Customer during the subscription +period, and subject to Customer's compliance with this Agreement (including Customer's timely payment of all applicable Content +Subscription Fees), Splunk grants to such Customer a nonexclusive, worldwide, nontransferable, nonsublicensable license during +the applicable subscription period to install and use the subscribed content solely in connection with the designated Purchased +Software and solely for Customer's Internal Business Purposes. Such content will be treated as Purchased Software under this +Agreement except that Section 10 (Warranty) will not apply. + 2.6 Splunk Extensions. Subject to Customer's compliance with this Agreement, including Customer's timely payment of +all License Fees (if any), Splunk grants to Customer a nonexclusive, worldwide, nontransferable, nonsublicensable license to use +Splunk Extensions solely in connection with applicable Software that Customer has licensed from Splunk, subject to the same +limitations and restrictions (including with respect to Term and Licensed Capacity) that apply to the Software with which the Splunk +Extensions are used. Notwithstanding the foregoing, if any Splunk Extension is provided to Customer under a separate license +agreement that grants Customer more permissive or broader rights with respect to such Splunk Extension (e.g., a separate license +agreement that is provided to Customer as part of the download process for such Splunk Extension), then that separate license +agreement, and not this Agreement, will govern Customer's installation and use of such Splunk Extension (but, for clarity, this +Agreement will apply to all other Splunk Extensions). + 2.7 Customer Extensions. Subject to Customer's compliance with this Agreement, Splunk grants to Customer a +nonexclusive, worldwide, nontransferable, nonsublicensable license (a) to copy, modify and use the Splunk Developer Tools solely +to develop Extensions for use with the designated Software or Splunk Extension ("Customer Extensions"), including to support +interoperability between the Software or Splunk Extension and Customer's system or environment and (b) to distribute the +Customer Extensions exclusively for the use with the designated Software or Splunk Extension. The foregoing license is subject to +the following conditions: (x) Splunk proprietary legends or notices contained in the Splunk Developer Tools may not be removed or +altered when used in or with the Customer Extension; and (y) Customer may not make any statement that Customer Extension is +certified (unless it is duly certified by Splunk through the Splunk App Certification Program) or that its performance is guaranteed +by Splunk. Customer retains title to the Customer Extensions, subject to Splunk's ownership set forth in Section 5. If Customer +allows end users of Customer Extensions to modify or distribute the Customer Extensions, Customer shall limit such modification +or distribution to use with the designated Software or Splunk Extension only, and will flow down the conditions in (x) and (y) above +to end users of Customer Extensions. Customer agrees to assume full responsibility for the performance and distribution of +Customer Extensions. + 2.8 Open Source Software. Customer acknowledges that certain Software may contain Open Source Software. Open +Source Software may be identified in the end user documentation or in a list of the Open Source Software provided to Customer +upon Customer's written request. Any Open Source Software that is delivered to Customer as part of Purchased Software, and +which may not be taken out of the Purchased Software or used separately from the Purchased Software is covered by the +warranty, support and indemnification provisions applicable to Purchased Software. Customer acknowledges that specific terms +required by the respective licensor of the Open Source Software may apply to the use of Open Source Software, which terms shall +be included in the documentation; however, these terms will not: (a) impose any additional restrictions on Customer's use of the +Software, or (b) negate or amend Splunk's responsibilities with respect to Purchased Software. +3. LICENSE RESTRICTIONS. Unless otherwise expressly permitted by Splunk, Customer will not and Customer has no right to: (a) +copy any Splunk Materials (except as required to run the Software and for reasonable backup purposes); (b) modify, adapt, or +create derivative works of any Splunk Materials; (c) rent, lease, loan, resell, transfer, sublicense, distribute, disclose or otherwise +provide any Splunk Materials to any third party; (d) decompile, disassemble or reverse-engineer any Splunk Materials, or +determine or attempt to determine any source code, algorithms, methods or techniques embodied in any Splunk Materials, except +to the extent expressly permitted by applicable law notwithstanding a contractual prohibition to the contrary; (e) access or use any +Disabled Materials; (f) provide to any third party the results of any benchmark tests or other evaluation of any Splunk Materials +without Splunk's prior written consent; (g) attempt to disable or circumvent any license key or other technological mechanisms or +measures intended to prevent, limit or control use or copying of, or access to, any Splunk Materials (including in order to gain +access to any Disabled Materials); (h) remove or obscure any copyright, trademark, patent, or other proprietary notices, legends or +symbols from any Splunk Materials; (i) exceed the Licensed Capacity; (j) separately use any of the applicable features and +functionalities of the Splunk Materials with external applications or code not furnished by Splunk or any data not processed by the +Software, except otherwise specifically permitted in the Documentation; (k) otherwise access or use any Splunk Materials except +as expressly authorized in this Agreement; or (l) encourage or assist any third party to do any of the foregoing. Customer +acknowledges that the Software may be configured to display warnings, reduce available functionality, and/or cease functioning if +unauthorized or improper use is detected, including if the Term expires or the Licensed Capacity is reached or exceeded. +4. CONSULTANTS. Customer may permit its authorized consultants, contractors, and agents ("Service Providers") to access and +use the Software solely on Customer's behalf in connection with providing services to Customer, subject to the terms and +conditions of this Agreement. Any such access or use by a Service Provider will be subject to the same limitations and restrictions +that apply to Customer under this Agreement, and Customer will be jointly and severally liable for any Service Provider's actions +relating to or use of the Software. For avoidance of doubt, the aggregate use by Customer and all of its Service Providers must not +exceed the Licensed Capacity and nothing in this Section 4 is intended to or will be deemed to increase any Licensed Capacity. +5. OWNERSHIP. Splunk, its suppliers and/or licensors own all worldwide right, title and interest in and to the Splunk Materials, +including all related Intellectual Property Rights. Except for the licenses expressly granted to Customer in Section 2, Customer will +not acquire or claim any right, title or interest in or to any Splunk Materials or related Intellectual Property Rights, whether by +implication, operation of law or otherwise. Notwithstanding anything to the contrary, the Software is licensed, not sold, to Customer. +To the extent that Customer provides any Feedback, Customer grants to Splunk a perpetual, irrevocable, worldwide, nonexclusive, +transferable, sublicensable, royalty-free, fully paid-up right and license to use and commercially exploit the Feedback in any +manner Splunk deems fit. +6. LICENSE AND SUBSCRIPTION FEES. Customer will pay all license fees set forth in the Order (the "License Fees") for the +Software delivered to Customer no later than thirty (30) days after the date of Splunk's applicable invoice. Customer will also pay +all content subscription fees as may be applicable to the Purchased Software, as identified in the Order (the "Content +Subscription Fees", collectively together with License Fees, the "Fees"). Without limitation of Splunk's other termination rights, if +Customer fails to pay the Fees when due, then Splunk may terminate this Agreement and all licenses granted hereunder by notice +to Customer. All Fees are non-refundable once paid. Any fees and payment terms for Splunk Extensions not included in the Order +will be as set forth on the download page for such Splunk Extensions. +7. MAINTENANCE AND SUPPORT. If Customer has purchased support and maintenance for the Purchased Software as set forth in +the Order (the "Support Services"), then Splunk will provide the level of support and maintenance included in the Order in +accordance with the terms and conditions set forth in Exhibit C. +8. CONFIGURATION SERVICES. Subject to Customer's payment of applicable fees, Splunk will provide the deployment, usage +assistance, configuration, and/or training services (if any) set forth in the Order (the "Professional Services") in accordance with +Splunk's standard professional services terms and conditions, which terms and conditions are hereby incorporated by reference +and made a part of this Agreement. +9. SOFTWARE VERIFICATION AND AUDIT. At Splunk's request, Customer will furnish Splunk with a certification signed by +Customer's authorized representative verifying that the Software is being used in accordance with this Agreement and the +applicable Order. Also, if Customer has purchased an offering that requires usage reporting as identified in the Order, Customer +agrees to provide such reporting pursuant to the requirements set forth by Splunk. Upon at least ten (10) days' prior written notice +to Customer, Splunk may audit Customer's (and its Service Providers') use of the Software to ensure that Customer (and such +Service Providers) are in compliance with this Agreement and the applicable Order. Any such audit will be conducted during +regular business hours at Customer's (and/or its Service Providers) facilities, will not unreasonably interfere with Customer's (or its +Service Providers') business and will comply with Customer's (or its Service Providers') reasonable security procedures. Customer +will (and will ensure that its Service Providers) provide Splunk with reasonable access to all relevant records and facilities +reasonably necessary to conduct the audit. If an audit reveals that Customer (and/or any Service Provider) has exceeded the +Licensed Capacity or the scope of Customer's license grant during the period audited, then Splunk will invoice Customer, and +Customer will promptly pay Splunk any underpaid Fees based on Splunk's price list in effect at the time the audit is completed. If +the excess usage exceeds ten percent (10%) of the Licensed Capacity, then Customer will also pay Splunk's reasonable costs of +conducting the audit. Customer will ensure that its Service Providers provide Splunk with the access described in this Section 9. +This Section 9 will survive expiration or termination of this Agreement for a period of three (3) years. +10. WARRANTY. Splunk warrants that for a period of thirty (30) days from the Delivery of Purchased Software, the Purchased +Software will substantially perform the material functions described in Splunk's user documentation for such Purchased Software, +when used in accordance with the user documentation. The sole liability of Splunk (and its Affiliates and suppliers/licensors), and +Customer's sole remedy, for any failure of the Purchased Software to conform to the foregoing warranty, is for Splunk to do one of +the following (at Splunk's sole option and discretion): (a) modify, or provide an Enhancement for, the Purchased Software so that it +conforms to the foregoing warranty, (b) replace Customer's copy of the Purchased Software with a copy that conforms to the +foregoing warranty, or (c) terminate the license with respect to the non-conforming Purchased Software and refund the License +Fees paid by Customer for such non-conforming Purchased Software. All warranty claims must be made by written notice from +Customer to Splunk on or before the expiration of the warranty period, as detailed in Section 23.2 below. +11. WARRANTY DISCLAIMER. EXCEPT AS EXPRESSLY SET FORTH IN SECTION 10 ABOVE, THE SPLUNK MATERIALS, OPEN +SOURCE SOFTWARE, THIRD PARTY CONTENT, SUPPORT SERVICES AND PROFESSIONAL SERVICES ARE PROVIDED +"AS IS" WITH NO WARRANTIES WHATSOEVER, EXPRESS OR IMPLIED. TO THE FULL EXTENT PERMITTED BY LAW, +SPLUNK AND ITS SUPPLIERS AND LICENSORS DISCLAIM ALL WARRANTIES OTHER THAN AS EXPRESSLY SET FORTH +IN SECTION 10, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS +FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR QUIET ENJOYMENT, AND ANY WARRANTIES ARISING OUT OF +COURSE OF DEALING OR TRADE USAGE. WITHOUT LIMITATION OF THE GENERALITY OF THE FOREGOING, SPLUNK +DOES NOT WARRANT THAT USE OF THE SOFTWARE WILL BE UNINTERRUPTED, ERROR FREE OR SECURE, OR THAT +ALL DEFECTS WILL BE CORRECTED. +12. LIMITATION OF LIABILITY. TO THE FULL EXTENT PERMITTED BY APPLICABLE LAW AND NOTWITHSTANDING ANY +FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY OR LIMITATION OF LIABILITY: (A) SPLUNK AND ITS +AFFILIATES, SUBSIDIARIES, OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, PARTNERS (INCLUDING AUTHORIZED +PARTNERS AS DEFINED IN SECTION 21 BELOW) AND LICENSORS (THE "SPLUNK ENTITIES") WILL NOT BE LIABLE FOR +ANY SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (INCLUDING ANY DAMAGES ARISING +FROM LOSS OF USE, LOSS OF DATA, LOST PROFITS, LOST REVENUE, BUSINESS INTERRUPTION, OR COSTS OF +PROCURING SUBSTITUTE SOFTWARE OR SERVICES) ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE +SUBJECT MATTER HEREOF; AND (B) SPLUNK ENTITIES' TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATING +TO THIS AGREEMENT OR THE SUBJECT MATTER HEREOF WILL NOT EXCEED THE AMOUNTS PAID BY CUSTOMER TO +SPLUNK FOR THE PURCHASED SOFTWARE IN THE TWELVE (12) MONTHS PRIOR TO THE EVENT GIVING RISE TO SUCH +LIABILITY, IN EACH OF THE FOREGOING CASES (A) AND (B), REGARDLESS OF WHETHER SUCH LIABILITY ARISES +FROM CONTRACT, INDEMNIFICATION, WARRANTY, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR +OTHERWISE, AND REGARDLESS OF WHETHER SPLUNK HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH LOSS OR +DAMAGE. IN ADDITION, CUSTOMER, AND NOT SPLUNK, IS SOLELY RESPONSIBLE FOR THE ACCURACY, QUALITY AND +SECURITY OF CUSTOMER'S DATA AND FOR MAINTAINING A BACKUP OF ALL SUCH DATA, AND FOR ENSURING THE +SECURITY AND INTEGRITY OF CUSTOMER'S (AND ITS SERVICE PROVIDER'S) DATA, COMPUTERS, NETWORKS AND +SYSTEMS (INCLUDING WITH RESPECT TO PROTECTING AGAINST VIRUSES AND MALWARE). +13. INDEMNITY. Splunk will defend Customer against any claim, demand, suit or proceeding brought against Customer by a third +party alleging that Purchased Software infringes or misappropriates such third party's Intellectual Property Rights ("Claim"), and +Splunk will pay all damages finally awarded against Customer by a court of competent jurisdiction as a result of such Claim, +subject to the other terms and conditions of this Agreement. Notwithstanding the foregoing, Splunk has no obligation to indemnify +Customer with respect to: (a) use of the Purchased Software in a manner that is not permitted under the Agreement or that is +inconsistent with Splunk's applicable user documentation; (b) modifications to the Splunk Materials made by anyone other than +Splunk; (c) the combination of Software with hardware or software not made by Splunk, or with third-party services, processes or +materials where the infringement or misappropriation would not occur but for such combination; (d) Customer's continued use of +the Purchased Software or other allegedly infringing activity after receiving notice of the alleged infringement; or (e) any version of +the Purchased Software that is no longer supported by Splunk ((a) through (e), collectively, "Excluded Matters"). If an applicable +Claim is made or appears likely to be made, Splunk may, at its option and expense, modify the affected Purchased Software so +that it is noninfringing, or replace it with substantially functionally equivalent software. If Splunk determines that neither is +reasonably feasible, Splunk may terminate Customer's applicable license and refund Customer a pro rata refund of the Fees +previously paid by Customer, which will be calculated using the remainder of the license term (beginning with the date of Splunk's +receipt of notice of the applicable Claim), or if the Purchased Software is licensed under a perpetual license, a refund of Fees +previously paid by Customer, less straight-line depreciation on a three-year basis from the Delivery of the applicable Software. The +obligations set forth in this Section constitute Customer's sole and exclusive remedy, and Splunk's entire liability, with respect to +any Claims that the Purchased Software infringes any third party's Intellectual Property Rights. Customer will defend Splunk +against any Claim brought against Splunk by a third party arising out of or relating to any Excluded Matter or any Customer +Extension, and Customer will pay all damages finally awarded against Splunk by a court of competent jurisdiction as a result of +such Claim. Each party's indemnity obligations set forth in this Section 13 are conditioned upon the party seeking indemnification +(x) providing prompt written notice to the other party of the applicable Claim; (y) giving the indemnifying party sole control of the +defense and/or settlement of the Claim, except that: (i) the indemnified party may participate in the defense with counsel of its +choice at its own expense, and (ii) the indemnifying party will not agree to any settlement that imposes a material obligation on the +indemnified party without the indemnified party's prior written consent (not to be unreasonably withheld or delayed), and (z) +providing reasonable cooperation and assistance in the defense and negotiations. +14. CONFIDENTIAL INFORMATION. + 14.1 Confidential Information. "Confidential Information" means any technical or business information, ideas, +materials, know-how or other subject matter that is disclosed by one party to the other party that: (a) if disclosed in writing, is +marked "confidential" or "proprietary" at the time of such disclosure; (b) if disclosed orally, is identified as "confidential" or +"proprietary" at the time of such disclosure, and is summarized in a writing sent by the disclosing party to the receiving party within +thirty (30) days after any such disclosure; or (c) under the circumstances, a person exercising reasonable business judgment would +understand to be confidential or proprietary. Confidential Information of Splunk will include the Splunk Materials (including any +license keys). + 14.2 Use and Disclosure Restrictions. The party receiving Confidential Information ("Recipient") agrees: (a) to maintain +the Confidential Information of the party disclosing such information (the "Discloser") in strict confidence; (b) not to disclose such +Confidential Information to any third parties; and (c) not to use any such Confidential Information for any purpose other than to +exercise its rights or perform its obligations under this Agreement. Recipient will treat Confidential Information of the Discloser with +the same degree of care as it accords to its own Confidential Information, but in no event with less than reasonable care. Recipient +may disclose the Confidential Information of Discloser to its directors, officers, employees, and subcontractors (collectively, +"Representatives"), who have a bona fide need to know such Confidential Information, provided that each such Representative is +bound by a legal obligation as protective of the other party's Confidential Information as those set forth herein. Recipient's +obligations under this Section 14 will continue in effect for a period of three (3) years from the date of last disclosure of Confidential +Information by Discloser, except that Customer's obligations under this Section 14 will continue in effect in perpetuity with respect +to Splunk Materials. + 14.3 Exclusions. The obligations of Recipient under Section 14.1 will not apply to any Confidential Information that: (a) is +now or thereafter becomes generally known or available to the public, through no act or omission on the part of Recipient (or any of +its Representatives, Affiliates, or agents) or any third party subject to any use or disclosure restrictions with respect to such +Confidential Information; (b) was known by or lawfully in the possession of Recipient, prior to receiving such information from +Discloser, without restriction as to use or disclosure; (c) is rightfully acquired by Recipient from a third party who has the right to +disclose it and who provides it without restriction as to use or disclosure; or (d) is independently developed by Recipient without +access, use or reference to any Confidential Information of Discloser. + 14.4 Required Disclosures. The provisions of Section 14.1 will not restrict Recipient from disclosing Discloser's +Confidential Information to the extent required by any law or regulation or compelled by a court or administrative agency of +competent jurisdiction, provided that, to the extent permissible under law, Recipient uses reasonable efforts to give Discloser +advance notice of such required disclosure in order to enable Discloser to prevent or limit disclosure. + 14.5 Return or Destruction of Confidential Information. Upon termination of the Agreement or support and +maintenance, Recipient will promptly return to Discloser or, at Discloser's option, destroy all tangible items and embodiments +containing or consisting of Discloser's Confidential Information and all copies thereof and provide written certification of such +destruction or return by an authorized person. + 14.6 Injunctive Relief. Recipient agrees that, due to the unique nature of the Confidential Information, the unauthorized +disclosure or use of the Confidential Information will cause irreparable harm and significant injury to Discloser, the extent of which +will be difficult to ascertain and for which there will be no adequate remedy at law. Accordingly, Recipient agrees that Discloser, in +addition to any other available remedies, will have the right to an immediate injunction and other equitable relief enjoining any +breach or threatened breach of this Section 14, without the necessity of posting any bond or other security. Recipient will notify +Discloser in writing immediately upon Recipient's becoming aware of any such breach or threatened breach. +15. TERM. This Agreement will commence upon Splunk's first delivery of the Software specified in the Order (or, Splunk's other initial +delivery of the Software to Customer) and will remain in effect until the expiration of the applicable Software license term, unless +earlier terminated pursuant to Section 16 (the "Term"). For the avoidance of doubt, termination of a license term shall not affect the +term of any other licenses applicable to other Splunk products and services that Customer has purchased. Further, termination of a +Content Subscription shall not affect the term of the base license applicable to the Software that Customer has purchased. +15.1 Purchased Software, etc. Unless otherwise indicated in the Order, the Term for Purchased Software, Free Software, +Splunk Extensions and Splunk Developer Tools, if applicable, will continue indefinitely, unless and until terminated +pursuant to Section 16. If the Order indicates a Term of a specific duration for any of the foregoing, the licenses granted to +Customer for such Purchased Software or Free Software will terminate automatically upon expiration of such Term. Upon +expiration of any Term, the applicable Software will stop working automatically. +15.2 Evaluation Software. If Customer is granted a license for Evaluation Software, then the Term for such Evaluation +Software will be specified in the Order or with the license key. If no such term is specified, the Term for Evaluation Software +is thirty (30) days from the date the license key is delivered. Any license keys provided for Evaluation Software will +automatically expire and cause the Evaluation Software to become non-operational at the end of the Term. If Customer +wishes to use the Evaluation Software after the Term expires, then Customer must obtain the applicable paid license. +16. TERMINATION. Either party may terminate this Agreement by written notice to the other party if the other party materially +breaches this Agreement and does not cure the breach within thirty (30) days of receiving written notice of the breach pursuant to +Section 23.2 below. In addition, Splunk may immediately terminate this Agreement (in whole or in part, including with respect to +any Term) by written notice to Customer (a) if Customer materially breaches Section 3, and (b) as set forth in Section 6. Splunk +may also terminate Customer's license to any Evaluation Software at any time with or without cause by notice to Customer. If +Customer is the Government, then termination terms and conditions will be governed by 48 C.F.R. Section 52.212-4. Upon any expiration +or termination of this Agreement, the rights and licenses granted to Customer hereunder will automatically terminate, and +Customer agrees to cease immediately using the Splunk Materials and to return or destroy all copies of the Splunk Materials and +other Splunk Confidential Information in Customer's possession or control, and certify in writing the completion of such return or +destruction in accordance with Section 14.4. Upon termination of this Agreement, Splunk will have no obligation to refund any Fees +or other amounts received from Customer during the Term, and notwithstanding any early termination above, Customer shall still +be required to pay all Fees payable under an Order (i.e., no such early termination shall relieve Customer of its obligations to pay +all Fees payable under an Order) unless otherwise provided in this Agreement. Termination of Support and Maintenance Terms +and Conditions due to Splunk's breach is provided in Section 3.2 of Exhibit C. Section 1 (Definitions), Section 5 (Ownership), +Section 9 (Software Verification and Audit), Section 11 (Warranty Disclaimer), Section 12 (Limitation of Liability), Section 13 +(Indemnity), Section 14 (Confidentiality), Section 16 (Termination) and Sections 17 (Export) through 23 (General) will survive any +expiration or termination of this Agreement. +17. EXPORT. Customer will comply fully with all relevant export laws and regulations of the United States and any other country +("Export Laws") where Customer uses any of the Splunk Materials. Customer certifies that Customer is not on any of the relevant +U.S. government lists of prohibited persons, including the Treasury Department's List of Specially Designated Nationals and the +Commerce Department's List of Denied Persons or Entity List. Customer further certifies that Customer will not export, re-export, +ship, transfer or otherwise use the Splunk Materials in any country subject to an embargo or other sanction by the United States, +including Iran, Syria, Cuba, Sudan and North Korea and that Customer will not use the Splunk Materials for any purpose prohibited +by the Export Laws, including, but not limited to, nuclear, chemical, missile or biological weapons related end uses. +18. GOVERNMENT END USER RIGHTS. Customer acknowledges that all Splunk Materials were developed entirely at private +expense and that no part of the Splunk Materials was first produced in the performance of a government contract. Customer +agrees that all Splunk Materials and any derivatives thereof are "Commercial Items" as defined in 48 C.F.R. Section 2.101, and if +Customer is the Government, then such use, duplication, reproduction, release, modification, disclosure or transfer of this +commercial product and data, is restricted in accordance with 48 C.F.R. Section 12.211, 48 C.F.R. Section 12.212, 48 C.F.R. Section 227.7102-2, +and 48 C.F.R. Section 227.7202, as applicable. Consistent with 48 C.F.R. Section 12.211, 48 C.F.R. Section 12.212, 48 C.F.R. Section 227.7102-1 through +48 C.F.R. Section 227.7102-3, and 48 C.F.R. Sections 227.7202-1 through 227.7202-4, as applicable, the Splunk Materials are licensed to +Government end users (a) only as Commercial Items and (b) with only those rights as are granted to all other users pursuant to +this Agreement and any related agreement(s), as applicable. Accordingly, Customer will have no rights in the Splunk Materials +except as expressly agreed to in writing by Customer and Splunk. +19. PUBLICITY. Customer agrees that Splunk may publish a brief description describing Customer's deployment of the Software and +identify Customer as a Splunk customer on any of Splunk's websites, client lists, press releases, and/or other marketing materials. +20. THIRD PARTY CONTENT DISCLAIMER. Certain Extensions and other materials available for download on Splunkbase are +developed and/or provided by third parties ("Third-Party Content"). Splunk makes such Third-Party Content available for +download on Splunkbase as a convenience to its customers, but Splunk neither controls nor endorses, nor is Splunk responsible +for, any Third-Party Content, including the accuracy, integrity, quality, legality, usefulness or safety of Third-Party Content. Certain +Third-Party Content may, among other things, be inaccurate, nonfunctional, infringing or dangerous. Nothing in this Agreement or +on Splunkbase will be deemed to be a representation or warranty by Splunk with respect to any Third-Party Content, even if a +particular Extension or other item of Third-Party Content is identified as "certified" for use with Software. Splunk has no obligation +to monitor Third-Party Content, and Splunk may block or disable access to any Third-Party Content at any time. In addition, the +availability of any Third-Party Content through Splunkbase does not imply Splunk's endorsement of, or affiliation with, any provider +of such Third-Party Content, nor does such availability create any legal relationship between Customer and any such provider. +Customer's use of Third-Party Content is at Customer's own risk and may be subject to any additional terms, conditions and +policies applicable to such Third-Party Content (such as license terms, terms of service or privacy policies of the providers of such +Third-Party Content). +21. AUTHORIZED PARTNERS. If Customer acquired the Software through an authorized reseller, partner or OEM of Splunk +("Authorized Partner") then, notwithstanding anything to the contrary in this Agreement: (a) Customer's use of the Software is +subject to any additional terms in the agreement provided by the Authorized Partner; (b) Customer agrees to pay the Authorized +Partner the Fees and other applicable fees, and Customer will have no direct Fee payment obligations to Splunk for such Software; +(c) Customer's agreement with the Authorized Partner is between Customer and the Authorized Partner and is not binding on +Splunk; and (d) Splunk may terminate this Agreement (including Customer's right to use the Software) if Splunk does not receive +payment for Customer's use of the Software from the Authorized Partner or if Customer breaches any term of this Agreement. If +Customer's warranty and support terms stated in its agreement with the Authorized Partner are different from those set forth in this +Agreement, then such different terms are solely between Customer and the Authorized Partner and Splunk will have no obligations +to Customer under this Agreement with respect to such different terms. Except as set forth in the preceding sentence, if there is +any conflict or inconsistency between this Agreement and Customer's agreement with Authorized Partner, then this Agreement will +control (and will resolve such inconsistency) as between Splunk and Customer. +22. CHOICE OF LAW AND DISPUTES. Unless Customer is the Government, this Agreement will be governed by and construed in +accordance with the laws of the State of California, as if performed wholly within the state and without giving effect to the conflicts +of law principles of any jurisdiction or the United Nations Convention on Contracts for the International Sale of Goods, the +application of which is expressly excluded. Any legal action or proceeding arising under this Agreement will be brought exclusively +in the federal or state courts located in San Francisco, California, and the parties hereby consent to personal jurisdiction and venue +therein (except that Splunk may seek injunctive relief to prevent improper or unauthorized use or disclosure of any Splunk +Materials in any court of competent jurisdiction). If Customer is the Government, this Agreement will be governed by and +interpreted in accordance with the Contract Disputes Act of 1978, as amended (41 U.S.C. Sections 7101-7109). Failure of the parties to +reach agreement on any request for equitable adjustment, claim, appeal, or action arising under or relating to this Agreement will +be a dispute to be resolved in accordance with the clause at 48 C.F.R Section 52.233-1, which is incorporated in this Agreement by +reference. +23. GENERAL. + 23.1 Purchase Order. Customer's issuance of a purchase order constitutes acceptance of this Agreement +notwithstanding anything to the contrary in such purchase order. If any purchase order contains any terms or conditions that are +different from or additional to the terms and conditions set forth in this Agreement, then Splunk expressly rejects such different or +additional terms and conditions, and such different or additional terms and conditions will not become a part of the agreement +between the parties notwithstanding any subsequent acknowledgement, invoice or license key that Splunk may issue. + 23.2 Notices. All notices required or permitted under this Agreement will be in writing and delivered in person, by +confirmed facsimile transmission, by overnight delivery service, or by registered or certified mail, postage prepaid with return +receipt requested, and in each instance will be deemed given upon receipt. All communications will be sent to the addresses set +forth in the applicable Order or to such other address as may be specified by either party to the other party in accordance with this +Section. + 23.3 Assignment. Customer may not assign, delegate or transfer this Agreement, in whole or in part, by agreement, +operation of law or otherwise without the prior written consent of Splunk. Splunk may assign this Agreement in whole or in part to +an Affiliate or in connection with an internal reorganization or a merger, acquisition, or sale of all or substantially all of Splunk's +assets to which this Agreement relates. Splunk may also assign its rights to receive payment due as a result of performance of this +Agreement to a bank, trust company, or other financing institution, including any federal lending agency in accordance with the +Assignment of Claims Act (31 U.S.C. Section 3727) and may assign this Agreement in accordance with the provisions at 48 C.F.R +Section 42.12, as applicable. Any attempt to assign this Agreement other than as permitted herein will be null and void. Subject to the +foregoing, this Agreement will bind and inure to the benefit of the parties' permitted successors and assigns. + 23.4 Rights and Remedies. Except as otherwise expressly set forth in this Agreement, the rights and remedies of either +party as set forth in this Agreement are not exclusive and are in addition to any other rights and remedies now or hereafter +provided by law or at equity. + 23.5 Waiver; Severability. The waiver by either party of a breach of or a default under this Agreement will not be effective +unless in writing. The failure by either party to enforce any provisions of this Agreement will not constitute a waiver of any other +right hereunder or of any subsequent enforcement of that or any other provisions. If a court of competent jurisdiction holds any +provision of this Agreement invalid or unenforceable, the remaining provisions of the Agreement will remain in full force and effect, +and the provision affected will be construed so as to be enforceable to the maximum extent permissible by law. + 23.6 Interpretation. For purposes of interpreting this Agreement, (a) unless the context otherwise requires, the singular +includes the plural, and the plural includes the singular; (b) unless otherwise specifically stated, the words "herein," "hereof," and +"hereunder" and other words of similar import refer to this Agreement as a whole and not to any particular section or paragraph; +(c) the words "include" and "including" will not be construed as terms of limitation, and will therefore mean "including but not limited +to" and "including without limitation"; (d) unless otherwise specifically stated, the words "writing" or "written" mean preserved or +presented in retrievable or reproducible form, whether electronic (including email but excluding voice mail) or hard copy; (e) the +captions and section and paragraph headings used in this Agreement are inserted for convenience only and will not affect the +meaning or interpretation of this Agreement; and (f) the references herein to the parties will refer to their permitted successors and +assigns. + 23.7 Data Collection; Privacy. From time to time, Splunk may collect and process technical and related information about +Customer's use of the Software, which may include Internet protocol addresses, hardware identification, operating system, +application software and other usage information, and use this information to support and troubleshoot issues, provide updates, +invoice, analyze trends and improve Splunk's products or services. Such information will be subject to the Splunk Privacy Policy, +which policy is hereby incorporated by reference and made a part of this Agreement. + 23.8 Integration; Entire Agreement. This Agreement along with any additional terms incorporated herein by reference, +including the Order and the Exhibits hereto, constitute the complete and exclusive understanding and agreement between the +parties and supersedes any and all prior or contemporaneous agreements, communications and understandings, written or oral, +relating to their subject matter. Any waiver, modification or amendment of any provision of this Agreement will be effective only if in +writing and signed by duly authorized representatives of both parties. Any terms and conditions contained or referenced by either +party in a quote, purchase order, acceptance, invoice or any similar document purporting to modify the terms and conditions +contained in this Agreement will be disregarded and have no effect unless otherwise expressly agreed to by the parties in +accordance with the preceding sentence. + + + +EXHIBIT A +DEFINITIONS +1. "Affiliate," with respect to a party, means a corporation, partnership or other entity controlling, controlled by or under common +control with such party, but only so long as such control continues to exist. For purposes of this definition, "control" means +ownership, directly or indirectly, of greater than fifty percent (50%) of the voting rights in such entity (or, in the case of a +noncorporate entity, equivalent rights). +2. "Authorized Partner" has the meaning set forth in Section 21. +3. "Claim" has the meaning set forth in Section 13. +4. "Confidential Information" has the meaning set forth in Section 14.1. +5. "Content Subscription" means certain entitlement for Customer to receive a collection of updated contents applicable to the +Purchased Software (such as models, rules and configurations, as further described in the relevant end user documentation for the +Purchased Software) on a periodic basis for the duration of the subscription period. This can be purchased as an add-on service +to the term license or perpetual license to the applicable Purchased Software as identified in the Order. +6. "Content Subscription Fees" has the meaning set forth in Section 6. +7. "Customer Extensions" has the meaning set forth in Section 2.7. +8. "Delivery" means the date of Splunk's initial delivery of the license key for the applicable Software or otherwise making the +applicable Software available for download by Customer. +9. "Disabled Materials" means certain materials (including programs, modules or components, functionality, features, +documentation, content or other materials) that may be contained in or provided with the Software as part of the delivery +mechanism used by Splunk, but that are disabled or hidden in Customer's setting, because Customer either: (a) does not have the +relevant license or license key, or (b) has not paid the applicable Fees, for those materials. +10. "Enhancements" means any updates, upgrades, releases, fixes, enhancements or modifications to the Purchased Software made +generally commercially available by Splunk to its support customers under the terms and conditions set forth in Exhibit C. +11. "Evaluation Software" means Software that is specified in an Order as provided under an evaluation license or a free trial license. +12. "Excluded Matters" has the meaning set forth in Section 13. +13. "Extension" means any separately downloadable suite, configuration file, add-on, technical add-on, example module, command, +function or application that extends the features or functionality of the applicable Software. +14. "Feedback" means all suggestions for improvement or enhancement, recommendations, comments, opinions, code, input, ideas, +reports, information, know-how or other feedback provided by Customer (whether in oral, electronic or written form) to Splunk in +connection with Splunk's Software. Feedback does not include any data, results or output created or generated by Customer using +the Software, unless specifically submitted or communicated by Customer to Splunk as part of the Feedback. +15. "Free Software" means Software that is specified in an Order as provided to Customer without charge (other than Evaluation +Software). +16. "Government" means an agency, department, or instrumentality of the United States government. +17. "Intellectual Property Rights" means all patent, copyright, trademark, and trade secret rights and other intellectual property and +proprietary rights, whether registered or unregistered. +18. "Internal Business Purpose" means Customer's use for its own internal business operations on Customer's systems, networks +and devices with Customer's data. Such use does not include use by Customer on a service bureau basis or otherwise to provide +services to, or process data for, any third party. +19. "Licensed Capacity" means the maximum usage of the Software (e.g., aggregate daily volume of data indexed, number of Nodes, +number of users, etc.) that is permitted under the type of license included in the applicable Order. The available types of license +and the associated Licensed Capacity for each are set forth in Exhibit B. +20. "License Fees" has the meaning set forth in Section 6. +21. "Open Source Software" means software or similar subject matter that is distributed under an open source license such as (by +way of example only) the GNU General Public License, GNU Lesser General Public License, Apache License, Mozilla Public +License, BSD License, MIT License, Common Public License, any derivative of any of the foregoing licenses, or any other license +approved as an open source license by the Open Source Initiative. +22. "Order" means Splunk's quote, statement of work, or ordering document accepted by Customer or Customer's purchase order or +other ordering document submitted to Splunk (directly or indirectly through an Authorized Partner) to order Splunk Materials or +services, which references the products, services, pricing and other applicable terms set forth in an applicable Splunk quote or +ordering document. +23. "Professional Services" has the meaning set forth in Section 8. +24. "Purchased Software" means Software that is licensed to Customer and for which Customer has paid a License Fee to Splunk, +whether directly or through an Authorized Partner. +25. "Service Providers" has the meaning set forth in Section 4. +26. "Splunkbase" means Splunk's online directory of or platform for Extensions, currently located at https://splunkbase.splunk.com/ +and any and all successors, replacements, new versions, derivatives, updates and upgrades thereto. +27. "Splunk Developer Tool" means the standard application programming interface or configuration and related materials identified +and provided by Splunk for and with the applicable Software to enable the creation of Extensions or otherwise support +interoperability between the Software and Customer's system or environment. +28. "Splunk Extensions" means Extensions made available through Splunkbase that are identified on Splunkbase as published by +Splunk (and not by any third party). +29. "Splunk Materials" mean the Software, Software license keys, Splunk Developer Tools, Splunk Extensions and end user +documentation relating to the foregoing. +30. "Software" means the Software products listed in an Order and any Enhancements thereto made available to Customer by Splunk. +31. "Support Fees" has the meaning set forth in Exhibit C. +32. "Support Services" has the meaning set forth in Section 7. +33. "Term" has the meaning set forth in Section 15. +34. "Test and Development Software" means Software that is specified in an Order as provided under a test and development +license. +35. "Third-Party Content" has the meaning set forth in Section 20. + + +EXHIBIT B +LICENSED CAPACITY + +Product +License Type +Licensed Capacity + + + +Splunk Enterprise & Splunk Light + +Paid license +"Daily Indexing Volume" means the maximum daily aggregate volume of +uncompressed data for indexing as set forth in the Order Document + +Free license +500MB of uncompressed data for indexing per day + +Evaluation or trial license +Daily Indexing Volume + + + +Splunk Analytics for Hadoop + +Paid license +Maximum number of Nodes or Fractional Use of Nodes from which data can be +sourced to be analyzed and visualized, as identified in the applicable Order +Document (NOTE: Data in a Node that has already been indexed by Splunk +Enterprise (or Splunk Light or Splunk Cloud) will not be counted toward the paid +volume.) +"Node" means a 64 bit Linux operating system or any other operating system +identified in the documentation that runs Hadoop TaskTracker or Node Manager to +execute Splunk jobs on Hadoop nodes. +"Fractional Use of Nodes" means the greater of compute load or applicable +storage of the number of Nodes in Cluster(s) for a specific use case or business +unit, as identified in an Order Document. +"Cluster" means a group of Nodes administered by one Hadoop JobTracker or +Hadoop Resource Manager. + +Evaluation or Trial license +Maximum of five (5) Nodes from which data can be sourced to be analyzed and +visualized + + + +Splunk Enterprise Security + +Paid license +Daily Indexing Volume + + + +Splunk IT Service Intelligence (Splunk ITSI) + +Paid license +Daily Indexing Volume + + + +Splunk User Behavior Analytics (UBA) + +Paid license +Number of User Behavior Analytics Monitored Accounts. "Number of User +Behavior Analytics Monitored Accounts" means the number of user and system +accounts in Microsoft Active Directory, Lightweight Directory Access Protocol +(LDAP) or any similar service that is used to authenticate users inside the network. + + + +Splunk App for PCI Compliance + +Paid license +Daily Indexing Volume + + + +Splunk App for Microsoft Exchange +Paid license +Daily Indexing Volume + + + +Splunk App for VMware +Paid license +Daily Indexing Volume + + +EXHIBIT C +SPLUNK INC. +SUPPORT AND MAINTENANCE TERMS AND CONDITIONS +Customer agrees that the following terms and conditions ("Terms and Conditions") will govern the delivery of any support and/or maintenance +services by Splunk ("Support") listed on an Order entered into pursuant to the Software License Agreement (the "Agreement") to which these +Terms and Conditions are attached and made a part thereof. Subject to Customer's termination rights set forth in the Agreement, ordering any +Support from Splunk or any authorized reseller indicates Customer's acceptance of these Terms and Conditions. These Terms and Conditions +are effective upon receipt and confirmation of acceptance of Customer's purchase order by Splunk or an Authorized Partner (the "Effective +Date"). +1. DEFINITIONS. Unless otherwise defined in these Terms and Conditions, capitalized terms have the meanings set forth in the +Agreement. +2. SUPPORT AND MAINTENANCE. +2.1 Services. Subject to Customer's timely payment of the applicable annual Support fees set forth in the Order (the "Support +Fees"), Splunk will provide the level of Support identified in the Order in accordance with the Support descriptions set forth +below. No other maintenance or support for the Software is included. +2.2 Support Fees. Support Fees will be due and payable in accordance with the Order. Splunk will notify (electronically or +otherwise) Customer of the then-current annual Support Fee for Customer's level of Support in each notice of term renewal. +Support Fees are non-refundable once paid. +2.3 Exclusions. Splunk will have no obligation of any kind to provide Support for issues caused by or arising out of any of the +following (each, a "Licensee-Generated Error"): (i) modifications to the Software not made by Splunk; (ii) use of the Software +other than as authorized in the Agreement or as provided in the documentation for the Software; (iii) damage to the machine +on which the Software is installed; (iv) Customer's continued failure to use the Software without reference to the +documentation; (v) versions of the Software other than the most recent version or the Supported Prior Version (defined in +Section 2.6.8); (vi) third-party products not expressly supported by Splunk and described in the documentation; or (vii) conflicts +related to replacing or installing hardware, drivers, and software that are not expressly supported by Splunk and described in +the documentation. If Splunk determines that support for an issue caused by a Licensee-Generated Error, Splunk will notify +Customer as soon as reasonably possible under the circumstances. If Customer agrees that Splunk should provide support for +the Licensee-Generated Error via a confirming email, then Splunk will have the right to invoice Customer at Splunk's then- +current time and materials rates for any such support provided by Splunk. +2.4 Support for Splunk Extensions. Subject to Customer's payment of the applicable annual Support fees, if Customer are a +licensee of a Splunk Extension supported by Splunk, Splunk will provide an Initial Response and Acknowledgement in +accordance with P3 terms as described in Section 2.6.3 below. Updates for the Software will be provided when made +available. No other sections in these Terms and Conditions apply to Splunk Extensions. +2.5 Restrictions. Support is delivered only in English unless Customer is in a location where Splunk has made localized Support +available. +2.6 Support Descriptions. +2.6.1 Splunk Support. Customer's Order will identify one of three levels of Support: Standard, Enterprise or Global. Every +level of Splunk Support provides telephone support, online documentation, web forums, email and a web-based +portal for submitting cases and tracking case status. Support cases are handled based on case priority levels as +described in Section 2.6.2. When submitting a case, Customer will select the priority for initial response by logging +the case online, in accordance with the priority guidelines set forth in Section 2.6.2. When the case is received, +Splunk Support may change the priority if the issue does not conform to the criteria for the selected priority and will +provide Customer with notice (electronic or otherwise) of such change. Splunk Standard Support means in the first +forty-five (45) days from delivery of the Purchased Software, Splunk will provide an Initial Response and +Acknowledgement for P3 issues only and will provide Software updates, when available. Splunk will provide to +Customers of Test and Development Software P4 support through a web-based portal only. For Splunk Enterprise or +Splunk Global Supports, Splunk will respond to support requests and will provide workarounds or fixes in accordance +with the guidelines set forth in Section 2.6.3. Splunk Global Support also provides a primary contact to set up +meetings, as frequently as weekly, to monitor Customer's support issues; to provide additional status reports and +metrics; and to coordinate and execute a quarterly account status review at a mutually agreeable time. For a +summary of the different support programs, please visit http://www.splunk.com/en_us/support-and-services/support- +programs.html. +2.6.2 Case Priority Levels. Case priorities are assigned based on the technical importance of the problem on Customer's +Splunk environment. +P1 = Purchased Software is completely inaccessible or the majority of its functionality is +unusable. +P2 = One or more key features of Purchased Software are unusable. +P3 = Any other case where a Purchased Software feature is not operating as documented. +P4 = General questions and requests for enhancements to the Purchased Software. +2.6.3 Target Fix, Workaround, Escalation and Response Times. +Initial Response & Acknowledgment, +by case priority +Targeted Fix Date or Workaround, +by case priority +P1: 4 hours +P1: 1 day +P2: Next business day +P2: 1 week +P3: Two business days +P3: Next release +P4: Two business days +P4: At Splunk's discretion + +Escalation, +by case priority +Email Status Updates for Open Cases, +by case priority +P1: Manager: Immediate / VP: 1 business day +P1: Daily +P2: Manager: 1 business day / VP: 1 week +P2: Weekly +P3: VP Product Management reviews all open bugs +quarterly +P3: None +P4: VP Product Management reviews all +enhancement requests quarterly +P4: None + +2.6.4 Authorized Support Contacts. Support will be provided solely to the authorized individual(s) specified by Customer +that Splunk will communicate with that individual(s) when providing Support ("Support Contacts"). Splunk strongly +recommends that Customer's Support Contact(s) be trained on the Purchased Software. Customer's Order will +indicate a maximum number of authorized Support Contacts for Customer's license level. Customer will be asked to +designate Customer's authorized support contacts, including their primary email address and Splunk.com login ID, +following Splunk's acknowledgment of Customer's Order. +2.6.5 Defect Resolution. Should Splunk in its sole judgment determine that there is a defect in the Purchased Software, it +will, at its sole option, repair that defect in the version of the Software that Customer is currently using or instruct +Customer to install a newer version of the Software with that defect repaired. Splunk reserves the right to provide +Customer with a workaround in lieu of fixing a defect should it in its sole judgment determine that it is more effective +to do so. +2.6.6 Support Hours. Support is provided via telephone, email and web portal. Support will be delivered by a member of +Splunk's technical support team during the regional hours of operation listed below. +Enterprise Support +Global Support +P1: 24 x 7 +P1: 24 x 7 +P2: Monday through Friday by region (North +America, APAC and EMEA) during standard +business hours (8 am to 5 pm); excluding +Splunk holidays +P2: 24 hours per day during the five business days +(Monday through Friday), excluding Splunk +holidays +P3: Monday through Friday by region (North +America, APAC and EMEA) during standard +business hours (8 am to 5 pm); excluding +Splunk holidays +P3: 24 hours per day during the five business days +(Monday through Friday), excluding Splunk +holidays +P4: Monday through Friday by region (North +America, APAC and EMEA) during standard +business hours (8 am to 5 pm); excluding +Splunk holidays +P4: Monday through Friday by region (North +America, APAC and EMEA) during standard +business hours (8 am to 5 pm); excluding +Splunk holidays + +2.6.7 Customer's Obligation to Assist. Should Customer report a purported defect in the Purchased Software to Splunk, +Splunk may require Customer to provide them with the following information: (a) a general description of the +operating environment, (b) a list of all hardware components, operating systems and networks, (c) a reproducible test +case, and (d) any log files, trace and systems files. Customer's failure to provide this information may prevent Splunk +from identifying and fixing that purported defect. +2.6.8 Software Upgrades and Software End of Life Policy. When available, Splunk provides updates, upgrades, +maintenance releases and reset keys only to Splunk Support customers. Software comes with a three-digit number +version. The first digit represents the major release (i.e. upgrade), the second digit identifies the minor releases (i.e., +updates) and the third digit identifies the maintenance releases. With a new major version, the number to the left of +the decimal is changed and for minor releases, the number to the right of the decimal point is increased. Subject to +the foregoing, Splunk provides full Support, including, when available, bug fixes, only on the current major release +and (a) the immediately prior major release or (b) twenty-four months from the then current major release, whichever +period is longer ("Supported Prior Versions"). Notwithstanding the foregoing, Splunk will provide support for the +first annual term for UBA in accordance with the following terms: Support will be provided only for use of the most +current version of UBA plus the prior two releases, whether a minor or major release, or one year from delivery of +UBA, whichever period is longer. +2.7 Changes in Support and Software. Subject to Section 2.6.8, Customer acknowledges that Splunk has the right to +discontinue the manufacture and development of any Software and the Support for any Software, including the distribution of +older Software versions, at any time in its sole discretion, provided that Splunk agrees not to discontinue Support for the +Software during the current annual term of these Terms and Conditions, subject to the termination provisions herein. Splunk +reserves the right to alter Support from time to time, using reasonable discretion but in no event will such alterations result in (i) +diminished support from the level of Support set forth herein; (ii) materially diminished obligations for Splunk; (iii) materially +diminished Customer's rights; or (iv) higher Support Fees during the then-current term. Splunk will provide Customer with thirty +(30) days' prior written notice (delivered electronically or otherwise) of any permitted material changes to the Support +contemplated herein. +3. TERM AND TERMINATION. +3.1 Term. These Terms and Conditions will commence on the Delivery date and, unless terminated earlier in accordance with the +terms of the Agreement, for a period of one (1) year (or for term purchased if different than one year) thereafter (the "Initial +Term"). The agreement will automatically renew for additional one (1)-year terms (or for term purchased if different than one +year) (each, a "Renewal Term," and the Initial Term, collectively with any and all Renewal Terms, will be referred to as the +"Support Term"), unless either party provides the other (or if purchased through a reseller, Customer provides reseller) with +written notice of its intent not to renew the agreement at least thirty (30) days prior to the end of the then current Initial Term or +Renewal Term. Customer must purchase and/or renew Support for all of the licenses for a particular Software product. If the +Support Term lapses, Customer may seek to re-activate Support by submitting a purchase order that includes fees for the +lapsed period plus a reinstatement fee. +3.2 Termination. Either party may terminate this Agreement by written notice to the other party if the other party materially +breaches this Agreement and does not cure the breach within thirty (30) days of receiving notice of the breach. If Customer +terminates the Agreement for Splunk's uncured material breach of the support and maintenance terms set forth here in Exhibit +C, then Splunk will refund any unused prepaid fees to Customer as Customer's sole and exclusive remedy. +4. FORCE MAJEURE. Splunk will not be responsible for any failure or delay in its performance under these Terms and Conditions due to +causes beyond its reasonable control, including, but not limited to, labor disputes, strikes, lockouts, shortages of or inability to obtain +labor, energy, raw materials or supplies, war, acts of terror, riot, acts of God or governmental action. + + +Software License Agreement 05022017 1 diff --git a/deps/apps/Splunk_SA_CIM/locale/de_DE/LC_MESSAGES/messages.mo b/deps/apps/Splunk_SA_CIM/locale/de_DE/LC_MESSAGES/messages.mo new file mode 100644 index 000000000..5c86cf842 Binary files /dev/null and b/deps/apps/Splunk_SA_CIM/locale/de_DE/LC_MESSAGES/messages.mo differ diff --git a/deps/apps/Splunk_SA_CIM/locale/de_DE/LC_MESSAGES/messages.po b/deps/apps/Splunk_SA_CIM/locale/de_DE/LC_MESSAGES/messages.po new file mode 100644 index 000000000..d63abb08a --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/locale/de_DE/LC_MESSAGES/messages.po @@ -0,0 +1,526 @@ +# Copyright (C) 2009-2018 Splunk Inc. All Rights Reserved. +# +# Translatable strings for Common Information Model +# +# +msgid "" +msgstr "" +"Project-Id-Version: CIM Translation\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2016-08-27 16:20-0800\n" +"PO-Revision-Date: 2017-06-21 11:54+0100\n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: \n" +"Language-Team: \n" +"Language: de_DE\n" +"X-Generator: Poedit 2.0.1\n" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:250 +msgid "Application State" +msgstr "Anwendungsstatus" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:253 +msgid "Authentication" +msgstr "Authentisierung" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:256 +msgid "Certificates" +msgstr "Zertifikate" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:259 +msgid "Change Analysis" +msgstr "Änderungsanalyse" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:262 +msgid "Compute Inventory" +msgstr "Bestand berechnen" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:265 +msgid "DLP" +msgstr "DLP" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:268 +msgid "Databases" +msgstr "Datenbanken" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:274 +msgid "Interprocess Messaging" +msgstr "Nachrichtenübertragung zwischen Prozessen" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:277 +msgid "Intrusion Detection" +msgstr "Erkennung von unbefugtem Zugriff" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:280 +msgid "JVM" +msgstr "JVM" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:283 +msgid "Malware" +msgstr "Malware" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:286 +msgid "Network Resolution" +msgstr "Netzwerkauflösung" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:289 +msgid "Network Sessions" +msgstr "Netzwerksitzungen" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:298 +msgid "Ticket Management" +msgstr "Ticket-Management" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:301 +msgid "Updates" +msgstr "Aktualisierungen" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:304 +msgid "Vulnerabilities" +msgstr "Schwachstellen" + +#: appserver/static/js/views/CIMSetupView.js:41 appserver/static/cim_setup.js:239 +msgid "Saved" +msgstr "Gespeichert" + +#: appserver/static/js/views/CIMSetupView.js:44 +msgid "Save failed" +msgstr "Speichern fehlgeschlagen" + +#: appserver/static/js/views/CIMSetupView.js:53 +msgid "Splunk Common Information Model Add-on Set Up" +msgstr "Splunk Add-on für gemeinsames Informationsmodell - Einrichtung" + +#: appserver/static/js/views/CIMSetupView.js:55 +msgid "By default a datamodel will search across all indexes. Use the configuration panel below to constrain data model searches to specific indexes." +msgstr "" +"Standardmäßig durchsucht ein Datenmodell alle Indizes. Im nachstehenden Konfigurationsteilfenster können Sie Datenmodellsuchvorgänge auf bestimmte Indizes beschränken." + +#: appserver/static/js/views/CIMSetupView.js:266 +#, python-format +msgid "Restricted to: %s" +msgstr "Beschränkt auf: %s" + +#: appserver/static/js/views/CIMSetupView.js:270 +msgid "No restriction" +msgstr "Keine Beschränkung" + +#: appserver/static/js/views/CIMSetupView.js:276 +msgid "show all" +msgstr "alle anzeigen" + +#: appserver/static/js/views/DataModelConfig.js:260 +msgid "No datamodel found" +msgstr "Kein Datenmodell gefunden" + +#: appserver/static/js/views/IndexList.js:147 +#, python-format +msgid "%s MB" +msgstr "%s MB" + +#: appserver/static/js/views/IndexList.js:201 +msgid "Name" +msgstr "Name" + +#: default/data/ui/views/datamodel_audit.xml:2 +msgid "Data Model Audit" +msgstr "Datenmodell-Audit" + +#: default/data/ui/views/datamodel_audit.xml:8 +msgid "Top Accelerations By Size" +msgstr "Größte Beschleunigungen nach Größe" + +#: default/data/ui/views/datamodel_audit.xml:21 +msgid "Top Accelerations By Run Duration" +msgstr "Größte Beschleunigungen nach Ausführungsdauer" + +#: default/data/ui/views/datamodel_audit.xml:36 +msgid "Acceleration Details" +msgstr "Beschleunigungsdetails" + +#: default/data/ui/views/predictive_analytics.xml:2 +msgid "Predictive Analytics" +msgstr "Vorausschauende Analyse" + +#: default/data/ui/views/predictive_analytics.xml:17 +msgid "Function" +msgstr "Funktion" + +#: default/data/ui/views/predictive_analytics.xml:30 +msgid "Attribute" +msgstr "Attribut" + +#: default/data/ui/views/predictive_analytics.xml:47 +msgid "Prediction Over Time" +msgstr "Vorhersagen im Zeitverlauf" + +#: default/data/ui/views/predictive_analytics.xml:60 +msgid "Outliers" +msgstr "Ausreißer" + +#: default/data/ui/views/cim_setup.xml:2 +msgid "CIM Setup" +msgstr "CIM-Einrichtung" + +#: appserver/static/predictive_analytics.js:28 +msgid "Save as Correlation Search ..." +msgstr "Als Korrelationssuche speichern..." + +#: appserver/static/predictive_analytics.js:59 +msgid "All functions other than count require an attribute!" +msgstr "Für alle Funktionen außer Zählung ist ein Attribut erforderlich!" + +#: appserver/static/predictive_analytics.js:63 +msgid "Please select a function!" +msgstr "Wählen Sie eine Funktion aus!" + +#: appserver/static/predictive_analytics.js:142 +#, python-format +msgid "The correlation search was successfully created.


View created search

" +msgstr "Die Korrelationssuche wurde erfolgreich erstellt.


Erstellte Suche anzeigen

" + +#: appserver/static/predictive_analytics.js:237 +msgid "Correlation search could not be saved" +msgstr "Die Korrelationssuche konnte nicht gespeichert werden." + +#: appserver/static/predictive_analytics.js:352 +msgid "Save as Correlation Search" +msgstr "Als Korrelationssuche speichern" + +#: appserver/static/predictive_analytics.js:354 +msgid "Security Domain" +msgstr "Sicherheitsdomäne" + +#: appserver/static/predictive_analytics.js:357 +msgid "Severity" +msgstr "Schweregrad" + +#: appserver/static/predictive_analytics.js:360 +msgid "Correlation Search Name" +msgstr "Name der Korrelationssuche" + +#: appserver/static/predictive_analytics.js:361 +msgid "Enter the name of the correlation search" +msgstr "Geben Sie den Namen der Korrelationssuche ein." + +#: appserver/static/predictive_analytics.js:363 +msgid "Correlation Search Description" +msgstr "Beschreibung der Korrelationssuche" + +#: appserver/static/predictive_analytics.js:364 +msgid "Enter a description of the correlation search" +msgstr "Geben Sie eine Beschreibung für die Korrelationssuche ein." + +#: appserver/static/predictive_analytics.js:366 +msgid "The correlation search was successfully created" +msgstr "Die Korrelationssuche wurde erfolgreich erstellt." + +#: appserver/static/predictive_analytics.js:375 +msgid "Run Search First" +msgstr "Suche zuerst ausführen" + +#: appserver/static/predictive_analytics.js:376 +msgid "You need to run the search first before attempting to make a correlation search." +msgstr "Sie müssen zuerst die Suche ausführen, bevor Sie eine Korrelationssuche erstellen können." + +#: appserver/static/predictive_analytics.js:407 +msgid "Advanced Predict Options" +msgstr "Erweiterte Vorhersageoptionen" + +#: appserver/static/predictive_analytics.js:409 +msgid "Predict Timespan" +msgstr "Vorhersagezeitspanne" + +#: appserver/static/predictive_analytics.js:410 +msgid "defaults to 10m" +msgstr "standardmäßig 10 Min." + +#: appserver/static/predictive_analytics.js:411 +msgid "Use time specifiers: y, mon, d, h, m, s" +msgstr "Mögliche Zeitangaben: y, mon, d, h, m, s" + +#: appserver/static/predictive_analytics.js:413 +msgid "Algorithm" +msgstr "Algorithmus" + +#: appserver/static/predictive_analytics.js:416 +msgid "Correlate" +msgstr "Korrelieren" + +#: appserver/static/predictive_analytics.js:417 +msgid "For bivariate model, indicates the field to correlate against" +msgstr "Gibt bei einem bivariaten Modell das Feld an, für das die Korrelation durchgeführt werden soll." + +#: appserver/static/predictive_analytics.js:419 +msgid "Future Timespan" +msgstr "Künftige Zeitspanne" + +#: appserver/static/predictive_analytics.js:420 +msgid "Must be a non-negative number" +msgstr "Muss eine nicht negative Zahl sein" + +#: appserver/static/predictive_analytics.js:421 +msgid "The length of prediction into the future" +msgstr "Die Länge der Vorhersage in der Zukunft" + +#: appserver/static/predictive_analytics.js:423 +msgid "Holdback" +msgstr "Zurückhalten" + +#: appserver/static/predictive_analytics.js:424 +msgid "Specifies the 'number' of data points from the end that are NOT used to build the model" +msgstr "Gibt die 'Anzahl' der Datenpunkte ausgehend vom Ende an, die NICHT für die Erstellung des Modells verwendet werden." + +#: appserver/static/predictive_analytics.js:426 +msgid "Lower confidence interval" +msgstr "Unterer Vertrauensbereich" + +#: appserver/static/predictive_analytics.js:427 appserver/static/predictive_analytics.js:431 +msgid "Must be between 0-100; defaults to 95" +msgstr "Muss zwischen 0 und 100 liegen. Der Standardwert ist 95." + +#: appserver/static/predictive_analytics.js:428 +msgid "Specifies a field name for the lower 'int' percentage confidence interval" +msgstr "Gibt einen Feldnamen für den unteren ganzzahligen Vertrauensbereich in Prozent an." + +#: appserver/static/predictive_analytics.js:430 +msgid "Upper confidence interval" +msgstr "Oberer Vertrauensbereich" + +#: appserver/static/predictive_analytics.js:432 +msgid "Specifies a field name for the upper 'int' percentage confidence interval" +msgstr "Gibt einen Feldnamen für den oberen ganzzahligen Vertrauensbereich in Prozent an." + +#: appserver/static/predictive_analytics.js:434 +msgid "Period" +msgstr "Zeitraum" + +#: appserver/static/predictive_analytics.js:435 +msgid "Specifies the seasonal period of the time series data" +msgstr "Gibt den Jahreszeitraum der Zeitreihendaten an." + +#: appserver/static/predictive_analytics.js:437 +msgid "Predict command help" +msgstr "Hilfe zum Vorhersagebefehl" + +#: appserver/static/predictive_analytics.js:439 +msgid "Apply" +msgstr "Anwenden" + +#: appserver/static/predictive_analytics.js:466 +msgid "Local level" +msgstr "Lokale Ebene" + +#: appserver/static/predictive_analytics.js:470 +msgid "Seasonal local level" +msgstr "Jahreszeitlich bedingte, lokale Ebene" + +#: appserver/static/predictive_analytics.js:478 +msgid "Local level trend" +msgstr "Trend auf lokaler Ebene" + +#: appserver/static/predictive_analytics.js:572 +msgid "Must be a valid timespan" +msgstr "Muss eine gültige Zeitspanne sein" + +#: appserver/static/predictive_analytics.js:582 appserver/static/predictive_analytics.js:592 +msgid "Must be between 0 and 100" +msgstr "Muss zwischen 0 und 100 liegen" + +#: appserver/static/predictive_analytics.js:602 +msgid "Must be a positive integer" +msgstr "Muss eine positive Ganzzahl sein" + +#: appserver/static/predictive_analytics.js:612 +msgid "Must be zero or more" +msgstr "Muss größer-gleich Null sein" + +#: appserver/static/predictive_analytics.js:622 +msgid "Must not be empty" +msgstr "Darf nicht leer sein" + +#: appserver/static/js/commonControl/AddonMenuControl.js:54 appserver/static/js/commonControl/AddonMenuControl.js:64 +msgid "N/A" +msgstr "-" + +#: appserver/static/js/views/DataModelConfig.js:42 +msgid "Enable acceleration" +msgstr "Beschleunigung aktivieren" + +#: appserver/static/js/views/DataModelConfig.js:53 +msgid "Backfill time" +msgstr "Auffüllzeitpunkt" + +#: appserver/static/js/views/DataModelConfig.js:59 appserver/static/js/views/DataModelConfig.js:92 +msgid "Year" +msgstr "Jahr" + +#: appserver/static/js/views/DataModelConfig.js:63 appserver/static/js/views/DataModelConfig.js:96 +msgid "Quarter" +msgstr "Quartal" + +#: appserver/static/js/views/DataModelConfig.js:67 appserver/static/js/views/DataModelConfig.js:100 +msgid "Month" +msgstr "Monat" + +#: appserver/static/js/views/DataModelConfig.js:71 appserver/static/js/views/DataModelConfig.js:104 +msgid "Week" +msgstr "Woche" + +#: appserver/static/js/views/DataModelConfig.js:75 appserver/static/js/views/DataModelConfig.js:108 +msgid "Day" +msgstr "Tag" + +#: appserver/static/js/views/DataModelConfig.js:86 +msgid "Earliest time" +msgstr "Anfangszeitpunkt" + +#: appserver/static/js/views/DataModelConfig.js:119 +msgid "Maximum time" +msgstr "Maximaler Zeitpunkt" + +#: appserver/static/js/views/DataModelConfig.js:130 +msgid "Maximum concurrent searches" +msgstr "Maximale Anzahl gleichzeitiger Suchen" + +#: appserver/static/js/views/DataModelConfig.js:141 +msgid "Manual rebuilds" +msgstr "Manuelle Neuerstellungen" + +#: appserver/static/js/views/DataModelConfig.js:155 +msgid "Schedule priority" +msgstr "Planungspriorität" + +#: appserver/static/js/views/DataModelConfig.js:164 +msgid "default" +msgstr "Standard" + +#: appserver/static/js/views/DataModelConfig.js:168 +msgid "higher" +msgstr "Hoch" + +#: appserver/static/js/views/DataModelConfig.js:172 +msgid "highest" +msgstr "Am höchsten" + +#: appserver/static/cim_setup.js:68 +msgid "enabled should be boolean" +msgstr "\"Aktiviert\" sollte ein boolescher Wert sein" + +#: appserver/static/cim_setup.js:71 +msgid "Invalid earliest time" +msgstr "Ungültiger Anfangszeitpunkt" + +#: appserver/static/cim_setup.js:74 +msgid "Invalid backfill time" +msgstr "Ungültiger Auffüllzeitpunkt" + +#: appserver/static/cim_setup.js:77 +msgid "Backfill time should be more recent than earliest time" +msgstr "Auffüllzeitpunkt sollte vor dem Anfangszeitpunkt liegen" + +#: appserver/static/cim_setup.js:80 +msgid "Maximum time should be an integer" +msgstr "Maximaler Zeitpunkt sollte eine Ganzzahl sein" + +#: appserver/static/cim_setup.js:84 +msgid "Maximum concurrent should be an integer" +msgstr "Maximale gleichzeitige Anzahl sollte eine Ganzzahl sein" + +#: appserver/static/cim_setup.js:87 +msgid "Manual rebuilds should be boolean" +msgstr "\"Manuelle Neuerstellungen\" ein boolescher Wert sein" + +#: appserver/static/cim_setup.js:177 +msgid "Saving" +msgstr "Es wird gespeichert" + +#: appserver/static/cim_setup.js:242 appserver/static/js/views/CIMSetupView.js:96 +msgid "Save" +msgstr "Speichern" + +#: appserver/static/js/views/CIMSetupView.js:60 +msgid "Data Models" +msgstr "Datenmodelle" + +#: appserver/static/js/views/CIMSetupView.js:65 appserver/static/js/views/CIMSetupView.js:71 +msgid "Indexes" +msgstr "Indizes" + +#: appserver/static/js/views/CIMSetupView.js:66 appserver/static/js/views/CIMSetupView.js:77 +msgid "Settings" +msgstr "Einstellungen" + +#: appserver/static/js/views/CIMSetupView.js:79 +msgid "Acceleration properties for the selected data model." +msgstr "Beschleunigungseigenschaften für das ausgewählte Datenmodell." + +#: appserver/static/js/views/CIMSetupView.js:80 +msgid "Splunk help" +msgstr "Splunk-Hilfe" + +#: appserver/static/js/views/CIMSetupView.js:81 +msgid "Learn More" +msgstr "Erfahren Sie mehr" + +#: appserver/static/js/views/CIMSetupView.js:93 +msgid "Cancel" +msgstr "Abbrechen" + +#: appserver/static/js/views/CIMSetupView.js:197 +msgid "Filter" +msgstr "Filter" + +#: appserver/static/js/views/CIMSetupView.js:380 +msgid "Apps" +msgstr "Apps" diff --git a/deps/apps/Splunk_SA_CIM/locale/fr_FR/LC_MESSAGES/messages.mo b/deps/apps/Splunk_SA_CIM/locale/fr_FR/LC_MESSAGES/messages.mo new file mode 100644 index 000000000..3616cf58f Binary files /dev/null and b/deps/apps/Splunk_SA_CIM/locale/fr_FR/LC_MESSAGES/messages.mo differ diff --git a/deps/apps/Splunk_SA_CIM/locale/fr_FR/LC_MESSAGES/messages.po b/deps/apps/Splunk_SA_CIM/locale/fr_FR/LC_MESSAGES/messages.po new file mode 100644 index 000000000..fe0220b05 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/locale/fr_FR/LC_MESSAGES/messages.po @@ -0,0 +1,526 @@ +# Copyright (C) 2009-2018 Splunk Inc. All Rights Reserved. +# +# Translatable strings for Common Information Model +# +# +msgid "" +msgstr "" +"Project-Id-Version: CIM Translation\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2016-08-27 16:20-0800\n" +"PO-Revision-Date: 2017-06-21 11:55+0100\n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: \n" +"Language-Team: \n" +"Language: fr_FR\n" +"X-Generator: Poedit 2.0.1\n" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:250 +msgid "Application State" +msgstr "État de l’application" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:253 +msgid "Authentication" +msgstr "Authentification" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:256 +msgid "Certificates" +msgstr "Certificats" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:259 +msgid "Change Analysis" +msgstr "Analyse des modifications" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:262 +msgid "Compute Inventory" +msgstr "Calculer l’inventaire" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:265 +msgid "DLP" +msgstr "DLP" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:268 +msgid "Databases" +msgstr "Bases de données" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:274 +msgid "Interprocess Messaging" +msgstr "Messagerie interprocessus" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:277 +msgid "Intrusion Detection" +msgstr "Détection des intrusions" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:280 +msgid "JVM" +msgstr "JVM" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:283 +msgid "Malware" +msgstr "Malware" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:286 +msgid "Network Resolution" +msgstr "Résolution réseau" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:289 +msgid "Network Sessions" +msgstr "Sessions réseau" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:298 +msgid "Ticket Management" +msgstr "Gestion des tickets" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:301 +msgid "Updates" +msgstr "Mises à jour" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:304 +msgid "Vulnerabilities" +msgstr "Vulnérabilités" + +#: appserver/static/js/views/CIMSetupView.js:41 appserver/static/cim_setup.js:239 +msgid "Saved" +msgstr "Enregistrée" + +#: appserver/static/js/views/CIMSetupView.js:44 +msgid "Save failed" +msgstr "Échec de l’enregistrement" + +#: appserver/static/js/views/CIMSetupView.js:53 +msgid "Splunk Common Information Model Add-on Set Up" +msgstr "Configuration de l’extension Modèle d’informations commun Splunk" + +#: appserver/static/js/views/CIMSetupView.js:55 +msgid "By default a datamodel will search across all indexes. Use the configuration panel below to constrain data model searches to specific indexes." +msgstr "" +"Par défaut, un modèle de données applique ses recherches à tous les index. Utilisez le panneau de configuration ci-dessous pour contraindre les recherches de modèles de données à des index spécifiques." + +#: appserver/static/js/views/CIMSetupView.js:266 +#, python-format +msgid "Restricted to: %s" +msgstr "Limité à : %s" + +#: appserver/static/js/views/CIMSetupView.js:270 +msgid "No restriction" +msgstr "Aucune restriction" + +#: appserver/static/js/views/CIMSetupView.js:276 +msgid "show all" +msgstr "voir tout" + +#: appserver/static/js/views/DataModelConfig.js:260 +msgid "No datamodel found" +msgstr "Aucun modèle de données trouvé" + +#: appserver/static/js/views/IndexList.js:147 +#, python-format +msgid "%s MB" +msgstr "%s Mo" + +#: appserver/static/js/views/IndexList.js:201 +msgid "Name" +msgstr "Nom" + +#: default/data/ui/views/datamodel_audit.xml:2 +msgid "Data Model Audit" +msgstr "Audit des modèles de données" + +#: default/data/ui/views/datamodel_audit.xml:8 +msgid "Top Accelerations By Size" +msgstr "Top des accélérations par taille" + +#: default/data/ui/views/datamodel_audit.xml:21 +msgid "Top Accelerations By Run Duration" +msgstr "Top des accélérations par durée d’exécution" + +#: default/data/ui/views/datamodel_audit.xml:36 +msgid "Acceleration Details" +msgstr "Détail des accélérations" + +#: default/data/ui/views/predictive_analytics.xml:2 +msgid "Predictive Analytics" +msgstr "Analyse prédictive" + +#: default/data/ui/views/predictive_analytics.xml:17 +msgid "Function" +msgstr "Fonction" + +#: default/data/ui/views/predictive_analytics.xml:30 +msgid "Attribute" +msgstr "Attribut" + +#: default/data/ui/views/predictive_analytics.xml:47 +msgid "Prediction Over Time" +msgstr "Historique des prédictions" + +#: default/data/ui/views/predictive_analytics.xml:60 +msgid "Outliers" +msgstr "Valeurs extrêmes" + +#: default/data/ui/views/cim_setup.xml:2 +msgid "CIM Setup" +msgstr "Configuration MIC" + +#: appserver/static/predictive_analytics.js:28 +msgid "Save as Correlation Search ..." +msgstr "Enregistrer comme recherche de corrélation..." + +#: appserver/static/predictive_analytics.js:59 +msgid "All functions other than count require an attribute!" +msgstr "En dehors de « count », toutes les fonctions nécessitent un attribut !" + +#: appserver/static/predictive_analytics.js:63 +msgid "Please select a function!" +msgstr "Veuillez sélectionner une fonction." + +#: appserver/static/predictive_analytics.js:142 +#, python-format +msgid "The correlation search was successfully created.


View created search

" +msgstr "La recherche de corrélation a bien été créée.


Afficher la recherche créée

" + +#: appserver/static/predictive_analytics.js:237 +msgid "Correlation search could not be saved" +msgstr "La recherche de corrélation n’a pas pu être sauvegardée." + +#: appserver/static/predictive_analytics.js:352 +msgid "Save as Correlation Search" +msgstr "Enregistrer comme recherche de corrélation" + +#: appserver/static/predictive_analytics.js:354 +msgid "Security Domain" +msgstr "Domaine de sécurité" + +#: appserver/static/predictive_analytics.js:357 +msgid "Severity" +msgstr "Gravité" + +#: appserver/static/predictive_analytics.js:360 +msgid "Correlation Search Name" +msgstr "Nom de la recherche de corrélation" + +#: appserver/static/predictive_analytics.js:361 +msgid "Enter the name of the correlation search" +msgstr "Saisissez le nom de la recherche de corrélation" + +#: appserver/static/predictive_analytics.js:363 +msgid "Correlation Search Description" +msgstr "Description de la recherche de corrélation" + +#: appserver/static/predictive_analytics.js:364 +msgid "Enter a description of the correlation search" +msgstr "Saisissez la description de la recherche de corrélation" + +#: appserver/static/predictive_analytics.js:366 +msgid "The correlation search was successfully created" +msgstr "La recherche de corrélation a bien été créée." + +#: appserver/static/predictive_analytics.js:375 +msgid "Run Search First" +msgstr "Exécuter d’abord la recherche" + +#: appserver/static/predictive_analytics.js:376 +msgid "You need to run the search first before attempting to make a correlation search." +msgstr "Vous devez d’abord exécuter la recherche avant de tenter d’effectuer une recherche de corrélation." + +#: appserver/static/predictive_analytics.js:407 +msgid "Advanced Predict Options" +msgstr "Options de prédiction avancées" + +#: appserver/static/predictive_analytics.js:409 +msgid "Predict Timespan" +msgstr "Intervalle de prédiction" + +#: appserver/static/predictive_analytics.js:410 +msgid "defaults to 10m" +msgstr "10 m par défaut" + +#: appserver/static/predictive_analytics.js:411 +msgid "Use time specifiers: y, mon, d, h, m, s" +msgstr "Utiliser des indicateurs de temps : y, mon, d, h, m, s" + +#: appserver/static/predictive_analytics.js:413 +msgid "Algorithm" +msgstr "Algorithme" + +#: appserver/static/predictive_analytics.js:416 +msgid "Correlate" +msgstr "Corréler" + +#: appserver/static/predictive_analytics.js:417 +msgid "For bivariate model, indicates the field to correlate against" +msgstr "Dans un modèle bivarié, indiquer le champ avec lequel établit une corrélation" + +#: appserver/static/predictive_analytics.js:419 +msgid "Future Timespan" +msgstr "Intervalle futur" + +#: appserver/static/predictive_analytics.js:420 +msgid "Must be a non-negative number" +msgstr "Doit être un chiffre non négatif" + +#: appserver/static/predictive_analytics.js:421 +msgid "The length of prediction into the future" +msgstr "Longueur de la prédiction dans l’avenir" + +#: appserver/static/predictive_analytics.js:423 +msgid "Holdback" +msgstr "Retenue" + +#: appserver/static/predictive_analytics.js:424 +msgid "Specifies the 'number' of data points from the end that are NOT used to build the model" +msgstr "Spécifie le « nombre » de points de données depuis la fin qui ne sont PAS utilisés pour élaborer le modèle" + +#: appserver/static/predictive_analytics.js:426 +msgid "Lower confidence interval" +msgstr "Intervalle de confiance bas" + +#: appserver/static/predictive_analytics.js:427 appserver/static/predictive_analytics.js:431 +msgid "Must be between 0-100; defaults to 95" +msgstr "Doit être compris entre 0 et 100 ; 95 par défaut" + +#: appserver/static/predictive_analytics.js:428 +msgid "Specifies a field name for the lower 'int' percentage confidence interval" +msgstr "Spécifie un nom de champ pour l’intervalle de confiance inférieur en pourcentage entier." + +#: appserver/static/predictive_analytics.js:430 +msgid "Upper confidence interval" +msgstr "Intervalle de confiance haut" + +#: appserver/static/predictive_analytics.js:432 +msgid "Specifies a field name for the upper 'int' percentage confidence interval" +msgstr "Spécifie un nom de champ pour l’intervalle de confiance supérieur en pourcentage entier." + +#: appserver/static/predictive_analytics.js:434 +msgid "Period" +msgstr "Période" + +#: appserver/static/predictive_analytics.js:435 +msgid "Specifies the seasonal period of the time series data" +msgstr "Spécifie la période saisonnière des données chronologiques" + +#: appserver/static/predictive_analytics.js:437 +msgid "Predict command help" +msgstr "Aide de la commande predict" + +#: appserver/static/predictive_analytics.js:439 +msgid "Apply" +msgstr "Appliquer" + +#: appserver/static/predictive_analytics.js:466 +msgid "Local level" +msgstr "Niveau local" + +#: appserver/static/predictive_analytics.js:470 +msgid "Seasonal local level" +msgstr "Niveau local saisonnier" + +#: appserver/static/predictive_analytics.js:478 +msgid "Local level trend" +msgstr "Tendance du niveau local" + +#: appserver/static/predictive_analytics.js:572 +msgid "Must be a valid timespan" +msgstr "Doit être un intervalle de temps valide" + +#: appserver/static/predictive_analytics.js:582 appserver/static/predictive_analytics.js:592 +msgid "Must be between 0 and 100" +msgstr "Doit être compris entre 0 et 100" + +#: appserver/static/predictive_analytics.js:602 +msgid "Must be a positive integer" +msgstr "Doit être un nombre entier positif" + +#: appserver/static/predictive_analytics.js:612 +msgid "Must be zero or more" +msgstr "Doit être supérieur ou égal à 0" + +#: appserver/static/predictive_analytics.js:622 +msgid "Must not be empty" +msgstr "Ne doit pas être vide" + +#: appserver/static/js/commonControl/AddonMenuControl.js:54 appserver/static/js/commonControl/AddonMenuControl.js:64 +msgid "N/A" +msgstr "S/O" + +#: appserver/static/js/views/DataModelConfig.js:42 +msgid "Enable acceleration" +msgstr "Activer l'accélération" + +#: appserver/static/js/views/DataModelConfig.js:53 +msgid "Backfill time" +msgstr "Temps de remplissage" + +#: appserver/static/js/views/DataModelConfig.js:59 appserver/static/js/views/DataModelConfig.js:92 +msgid "Year" +msgstr "Année" + +#: appserver/static/js/views/DataModelConfig.js:63 appserver/static/js/views/DataModelConfig.js:96 +msgid "Quarter" +msgstr "Trimestre" + +#: appserver/static/js/views/DataModelConfig.js:67 appserver/static/js/views/DataModelConfig.js:100 +msgid "Month" +msgstr "Mois" + +#: appserver/static/js/views/DataModelConfig.js:71 appserver/static/js/views/DataModelConfig.js:104 +msgid "Week" +msgstr "Semaine" + +#: appserver/static/js/views/DataModelConfig.js:75 appserver/static/js/views/DataModelConfig.js:108 +msgid "Day" +msgstr "Jour" + +#: appserver/static/js/views/DataModelConfig.js:86 +msgid "Earliest time" +msgstr "Début de la période" + +#: appserver/static/js/views/DataModelConfig.js:119 +msgid "Maximum time" +msgstr "Durée maximale" + +#: appserver/static/js/views/DataModelConfig.js:130 +msgid "Maximum concurrent searches" +msgstr "Nombre maximum de recherches simultanées" + +#: appserver/static/js/views/DataModelConfig.js:141 +msgid "Manual rebuilds" +msgstr "Reconstructions manuelles" + +#: appserver/static/js/views/DataModelConfig.js:155 +msgid "Schedule priority" +msgstr "Priorité de programmation" + +#: appserver/static/js/views/DataModelConfig.js:164 +msgid "default" +msgstr "défaut" + +#: appserver/static/js/views/DataModelConfig.js:168 +msgid "higher" +msgstr "plus élevée" + +#: appserver/static/js/views/DataModelConfig.js:172 +msgid "highest" +msgstr "la plus élevée" + +#: appserver/static/cim_setup.js:68 +msgid "enabled should be boolean" +msgstr "la valeur activée doit être booléenne" + +#: appserver/static/cim_setup.js:71 +msgid "Invalid earliest time" +msgstr "Début de la période non valide" + +#: appserver/static/cim_setup.js:74 +msgid "Invalid backfill time" +msgstr "Heure de remplissage non valide" + +#: appserver/static/cim_setup.js:77 +msgid "Backfill time should be more recent than earliest time" +msgstr "L'heure de remplissage doit être plus récente que le début de la période" + +#: appserver/static/cim_setup.js:80 +msgid "Maximum time should be an integer" +msgstr "La durée maximale doit être un entier" + +#: appserver/static/cim_setup.js:84 +msgid "Maximum concurrent should be an integer" +msgstr "Le nombre simultané doit être un entier" + +#: appserver/static/cim_setup.js:87 +msgid "Manual rebuilds should be boolean" +msgstr "La valeur de « reconstructions manuelles » doit être booléenne" + +#: appserver/static/cim_setup.js:177 +msgid "Saving" +msgstr "Enregistrement" + +#: appserver/static/cim_setup.js:242 appserver/static/js/views/CIMSetupView.js:96 +msgid "Save" +msgstr "Enregistrer" + +#: appserver/static/js/views/CIMSetupView.js:60 +msgid "Data Models" +msgstr "Modèles de données" + +#: appserver/static/js/views/CIMSetupView.js:65 appserver/static/js/views/CIMSetupView.js:71 +msgid "Indexes" +msgstr "Index" + +#: appserver/static/js/views/CIMSetupView.js:66 appserver/static/js/views/CIMSetupView.js:77 +msgid "Settings" +msgstr "Paramètres" + +#: appserver/static/js/views/CIMSetupView.js:79 +msgid "Acceleration properties for the selected data model." +msgstr "Propriétés de l'accélération pour le modèle de données sélectionné." + +#: appserver/static/js/views/CIMSetupView.js:80 +msgid "Splunk help" +msgstr "Aide Splunk" + +#: appserver/static/js/views/CIMSetupView.js:81 +msgid "Learn More" +msgstr "En savoir plus" + +#: appserver/static/js/views/CIMSetupView.js:93 +msgid "Cancel" +msgstr "Annuler" + +#: appserver/static/js/views/CIMSetupView.js:197 +msgid "Filter" +msgstr "Filtre" + +#: appserver/static/js/views/CIMSetupView.js:380 +msgid "Apps" +msgstr "Apps" diff --git a/deps/apps/Splunk_SA_CIM/locale/ja_JP/LC_MESSAGES/messages.mo b/deps/apps/Splunk_SA_CIM/locale/ja_JP/LC_MESSAGES/messages.mo new file mode 100644 index 000000000..80d69b76d Binary files /dev/null and b/deps/apps/Splunk_SA_CIM/locale/ja_JP/LC_MESSAGES/messages.mo differ diff --git a/deps/apps/Splunk_SA_CIM/locale/ja_JP/LC_MESSAGES/messages.po b/deps/apps/Splunk_SA_CIM/locale/ja_JP/LC_MESSAGES/messages.po new file mode 100644 index 000000000..48c14d63d --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/locale/ja_JP/LC_MESSAGES/messages.po @@ -0,0 +1,526 @@ +# Copyright (C) 2009-2018 Splunk Inc. All Rights Reserved. +# +# Translatable strings for Common Information Model +# +# +msgid "" +msgstr "" +"Project-Id-Version: CIM Translation\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2016-08-27 16:20-0800\n" +"PO-Revision-Date: 2017-06-20 12:28+0100\n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: \n" +"Language-Team: \n" +"Language: ja_JP\n" +"X-Generator: Poedit 2.0.1\n" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:250 +msgid "Application State" +msgstr "アプリケーションの状態" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:253 +msgid "Authentication" +msgstr "認証" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:256 +msgid "Certificates" +msgstr "証明書" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:259 +msgid "Change Analysis" +msgstr "変更分析" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:262 +msgid "Compute Inventory" +msgstr "在庫計算" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:265 +msgid "DLP" +msgstr "DLP" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:268 +msgid "Databases" +msgstr "データベース" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:274 +msgid "Interprocess Messaging" +msgstr "プロセス間メッセージ" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:277 +msgid "Intrusion Detection" +msgstr "侵入検出" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:280 +msgid "JVM" +msgstr "JVM" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:283 +msgid "Malware" +msgstr "マルウェア" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:286 +msgid "Network Resolution" +msgstr "ネットワーク解像度" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:289 +msgid "Network Sessions" +msgstr "ネットワークセッション" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:298 +msgid "Ticket Management" +msgstr "チケット管理" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:301 +msgid "Updates" +msgstr "更新" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:304 +msgid "Vulnerabilities" +msgstr "脆弱性" + +#: appserver/static/js/views/CIMSetupView.js:41 appserver/static/cim_setup.js:239 +msgid "Saved" +msgstr "保存済み" + +#: appserver/static/js/views/CIMSetupView.js:44 +msgid "Save failed" +msgstr "保存に失敗しました" + +#: appserver/static/js/views/CIMSetupView.js:53 +msgid "Splunk Common Information Model Add-on Set Up" +msgstr "Splunk 共通情報モデルアドオンセットアップ" + +#: appserver/static/js/views/CIMSetupView.js:55 +msgid "" +"By default a datamodel will search across all indexes. Use the configuration panel below to constrain data model searches to specific indexes." +msgstr "デフォルトで、データモデルは全インデックスを検索します。データモデル検索を特定のインデックスに制限するには以下の設定パネルを使用します。" + +#: appserver/static/js/views/CIMSetupView.js:266 +#, python-format +msgid "Restricted to: %s" +msgstr "制限先：%s" + +#: appserver/static/js/views/CIMSetupView.js:270 +msgid "No restriction" +msgstr "無制限" + +#: appserver/static/js/views/CIMSetupView.js:276 +msgid "show all" +msgstr "すべて表示" + +#: appserver/static/js/views/DataModelConfig.js:260 +msgid "No datamodel found" +msgstr "データモデルが見つかりません" + +#: appserver/static/js/views/IndexList.js:147 +#, python-format +msgid "%s MB" +msgstr "%s MB" + +#: appserver/static/js/views/IndexList.js:201 +msgid "Name" +msgstr "名前" + +#: default/data/ui/views/datamodel_audit.xml:2 +msgid "Data Model Audit" +msgstr "データモデルの監査" + +#: default/data/ui/views/datamodel_audit.xml:8 +msgid "Top Accelerations By Size" +msgstr "サイズによる上位加速" + +#: default/data/ui/views/datamodel_audit.xml:21 +msgid "Top Accelerations By Run Duration" +msgstr "分析継続時間による上位加速" + +#: default/data/ui/views/datamodel_audit.xml:36 +msgid "Acceleration Details" +msgstr "加速詳細" + +#: default/data/ui/views/predictive_analytics.xml:2 +msgid "Predictive Analytics" +msgstr "予測分析" + +#: default/data/ui/views/predictive_analytics.xml:17 +msgid "Function" +msgstr "関数" + +#: default/data/ui/views/predictive_analytics.xml:30 +msgid "Attribute" +msgstr "属性" + +#: default/data/ui/views/predictive_analytics.xml:47 +msgid "Prediction Over Time" +msgstr "予測の推移" + +#: default/data/ui/views/predictive_analytics.xml:60 +msgid "Outliers" +msgstr "外れ値" + +#: default/data/ui/views/cim_setup.xml:2 +msgid "CIM Setup" +msgstr "CIM セットアップ" + +#: appserver/static/predictive_analytics.js:28 +msgid "Save as Correlation Search ..." +msgstr "相関サーチとして保存 ..." + +#: appserver/static/predictive_analytics.js:59 +msgid "All functions other than count require an attribute!" +msgstr "計算以外の全機能に属性が必要です！" + +#: appserver/static/predictive_analytics.js:63 +msgid "Please select a function!" +msgstr "機能を選択してください。" + +#: appserver/static/predictive_analytics.js:142 +#, python-format +msgid "The correlation search was successfully created.


View created search

" +msgstr "相関サーチは正常に作成されました。


作成されたサーチを表示します

" + +#: appserver/static/predictive_analytics.js:237 +msgid "Correlation search could not be saved" +msgstr "相関サーチを保存できませんでした。" + +#: appserver/static/predictive_analytics.js:352 +msgid "Save as Correlation Search" +msgstr "相関サーチとして保存" + +#: appserver/static/predictive_analytics.js:354 +msgid "Security Domain" +msgstr "セキュリティドメイン" + +#: appserver/static/predictive_analytics.js:357 +msgid "Severity" +msgstr "重大度" + +#: appserver/static/predictive_analytics.js:360 +msgid "Correlation Search Name" +msgstr "相関サーチ名" + +#: appserver/static/predictive_analytics.js:361 +msgid "Enter the name of the correlation search" +msgstr "相関サーチ名を入力" + +#: appserver/static/predictive_analytics.js:363 +msgid "Correlation Search Description" +msgstr "相関サーチの説明" + +#: appserver/static/predictive_analytics.js:364 +msgid "Enter a description of the correlation search" +msgstr "相関サーチの説明を入力" + +#: appserver/static/predictive_analytics.js:366 +msgid "The correlation search was successfully created" +msgstr "相関サーチは正常に作成されました" + +#: appserver/static/predictive_analytics.js:375 +msgid "Run Search First" +msgstr "始めにサーチを実行" + +#: appserver/static/predictive_analytics.js:376 +msgid "You need to run the search first before attempting to make a correlation search." +msgstr "検索サーチを試行する前にまずサーチを実行する必要があります。" + +#: appserver/static/predictive_analytics.js:407 +msgid "Advanced Predict Options" +msgstr "高度な予測オプション" + +#: appserver/static/predictive_analytics.js:409 +msgid "Predict Timespan" +msgstr "予測タイムスパン" + +#: appserver/static/predictive_analytics.js:410 +msgid "defaults to 10m" +msgstr "デフォルトで 10m に設定" + +#: appserver/static/predictive_analytics.js:411 +msgid "Use time specifiers: y, mon, d, h, m, s" +msgstr "時刻指定子を使用：y、mon、d、h、m、s" + +#: appserver/static/predictive_analytics.js:413 +msgid "Algorithm" +msgstr "アルゴリズム" + +#: appserver/static/predictive_analytics.js:416 +msgid "Correlate" +msgstr "関連" + +#: appserver/static/predictive_analytics.js:417 +msgid "For bivariate model, indicates the field to correlate against" +msgstr "二変量モデルでは、関連先のフィールドを示します" + +#: appserver/static/predictive_analytics.js:419 +msgid "Future Timespan" +msgstr "将来タイムスパン" + +#: appserver/static/predictive_analytics.js:420 +msgid "Must be a non-negative number" +msgstr "負以外の数値でなければなりません" + +#: appserver/static/predictive_analytics.js:421 +msgid "The length of prediction into the future" +msgstr "将来の予測の長さ" + +#: appserver/static/predictive_analytics.js:423 +msgid "Holdback" +msgstr "抑制措置" + +#: appserver/static/predictive_analytics.js:424 +msgid "Specifies the 'number' of data points from the end that are NOT used to build the model" +msgstr "モデルの構築に使用されない、最後からのデータポイントの「数を」指定します。" + +#: appserver/static/predictive_analytics.js:426 +msgid "Lower confidence interval" +msgstr "低信頼区間" + +#: appserver/static/predictive_analytics.js:427 appserver/static/predictive_analytics.js:431 +msgid "Must be between 0-100; defaults to 95" +msgstr "0-100 の間である必要があり、デフォルトは 95" + +#: appserver/static/predictive_analytics.js:428 +msgid "Specifies a field name for the lower 'int' percentage confidence interval" +msgstr "低「正数」パーセント信頼区間のフィールド名を指定します" + +#: appserver/static/predictive_analytics.js:430 +msgid "Upper confidence interval" +msgstr "上信頼区間" + +#: appserver/static/predictive_analytics.js:432 +msgid "Specifies a field name for the upper 'int' percentage confidence interval" +msgstr "上「正数」パーセント信頼区間のフィールド名を指定します" + +#: appserver/static/predictive_analytics.js:434 +msgid "Period" +msgstr "間隔" + +#: appserver/static/predictive_analytics.js:435 +msgid "Specifies the seasonal period of the time series data" +msgstr "時系列データの季節間隔を指定します" + +#: appserver/static/predictive_analytics.js:437 +msgid "Predict command help" +msgstr "予測コマンドヘルプ" + +#: appserver/static/predictive_analytics.js:439 +msgid "Apply" +msgstr "適用" + +#: appserver/static/predictive_analytics.js:466 +msgid "Local level" +msgstr "局所レベル" + +#: appserver/static/predictive_analytics.js:470 +msgid "Seasonal local level" +msgstr "季節局所レベル" + +#: appserver/static/predictive_analytics.js:478 +msgid "Local level trend" +msgstr "局所レベルの傾向" + +#: appserver/static/predictive_analytics.js:572 +msgid "Must be a valid timespan" +msgstr "有効なタイムスパンである必要があります" + +#: appserver/static/predictive_analytics.js:582 appserver/static/predictive_analytics.js:592 +msgid "Must be between 0 and 100" +msgstr "0～100% でなければなりません" + +#: appserver/static/predictive_analytics.js:602 +msgid "Must be a positive integer" +msgstr "正数でなければなりません" + +#: appserver/static/predictive_analytics.js:612 +msgid "Must be zero or more" +msgstr "ゼロ以上でなければなりません" + +#: appserver/static/predictive_analytics.js:622 +msgid "Must not be empty" +msgstr "空きがなければなりません" + +#: appserver/static/js/commonControl/AddonMenuControl.js:54 appserver/static/js/commonControl/AddonMenuControl.js:64 +msgid "N/A" +msgstr "N/A" + +#: appserver/static/js/views/DataModelConfig.js:42 +msgid "Enable acceleration" +msgstr "アクセラレーションを有効にする" + +#: appserver/static/js/views/DataModelConfig.js:53 +msgid "Backfill time" +msgstr "バックフィル時間" + +#: appserver/static/js/views/DataModelConfig.js:59 appserver/static/js/views/DataModelConfig.js:92 +msgid "Year" +msgstr "年" + +#: appserver/static/js/views/DataModelConfig.js:63 appserver/static/js/views/DataModelConfig.js:96 +msgid "Quarter" +msgstr "四半期" + +#: appserver/static/js/views/DataModelConfig.js:67 appserver/static/js/views/DataModelConfig.js:100 +msgid "Month" +msgstr "月" + +#: appserver/static/js/views/DataModelConfig.js:71 appserver/static/js/views/DataModelConfig.js:104 +msgid "Week" +msgstr "週" + +#: appserver/static/js/views/DataModelConfig.js:75 appserver/static/js/views/DataModelConfig.js:108 +msgid "Day" +msgstr "日" + +#: appserver/static/js/views/DataModelConfig.js:86 +msgid "Earliest time" +msgstr "もっとも早い時刻" + +#: appserver/static/js/views/DataModelConfig.js:119 +msgid "Maximum time" +msgstr "最大時間" + +#: appserver/static/js/views/DataModelConfig.js:130 +msgid "Maximum concurrent searches" +msgstr "最大同時サーチ数" + +#: appserver/static/js/views/DataModelConfig.js:141 +msgid "Manual rebuilds" +msgstr "マニュアル再構築" + +#: appserver/static/js/views/DataModelConfig.js:155 +msgid "Schedule priority" +msgstr "スケジュール優先度" + +#: appserver/static/js/views/DataModelConfig.js:164 +msgid "default" +msgstr "デフォルト" + +#: appserver/static/js/views/DataModelConfig.js:168 +msgid "higher" +msgstr "高" + +#: appserver/static/js/views/DataModelConfig.js:172 +msgid "highest" +msgstr "最高" + +#: appserver/static/cim_setup.js:68 +msgid "enabled should be boolean" +msgstr "有効はブール型にしてください" + +#: appserver/static/cim_setup.js:71 +msgid "Invalid earliest time" +msgstr "もっとも早い時間が無効です" + +#: appserver/static/cim_setup.js:74 +msgid "Invalid backfill time" +msgstr "バックフィル時間が無効です" + +#: appserver/static/cim_setup.js:77 +msgid "Backfill time should be more recent than earliest time" +msgstr "バックフィル時間は最も早い時間よりも早い時間を設定してください" + +#: appserver/static/cim_setup.js:80 +msgid "Maximum time should be an integer" +msgstr "最大時間は整数を入力してください" + +#: appserver/static/cim_setup.js:84 +msgid "Maximum concurrent should be an integer" +msgstr "最大同時サーチ数は整数を入力してください" + +#: appserver/static/cim_setup.js:87 +msgid "Manual rebuilds should be boolean" +msgstr "マニュアル再構築はブール型にしてください" + +#: appserver/static/cim_setup.js:177 +msgid "Saving" +msgstr "保存しています" + +#: appserver/static/cim_setup.js:242 appserver/static/js/views/CIMSetupView.js:96 +msgid "Save" +msgstr "保存" + +#: appserver/static/js/views/CIMSetupView.js:60 +msgid "Data Models" +msgstr "データモデル" + +#: appserver/static/js/views/CIMSetupView.js:65 appserver/static/js/views/CIMSetupView.js:71 +msgid "Indexes" +msgstr "インデックス" + +#: appserver/static/js/views/CIMSetupView.js:66 appserver/static/js/views/CIMSetupView.js:77 +msgid "Settings" +msgstr "設定" + +#: appserver/static/js/views/CIMSetupView.js:79 +msgid "Acceleration properties for the selected data model." +msgstr "選択したデータモデルのアクセラレーションプロパティ" + +#: appserver/static/js/views/CIMSetupView.js:80 +msgid "Splunk help" +msgstr "Splunk ヘルプ" + +#: appserver/static/js/views/CIMSetupView.js:81 +msgid "Learn More" +msgstr "詳細" + +#: appserver/static/js/views/CIMSetupView.js:93 +msgid "Cancel" +msgstr "キャンセル" + +#: appserver/static/js/views/CIMSetupView.js:197 +msgid "Filter" +msgstr "フィルター" + +#: appserver/static/js/views/CIMSetupView.js:380 +msgid "Apps" +msgstr "App" diff --git a/deps/apps/Splunk_SA_CIM/locale/ko_KR/LC_MESSAGES/messages.mo b/deps/apps/Splunk_SA_CIM/locale/ko_KR/LC_MESSAGES/messages.mo new file mode 100644 index 000000000..ebd615b61 Binary files /dev/null and b/deps/apps/Splunk_SA_CIM/locale/ko_KR/LC_MESSAGES/messages.mo differ diff --git a/deps/apps/Splunk_SA_CIM/locale/ko_KR/LC_MESSAGES/messages.po b/deps/apps/Splunk_SA_CIM/locale/ko_KR/LC_MESSAGES/messages.po new file mode 100644 index 000000000..d31e48d8f --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/locale/ko_KR/LC_MESSAGES/messages.po @@ -0,0 +1,526 @@ +# Copyright (C) 2009-2018 Splunk Inc. All Rights Reserved. +# +# Translatable strings for Common Information Model +# +# +msgid "" +msgstr "" +"Project-Id-Version: CIM Translation\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2016-08-27 16:20-0800\n" +"PO-Revision-Date: 2017-06-21 11:55+0100\n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: \n" +"Language-Team: \n" +"Language: ko_KR\n" +"X-Generator: Poedit 2.0.1\n" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:250 +msgid "Application State" +msgstr "애플리케이션 상태" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:253 +msgid "Authentication" +msgstr "인증" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:256 +msgid "Certificates" +msgstr "인증서" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:259 +msgid "Change Analysis" +msgstr "변경 사항 분석" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:262 +msgid "Compute Inventory" +msgstr "인벤토리 계산" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:265 +msgid "DLP" +msgstr "DLP" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:268 +msgid "Databases" +msgstr "데이터베이스" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:274 +msgid "Interprocess Messaging" +msgstr "프로세스 간 메시징" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:277 +msgid "Intrusion Detection" +msgstr "침입 탐지" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:280 +msgid "JVM" +msgstr "JVM" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:283 +msgid "Malware" +msgstr "멀웨어" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:286 +msgid "Network Resolution" +msgstr "네트워크 분석" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:289 +msgid "Network Sessions" +msgstr "네트워크 세션" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:298 +msgid "Ticket Management" +msgstr "티켓 관리" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:301 +msgid "Updates" +msgstr "업데이트" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:304 +msgid "Vulnerabilities" +msgstr "취약점" + +#: appserver/static/js/views/CIMSetupView.js:41 appserver/static/cim_setup.js:239 +msgid "Saved" +msgstr "저장됨" + +#: appserver/static/js/views/CIMSetupView.js:44 +msgid "Save failed" +msgstr "저장 실패" + +#: appserver/static/js/views/CIMSetupView.js:53 +msgid "Splunk Common Information Model Add-on Set Up" +msgstr "Splunk 공통 정보 모델 추가 기능 설정" + +#: appserver/static/js/views/CIMSetupView.js:55 +msgid "" +"By default a datamodel will search across all indexes. Use the configuration panel below to constrain data model searches to specific indexes." +msgstr "기본적으로 데이터 모델은 모든 인덱스에서 검색을 실행합니다. 아래 설정 패널을 사용하여 데이터 모델 검색을 특정 인덱스로 제한하십시오." + +#: appserver/static/js/views/CIMSetupView.js:266 +#, python-format +msgid "Restricted to: %s" +msgstr "제한: %s" + +#: appserver/static/js/views/CIMSetupView.js:270 +msgid "No restriction" +msgstr "제한 없음" + +#: appserver/static/js/views/CIMSetupView.js:276 +msgid "show all" +msgstr "모두 표시" + +#: appserver/static/js/views/DataModelConfig.js:260 +msgid "No datamodel found" +msgstr "데이터 모델을 찾을 수 없음" + +#: appserver/static/js/views/IndexList.js:147 +#, python-format +msgid "%s MB" +msgstr "%sMB" + +#: appserver/static/js/views/IndexList.js:201 +msgid "Name" +msgstr "이름" + +#: default/data/ui/views/datamodel_audit.xml:2 +msgid "Data Model Audit" +msgstr "데이터 모델 감사(audit)" + +#: default/data/ui/views/datamodel_audit.xml:8 +msgid "Top Accelerations By Size" +msgstr "크기별 상위 가속화" + +#: default/data/ui/views/datamodel_audit.xml:21 +msgid "Top Accelerations By Run Duration" +msgstr "실행 기간별 상위 가속화" + +#: default/data/ui/views/datamodel_audit.xml:36 +msgid "Acceleration Details" +msgstr "가속화 세부정보" + +#: default/data/ui/views/predictive_analytics.xml:2 +msgid "Predictive Analytics" +msgstr "예측 분석" + +#: default/data/ui/views/predictive_analytics.xml:17 +msgid "Function" +msgstr "기능" + +#: default/data/ui/views/predictive_analytics.xml:30 +msgid "Attribute" +msgstr "속성" + +#: default/data/ui/views/predictive_analytics.xml:47 +msgid "Prediction Over Time" +msgstr "시간에 따른 예측" + +#: default/data/ui/views/predictive_analytics.xml:60 +msgid "Outliers" +msgstr "이상값" + +#: default/data/ui/views/cim_setup.xml:2 +msgid "CIM Setup" +msgstr "CIM 설정" + +#: appserver/static/predictive_analytics.js:28 +msgid "Save as Correlation Search ..." +msgstr "상관(correlation) 검색으로 저장..." + +#: appserver/static/predictive_analytics.js:59 +msgid "All functions other than count require an attribute!" +msgstr "수가 아닌 모든 기능에 속성이 필요합니다!" + +#: appserver/static/predictive_analytics.js:63 +msgid "Please select a function!" +msgstr "기능을 선택하십시오!" + +#: appserver/static/predictive_analytics.js:142 +#, python-format +msgid "The correlation search was successfully created.


View created search

" +msgstr "상관(correlation) 검색이 작성되었습니다.


작성된 검색 보기

" + +#: appserver/static/predictive_analytics.js:237 +msgid "Correlation search could not be saved" +msgstr "상관(correlation) 검색을 저장할 수 없습니다." + +#: appserver/static/predictive_analytics.js:352 +msgid "Save as Correlation Search" +msgstr "상관(correlation) 검색으로 저장" + +#: appserver/static/predictive_analytics.js:354 +msgid "Security Domain" +msgstr "보안 도메인" + +#: appserver/static/predictive_analytics.js:357 +msgid "Severity" +msgstr "심각도" + +#: appserver/static/predictive_analytics.js:360 +msgid "Correlation Search Name" +msgstr "상관(correlation) 검색 이름" + +#: appserver/static/predictive_analytics.js:361 +msgid "Enter the name of the correlation search" +msgstr "상관(correlation) 검색의 이름을 입력하십시오." + +#: appserver/static/predictive_analytics.js:363 +msgid "Correlation Search Description" +msgstr "상관(correlation) 검색 설명" + +#: appserver/static/predictive_analytics.js:364 +msgid "Enter a description of the correlation search" +msgstr "상관(correlation) 검색의 설명을 입력하십시오." + +#: appserver/static/predictive_analytics.js:366 +msgid "The correlation search was successfully created" +msgstr "상관(correlation) 검색이 작성되었습니다." + +#: appserver/static/predictive_analytics.js:375 +msgid "Run Search First" +msgstr "우선 검색 실행" + +#: appserver/static/predictive_analytics.js:376 +msgid "You need to run the search first before attempting to make a correlation search." +msgstr "상관(correlation) 검색을 실행하기 전에 먼저 검색을 실행해야 합니다." + +#: appserver/static/predictive_analytics.js:407 +msgid "Advanced Predict Options" +msgstr "고급 예측 옵션" + +#: appserver/static/predictive_analytics.js:409 +msgid "Predict Timespan" +msgstr "시간 간격 예측" + +#: appserver/static/predictive_analytics.js:410 +msgid "defaults to 10m" +msgstr "기본값: 10m" + +#: appserver/static/predictive_analytics.js:411 +msgid "Use time specifiers: y, mon, d, h, m, s" +msgstr "시간 지정자 사용: y, mon, d, h, m, s" + +#: appserver/static/predictive_analytics.js:413 +msgid "Algorithm" +msgstr "알고리즘" + +#: appserver/static/predictive_analytics.js:416 +msgid "Correlate" +msgstr "상관(correlation)" + +#: appserver/static/predictive_analytics.js:417 +msgid "For bivariate model, indicates the field to correlate against" +msgstr "이변량 모델의 경우, 상호 상관할 필드를 나타냅니다." + +#: appserver/static/predictive_analytics.js:419 +msgid "Future Timespan" +msgstr "미래 시간 간격" + +#: appserver/static/predictive_analytics.js:420 +msgid "Must be a non-negative number" +msgstr "음수가 아닌 숫자여야 합니다." + +#: appserver/static/predictive_analytics.js:421 +msgid "The length of prediction into the future" +msgstr "미래의 예측 길이" + +#: appserver/static/predictive_analytics.js:423 +msgid "Holdback" +msgstr "Holdback" + +#: appserver/static/predictive_analytics.js:424 +msgid "Specifies the 'number' of data points from the end that are NOT used to build the model" +msgstr "모델을 만드는 데 사용되지 않은 마지막 데이터 포인트의 '수'를 지정합니다." + +#: appserver/static/predictive_analytics.js:426 +msgid "Lower confidence interval" +msgstr "하위 신뢰 구간" + +#: appserver/static/predictive_analytics.js:427 appserver/static/predictive_analytics.js:431 +msgid "Must be between 0-100; defaults to 95" +msgstr "0-100 사이여야 하며 기본값은 95입니다." + +#: appserver/static/predictive_analytics.js:428 +msgid "Specifies a field name for the lower 'int' percentage confidence interval" +msgstr "하위 'int' 백분율 신뢰 구간의 필드 이름을 지정합니다." + +#: appserver/static/predictive_analytics.js:430 +msgid "Upper confidence interval" +msgstr "상위 신뢰 구간" + +#: appserver/static/predictive_analytics.js:432 +msgid "Specifies a field name for the upper 'int' percentage confidence interval" +msgstr "상위 'int' 백분율 신뢰 구간의 필드 이름을 지정합니다." + +#: appserver/static/predictive_analytics.js:434 +msgid "Period" +msgstr "기간" + +#: appserver/static/predictive_analytics.js:435 +msgid "Specifies the seasonal period of the time series data" +msgstr "시계열 데이터의 계절적 기간을 지정합니다." + +#: appserver/static/predictive_analytics.js:437 +msgid "Predict command help" +msgstr "Predict 명령 도움말" + +#: appserver/static/predictive_analytics.js:439 +msgid "Apply" +msgstr "적용" + +#: appserver/static/predictive_analytics.js:466 +msgid "Local level" +msgstr "로컬 레벨" + +#: appserver/static/predictive_analytics.js:470 +msgid "Seasonal local level" +msgstr "계절적 로컬 레벨" + +#: appserver/static/predictive_analytics.js:478 +msgid "Local level trend" +msgstr "로컬 레벨 추세" + +#: appserver/static/predictive_analytics.js:572 +msgid "Must be a valid timespan" +msgstr "유효한 시간 범위여야 합니다." + +#: appserver/static/predictive_analytics.js:582 appserver/static/predictive_analytics.js:592 +msgid "Must be between 0 and 100" +msgstr "0-100 사이여야 합니다." + +#: appserver/static/predictive_analytics.js:602 +msgid "Must be a positive integer" +msgstr "양의 정수여야 합니다." + +#: appserver/static/predictive_analytics.js:612 +msgid "Must be zero or more" +msgstr "0 이상이어야 합니다." + +#: appserver/static/predictive_analytics.js:622 +msgid "Must not be empty" +msgstr "비워둘 수 없습니다." + +#: appserver/static/js/commonControl/AddonMenuControl.js:54 appserver/static/js/commonControl/AddonMenuControl.js:64 +msgid "N/A" +msgstr "해당 사항 없음" + +#: appserver/static/js/views/DataModelConfig.js:42 +msgid "Enable acceleration" +msgstr "가속화 사용" + +#: appserver/static/js/views/DataModelConfig.js:53 +msgid "Backfill time" +msgstr "다시 채우기 시간" + +#: appserver/static/js/views/DataModelConfig.js:59 appserver/static/js/views/DataModelConfig.js:92 +msgid "Year" +msgstr "년" + +#: appserver/static/js/views/DataModelConfig.js:63 appserver/static/js/views/DataModelConfig.js:96 +msgid "Quarter" +msgstr "분기" + +#: appserver/static/js/views/DataModelConfig.js:67 appserver/static/js/views/DataModelConfig.js:100 +msgid "Month" +msgstr "월" + +#: appserver/static/js/views/DataModelConfig.js:71 appserver/static/js/views/DataModelConfig.js:104 +msgid "Week" +msgstr "주" + +#: appserver/static/js/views/DataModelConfig.js:75 appserver/static/js/views/DataModelConfig.js:108 +msgid "Day" +msgstr "일" + +#: appserver/static/js/views/DataModelConfig.js:86 +msgid "Earliest time" +msgstr "시작 시간" + +#: appserver/static/js/views/DataModelConfig.js:119 +msgid "Maximum time" +msgstr "최대 시간" + +#: appserver/static/js/views/DataModelConfig.js:130 +msgid "Maximum concurrent searches" +msgstr "최대 동시 검색 수" + +#: appserver/static/js/views/DataModelConfig.js:141 +msgid "Manual rebuilds" +msgstr "수동 재작성" + +#: appserver/static/js/views/DataModelConfig.js:155 +msgid "Schedule priority" +msgstr "예약 우선순위" + +#: appserver/static/js/views/DataModelConfig.js:164 +msgid "default" +msgstr "기본값" + +#: appserver/static/js/views/DataModelConfig.js:168 +msgid "higher" +msgstr "더 높음" + +#: appserver/static/js/views/DataModelConfig.js:172 +msgid "highest" +msgstr "가장 높음" + +#: appserver/static/cim_setup.js:68 +msgid "enabled should be boolean" +msgstr "활성화 개수는 부울이어야 합니다." + +#: appserver/static/cim_setup.js:71 +msgid "Invalid earliest time" +msgstr "잘못된 시작 시간" + +#: appserver/static/cim_setup.js:74 +msgid "Invalid backfill time" +msgstr "잘못된 다시 채우기 시간" + +#: appserver/static/cim_setup.js:77 +msgid "Backfill time should be more recent than earliest time" +msgstr "다시 채우기 시간은 시작 시간보다 최근이어야 합니다." + +#: appserver/static/cim_setup.js:80 +msgid "Maximum time should be an integer" +msgstr "최대 시간은 정수여야 합니다." + +#: appserver/static/cim_setup.js:84 +msgid "Maximum concurrent should be an integer" +msgstr "최대 동시 수는 정수여야 합니다." + +#: appserver/static/cim_setup.js:87 +msgid "Manual rebuilds should be boolean" +msgstr "수동 재작성 수는 부울이어야 합니다." + +#: appserver/static/cim_setup.js:177 +msgid "Saving" +msgstr "저장하는 중" + +#: appserver/static/cim_setup.js:242 appserver/static/js/views/CIMSetupView.js:96 +msgid "Save" +msgstr "저장" + +#: appserver/static/js/views/CIMSetupView.js:60 +msgid "Data Models" +msgstr "데이터 모델" + +#: appserver/static/js/views/CIMSetupView.js:65 appserver/static/js/views/CIMSetupView.js:71 +msgid "Indexes" +msgstr "인덱스" + +#: appserver/static/js/views/CIMSetupView.js:66 appserver/static/js/views/CIMSetupView.js:77 +msgid "Settings" +msgstr "설정" + +#: appserver/static/js/views/CIMSetupView.js:79 +msgid "Acceleration properties for the selected data model." +msgstr "선택된 데이터 모델의 가속화 속성" + +#: appserver/static/js/views/CIMSetupView.js:80 +msgid "Splunk help" +msgstr "Splunk 도움말" + +#: appserver/static/js/views/CIMSetupView.js:81 +msgid "Learn More" +msgstr "자세히 알아보기" + +#: appserver/static/js/views/CIMSetupView.js:93 +msgid "Cancel" +msgstr "취소" + +#: appserver/static/js/views/CIMSetupView.js:197 +msgid "Filter" +msgstr "필터" + +#: appserver/static/js/views/CIMSetupView.js:380 +msgid "Apps" +msgstr "앱" diff --git a/deps/apps/Splunk_SA_CIM/locale/messages.pot b/deps/apps/Splunk_SA_CIM/locale/messages.pot new file mode 100644 index 000000000..4f0d75ec0 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/locale/messages.pot @@ -0,0 +1,541 @@ +# Copyright (C) 2009-2018 Splunk Inc. All Rights Reserved. + +# +# Translatable strings for Common Information Model +# + +# +#, fuzzy +msgid "" +msgstr "" +"Project-Id-Version: CIM Translation\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2016-08-27 16:20-0800\n" +"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" +"Last-Translator: FULL NAME \n" +"Language-Team: LANGUAGE \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" + + +#: default/macros.conf:250 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Application State" +msgstr "" + +#: default/macros.conf:253 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Authentication" +msgstr "" + +#: default/macros.conf:256 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Certificates" +msgstr "" + +#: default/macros.conf:259 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Change Analysis" +msgstr "" + +#: default/macros.conf:262 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Compute Inventory" +msgstr "" + +#: default/macros.conf:265 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "DLP" +msgstr "" + +#: default/macros.conf:268 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Databases" +msgstr "" + +#: default/macros.conf:274 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Interprocess Messaging" +msgstr "" + +#: default/macros.conf:277 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Intrusion Detection" +msgstr "" + +#: default/macros.conf:280 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "JVM" +msgstr "" + +#: default/macros.conf:283 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Malware" +msgstr "" + +#: default/macros.conf:286 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Network Resolution" +msgstr "" + +#: default/macros.conf:289 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Network Sessions" +msgstr "" + +#: default/macros.conf:298 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Ticket Management" +msgstr "" + +#: default/macros.conf:301 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Updates" +msgstr "" + +#: default/macros.conf:304 +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +msgid "Vulnerabilities" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:41 +#: appserver/static/cim_setup.js:239 +msgid "Saved" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:44 +msgid "Save failed" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:53 +msgid "Splunk Common Information Model Add-on Set Up" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:55 +msgid "" +"By default a datamodel will search across all indexes. Use the configuration panel below " +"to constrain data model searches to specific indexes." +msgstr "" + +#, python-format +#: appserver/static/js/views/CIMSetupView.js:266 +msgid "Restricted to: %s" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:270 +msgid "No restriction" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:276 +msgid "show all" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:260 +msgid "No datamodel found" +msgstr "" + +#, python-format +#: appserver/static/js/views/IndexList.js:147 +msgid "%s MB" +msgstr "" + +#: appserver/static/js/views/IndexList.js:201 +msgid "Name" +msgstr "" + +#: default/data/ui/views/datamodel_audit.xml:2 +msgid "Data Model Audit" +msgstr "" + +#: default/data/ui/views/datamodel_audit.xml:8 +msgid "Top Accelerations By Size" +msgstr "" + +#: default/data/ui/views/datamodel_audit.xml:21 +msgid "Top Accelerations By Run Duration" +msgstr "" + +#: default/data/ui/views/datamodel_audit.xml:36 +msgid "Acceleration Details" +msgstr "" + +#: default/data/ui/views/predictive_analytics.xml:2 +msgid "Predictive Analytics" +msgstr "" + +#: default/data/ui/views/predictive_analytics.xml:17 +msgid "Function" +msgstr "" + +#: default/data/ui/views/predictive_analytics.xml:30 +msgid "Attribute" +msgstr "" + +#: default/data/ui/views/predictive_analytics.xml:47 +msgid "Prediction Over Time" +msgstr "" + +#: default/data/ui/views/predictive_analytics.xml:60 +msgid "Outliers" +msgstr "" + +#: default/data/ui/views/cim_setup.xml:2 +msgid "CIM Setup" +msgstr "" + +#: appserver/static/predictive_analytics.js:28 +msgid "Save as Correlation Search ..." +msgstr "" + +#: appserver/static/predictive_analytics.js:59 +msgid "All functions other than count require an attribute!" +msgstr "" + +#: appserver/static/predictive_analytics.js:63 +msgid "Please select a function!" +msgstr "" + +#, python-format +#: appserver/static/predictive_analytics.js:142 +msgid "The correlation search was successfully created.


View created search

" +msgstr "" + +#: appserver/static/predictive_analytics.js:237 +msgid "Correlation search could not be saved" +msgstr "" + +#: appserver/static/predictive_analytics.js:352 +msgid "Save as Correlation Search" +msgstr "" + +#: appserver/static/predictive_analytics.js:354 +msgid "Security Domain" +msgstr "" + +#: appserver/static/predictive_analytics.js:357 +msgid "Severity" +msgstr "" + +#: appserver/static/predictive_analytics.js:360 +msgid "Correlation Search Name" +msgstr "" + +#: appserver/static/predictive_analytics.js:361 +msgid "Enter the name of the correlation search" +msgstr "" + +#: appserver/static/predictive_analytics.js:363 +msgid "Correlation Search Description" +msgstr "" + +#: appserver/static/predictive_analytics.js:364 +msgid "Enter a description of the correlation search" +msgstr "" + +#: appserver/static/predictive_analytics.js:366 +msgid "The correlation search was successfully created" +msgstr "" + +#: appserver/static/predictive_analytics.js:375 +msgid "Run Search First" +msgstr "" + +#: appserver/static/predictive_analytics.js:376 +msgid "You need to run the search first before attempting to make a correlation search." +msgstr "" + +#: appserver/static/predictive_analytics.js:407 +msgid "Advanced Predict Options" +msgstr "" + +#: appserver/static/predictive_analytics.js:409 +msgid "Predict Timespan" +msgstr "" + +#: appserver/static/predictive_analytics.js:410 +msgid "defaults to 10m" +msgstr "" + +#: appserver/static/predictive_analytics.js:411 +msgid "Use time specifiers: y, mon, d, h, m, s" +msgstr "" + +#: appserver/static/predictive_analytics.js:413 +msgid "Algorithm" +msgstr "" + +#: appserver/static/predictive_analytics.js:416 +msgid "Correlate" +msgstr "" + +#: appserver/static/predictive_analytics.js:417 +msgid "For bivariate model, indicates the field to correlate against" +msgstr "" + +#: appserver/static/predictive_analytics.js:419 +msgid "Future Timespan" +msgstr "" + +#: appserver/static/predictive_analytics.js:420 +msgid "Must be a non-negative number" +msgstr "" + +#: appserver/static/predictive_analytics.js:421 +msgid "The length of prediction into the future" +msgstr "" + +#: appserver/static/predictive_analytics.js:423 +msgid "Holdback" +msgstr "" + +#: appserver/static/predictive_analytics.js:424 +msgid "Specifies the 'number' of data points from the end that are NOT used to build the model" +msgstr "" + +#: appserver/static/predictive_analytics.js:426 +msgid "Lower confidence interval" +msgstr "" + +#: appserver/static/predictive_analytics.js:427 +#: appserver/static/predictive_analytics.js:431 +msgid "Must be between 0-100; defaults to 95" +msgstr "" + +#: appserver/static/predictive_analytics.js:428 +msgid "Specifies a field name for the lower 'int' percentage confidence interval" +msgstr "" + +#: appserver/static/predictive_analytics.js:430 +msgid "Upper confidence interval" +msgstr "" + +#: appserver/static/predictive_analytics.js:432 +msgid "Specifies a field name for the upper 'int' percentage confidence interval" +msgstr "" + +#: appserver/static/predictive_analytics.js:434 +msgid "Period" +msgstr "" + +#: appserver/static/predictive_analytics.js:435 +msgid "Specifies the seasonal period of the time series data" +msgstr "" + +#: appserver/static/predictive_analytics.js:437 +msgid "Predict command help" +msgstr "" + +#: appserver/static/predictive_analytics.js:439 +msgid "Apply" +msgstr "" + +#: appserver/static/predictive_analytics.js:466 +msgid "Local level" +msgstr "" + +#: appserver/static/predictive_analytics.js:470 +msgid "Seasonal local level" +msgstr "" + +#: appserver/static/predictive_analytics.js:478 +msgid "Local level trend" +msgstr "" + +#: appserver/static/predictive_analytics.js:572 +msgid "Must be a valid timespan" +msgstr "" + +#: appserver/static/predictive_analytics.js:582 +#: appserver/static/predictive_analytics.js:592 +msgid "Must be between 0 and 100" +msgstr "" + +#: appserver/static/predictive_analytics.js:602 +msgid "Must be a positive integer" +msgstr "" + +#: appserver/static/predictive_analytics.js:612 +msgid "Must be zero or more" +msgstr "" + +#: appserver/static/predictive_analytics.js:622 +msgid "Must not be empty" +msgstr "" + +#: appserver/static/js/commonControl/AddonMenuControl.js:54 +#: appserver/static/js/commonControl/AddonMenuControl.js:64 +msgid "N/A" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:42 +msgid "Enable acceleration" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:53 +msgid "Backfill time" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:59 +#: appserver/static/js/views/DataModelConfig.js:92 +msgid "Year" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:63 +#: appserver/static/js/views/DataModelConfig.js:96 +msgid "Quarter" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:67 +#: appserver/static/js/views/DataModelConfig.js:100 +msgid "Month" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:71 +#: appserver/static/js/views/DataModelConfig.js:104 +msgid "Week" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:75 +#: appserver/static/js/views/DataModelConfig.js:108 +msgid "Day" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:86 +msgid "Earliest time" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:119 +msgid "Maximum time" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:130 +msgid "Maximum concurrent searches" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:141 +msgid "Manual rebuilds" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:155 +msgid "Schedule priority" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:164 +msgid "default" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:168 +msgid "higher" +msgstr "" + +#: appserver/static/js/views/DataModelConfig.js:172 +msgid "highest" +msgstr "" + +#: appserver/static/cim_setup.js:68 +msgid "enabled should be boolean" +msgstr "" + +#: appserver/static/cim_setup.js:71 +msgid "Invalid earliest time" +msgstr "" + +#: appserver/static/cim_setup.js:74 +msgid "Invalid backfill time" +msgstr "" + +#: appserver/static/cim_setup.js:77 +msgid "Backfill time should be more recent than earliest time" +msgstr "" + +#: appserver/static/cim_setup.js:80 +msgid "Maximum time should be an integer" +msgstr "" + +#: appserver/static/cim_setup.js:84 +msgid "Maximum concurrent should be an integer" +msgstr "" + +#: appserver/static/cim_setup.js:87 +msgid "Manual rebuilds should be boolean" +msgstr "" + +#: appserver/static/cim_setup.js:177 +msgid "Saving" +msgstr "" + +#: appserver/static/cim_setup.js:242 +#: appserver/static/js/views/CIMSetupView.js:96 +msgid "Save" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:60 +msgid "Data Models" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:65 +#: appserver/static/js/views/CIMSetupView.js:71 +msgid "Indexes" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:66 +#: appserver/static/js/views/CIMSetupView.js:77 +msgid "Settings" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:79 +msgid "Acceleration properties for the selected data model." +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:80 +msgid "Splunk help" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:81 +msgid "Learn More" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:93 +msgid "Cancel" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:197 +msgid "Filter" +msgstr "" + +#: appserver/static/js/views/CIMSetupView.js:380 +msgid "Apps" +msgstr "" diff --git a/deps/apps/Splunk_SA_CIM/locale/zh_CN/LC_MESSAGES/messages.mo b/deps/apps/Splunk_SA_CIM/locale/zh_CN/LC_MESSAGES/messages.mo new file mode 100644 index 000000000..5584ea1e4 Binary files /dev/null and b/deps/apps/Splunk_SA_CIM/locale/zh_CN/LC_MESSAGES/messages.mo differ diff --git a/deps/apps/Splunk_SA_CIM/locale/zh_CN/LC_MESSAGES/messages.po b/deps/apps/Splunk_SA_CIM/locale/zh_CN/LC_MESSAGES/messages.po new file mode 100644 index 000000000..561d2e52d --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/locale/zh_CN/LC_MESSAGES/messages.po @@ -0,0 +1,526 @@ +# Copyright (C) 2009-2018 Splunk Inc. All Rights Reserved. +# +# Translatable strings for Common Information Model +# +# +msgid "" +msgstr "" +"Project-Id-Version: CIM Translation\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2016-08-27 16:20-0800\n" +"PO-Revision-Date: 2017-06-20 12:23+0100\n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Last-Translator: \n" +"Language-Team: \n" +"Language: zh_CN\n" +"X-Generator: Poedit 2.0.1\n" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:250 +msgid "Application State" +msgstr "应用程序状态" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:253 +msgid "Authentication" +msgstr "验证" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:256 +msgid "Certificates" +msgstr "证书" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:259 +msgid "Change Analysis" +msgstr "更改分析" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:262 +msgid "Compute Inventory" +msgstr "计算库存" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:265 +msgid "DLP" +msgstr "DLP" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:268 +msgid "Databases" +msgstr "数据库" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:274 +msgid "Interprocess Messaging" +msgstr "进程间通讯" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:277 +msgid "Intrusion Detection" +msgstr "入侵检测" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:280 +msgid "JVM" +msgstr "JVM" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:283 +msgid "Malware" +msgstr "恶意软件" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:286 +msgid "Network Resolution" +msgstr "网络分辨率" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:289 +msgid "Network Sessions" +msgstr "网络会话" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:298 +msgid "Ticket Management" +msgstr "票据管理" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:301 +msgid "Updates" +msgstr "更新" + +# Final text is programmatically extracted from the original text +# Original Text : cim_BLAH_BLAH_indexes +# Extracted Text: BLAH BLAH +#: default/macros.conf:304 +msgid "Vulnerabilities" +msgstr "漏洞" + +#: appserver/static/js/views/CIMSetupView.js:41 appserver/static/cim_setup.js:239 +msgid "Saved" +msgstr "已保存" + +#: appserver/static/js/views/CIMSetupView.js:44 +msgid "Save failed" +msgstr "保存失败" + +#: appserver/static/js/views/CIMSetupView.js:53 +msgid "Splunk Common Information Model Add-on Set Up" +msgstr "Splunk 常用信息模型加载项设置" + +#: appserver/static/js/views/CIMSetupView.js:55 +msgid "" +"By default a datamodel will search across all indexes. Use the configuration panel below to constrain data model searches to specific indexes." +msgstr "默认情况下数据模型会跨所有的索引进行搜索。使用下面的配置面板来约束数据模型搜索特定的索引。" + +#: appserver/static/js/views/CIMSetupView.js:266 +#, python-format +msgid "Restricted to: %s" +msgstr "限制为: %s" + +#: appserver/static/js/views/CIMSetupView.js:270 +msgid "No restriction" +msgstr "无限制" + +#: appserver/static/js/views/CIMSetupView.js:276 +msgid "show all" +msgstr "显示所有" + +#: appserver/static/js/views/DataModelConfig.js:260 +msgid "No datamodel found" +msgstr "未找到数据模型" + +#: appserver/static/js/views/IndexList.js:147 +#, python-format +msgid "%s MB" +msgstr "%s MB" + +#: appserver/static/js/views/IndexList.js:201 +msgid "Name" +msgstr "名称" + +#: default/data/ui/views/datamodel_audit.xml:2 +msgid "Data Model Audit" +msgstr "数据模型审计" + +#: default/data/ui/views/datamodel_audit.xml:8 +msgid "Top Accelerations By Size" +msgstr "按大小划分的最优加速" + +#: default/data/ui/views/datamodel_audit.xml:21 +msgid "Top Accelerations By Run Duration" +msgstr "按运行时间划分的最优加速" + +#: default/data/ui/views/datamodel_audit.xml:36 +msgid "Acceleration Details" +msgstr "加速详细信息" + +#: default/data/ui/views/predictive_analytics.xml:2 +msgid "Predictive Analytics" +msgstr "预测分析" + +#: default/data/ui/views/predictive_analytics.xml:17 +msgid "Function" +msgstr "函数" + +#: default/data/ui/views/predictive_analytics.xml:30 +msgid "Attribute" +msgstr "属性" + +#: default/data/ui/views/predictive_analytics.xml:47 +msgid "Prediction Over Time" +msgstr "时段预测值" + +#: default/data/ui/views/predictive_analytics.xml:60 +msgid "Outliers" +msgstr "离群值" + +#: default/data/ui/views/cim_setup.xml:2 +msgid "CIM Setup" +msgstr "CIM 设置" + +#: appserver/static/predictive_analytics.js:28 +msgid "Save as Correlation Search ..." +msgstr "另存为“相关搜索”..." + +#: appserver/static/predictive_analytics.js:59 +msgid "All functions other than count require an attribute!" +msgstr "除了计数以外的所有函数都需要一个属性!" + +#: appserver/static/predictive_analytics.js:63 +msgid "Please select a function!" +msgstr "请选择一个函数!" + +#: appserver/static/predictive_analytics.js:142 +#, python-format +msgid "The correlation search was successfully created.


View created search

" +msgstr "成功创建了相关搜索。


查看创建的搜索

" + +#: appserver/static/predictive_analytics.js:237 +msgid "Correlation search could not be saved" +msgstr "无法保存相关搜索" + +#: appserver/static/predictive_analytics.js:352 +msgid "Save as Correlation Search" +msgstr "另存为“相关搜索”" + +#: appserver/static/predictive_analytics.js:354 +msgid "Security Domain" +msgstr "安全域" + +#: appserver/static/predictive_analytics.js:357 +msgid "Severity" +msgstr "严重性" + +#: appserver/static/predictive_analytics.js:360 +msgid "Correlation Search Name" +msgstr "相关搜索名称" + +#: appserver/static/predictive_analytics.js:361 +msgid "Enter the name of the correlation search" +msgstr "输入相关搜索的名称" + +#: appserver/static/predictive_analytics.js:363 +msgid "Correlation Search Description" +msgstr "相关搜索描述" + +#: appserver/static/predictive_analytics.js:364 +msgid "Enter a description of the correlation search" +msgstr "输入相关搜索的描述" + +#: appserver/static/predictive_analytics.js:366 +msgid "The correlation search was successfully created" +msgstr "成功创建了相关搜索" + +#: appserver/static/predictive_analytics.js:375 +msgid "Run Search First" +msgstr "首先运行搜索" + +#: appserver/static/predictive_analytics.js:376 +msgid "You need to run the search first before attempting to make a correlation search." +msgstr "在试图进行相关搜索之前，您需要先运行搜索。" + +#: appserver/static/predictive_analytics.js:407 +msgid "Advanced Predict Options" +msgstr "高级预测选项" + +#: appserver/static/predictive_analytics.js:409 +msgid "Predict Timespan" +msgstr "预测时间跨度" + +#: appserver/static/predictive_analytics.js:410 +msgid "defaults to 10m" +msgstr "默认为 10m" + +#: appserver/static/predictive_analytics.js:411 +msgid "Use time specifiers: y, mon, d, h, m, s" +msgstr "使用时间说明符: y、mon、d、h、m、s" + +#: appserver/static/predictive_analytics.js:413 +msgid "Algorithm" +msgstr "算法" + +#: appserver/static/predictive_analytics.js:416 +msgid "Correlate" +msgstr "相关" + +#: appserver/static/predictive_analytics.js:417 +msgid "For bivariate model, indicates the field to correlate against" +msgstr "对于双变量模型，表示要关联的字段" + +#: appserver/static/predictive_analytics.js:419 +msgid "Future Timespan" +msgstr "未来时间跨度" + +#: appserver/static/predictive_analytics.js:420 +msgid "Must be a non-negative number" +msgstr "必须是非负数" + +#: appserver/static/predictive_analytics.js:421 +msgid "The length of prediction into the future" +msgstr "预测到未来的长度" + +#: appserver/static/predictive_analytics.js:423 +msgid "Holdback" +msgstr "阻止" + +#: appserver/static/predictive_analytics.js:424 +msgid "Specifies the 'number' of data points from the end that are NOT used to build the model" +msgstr "从末尾指定没有用于构建模型的数据点数的“数量”" + +#: appserver/static/predictive_analytics.js:426 +msgid "Lower confidence interval" +msgstr "下置信间隔" + +#: appserver/static/predictive_analytics.js:427 appserver/static/predictive_analytics.js:431 +msgid "Must be between 0-100; defaults to 95" +msgstr "必须介于 0 到 100；默认为 95" + +#: appserver/static/predictive_analytics.js:428 +msgid "Specifies a field name for the lower 'int' percentage confidence interval" +msgstr "指定 'int' 百分比的下置信间隔的字段名称" + +#: appserver/static/predictive_analytics.js:430 +msgid "Upper confidence interval" +msgstr "上置信间隔" + +#: appserver/static/predictive_analytics.js:432 +msgid "Specifies a field name for the upper 'int' percentage confidence interval" +msgstr "指定 'int' 百分比的上置信间隔的字段名称" + +#: appserver/static/predictive_analytics.js:434 +msgid "Period" +msgstr "周期" + +#: appserver/static/predictive_analytics.js:435 +msgid "Specifies the seasonal period of the time series data" +msgstr "指定时间系列数据的季节性周期" + +#: appserver/static/predictive_analytics.js:437 +msgid "Predict command help" +msgstr "预测命令帮助" + +#: appserver/static/predictive_analytics.js:439 +msgid "Apply" +msgstr "应用" + +#: appserver/static/predictive_analytics.js:466 +msgid "Local level" +msgstr "本地级别" + +#: appserver/static/predictive_analytics.js:470 +msgid "Seasonal local level" +msgstr "季节性的本地级别" + +#: appserver/static/predictive_analytics.js:478 +msgid "Local level trend" +msgstr "本地级别趋势" + +#: appserver/static/predictive_analytics.js:572 +msgid "Must be a valid timespan" +msgstr "必须为有效的时间跨度" + +#: appserver/static/predictive_analytics.js:582 appserver/static/predictive_analytics.js:592 +msgid "Must be between 0 and 100" +msgstr "必须介于 0 到 100" + +#: appserver/static/predictive_analytics.js:602 +msgid "Must be a positive integer" +msgstr "必须是正整数" + +#: appserver/static/predictive_analytics.js:612 +msgid "Must be zero or more" +msgstr "必须为零或多个" + +#: appserver/static/predictive_analytics.js:622 +msgid "Must not be empty" +msgstr "不能为空" + +#: appserver/static/js/commonControl/AddonMenuControl.js:54 appserver/static/js/commonControl/AddonMenuControl.js:64 +msgid "N/A" +msgstr "N/A" + +#: appserver/static/js/views/DataModelConfig.js:42 +msgid "Enable acceleration" +msgstr "启用加速" + +#: appserver/static/js/views/DataModelConfig.js:53 +msgid "Backfill time" +msgstr "回填时间" + +#: appserver/static/js/views/DataModelConfig.js:59 appserver/static/js/views/DataModelConfig.js:92 +msgid "Year" +msgstr "年" + +#: appserver/static/js/views/DataModelConfig.js:63 appserver/static/js/views/DataModelConfig.js:96 +msgid "Quarter" +msgstr "季度" + +#: appserver/static/js/views/DataModelConfig.js:67 appserver/static/js/views/DataModelConfig.js:100 +msgid "Month" +msgstr "月" + +#: appserver/static/js/views/DataModelConfig.js:71 appserver/static/js/views/DataModelConfig.js:104 +msgid "Week" +msgstr "周" + +#: appserver/static/js/views/DataModelConfig.js:75 appserver/static/js/views/DataModelConfig.js:108 +msgid "Day" +msgstr "天" + +#: appserver/static/js/views/DataModelConfig.js:86 +msgid "Earliest time" +msgstr "最早时间" + +#: appserver/static/js/views/DataModelConfig.js:119 +msgid "Maximum time" +msgstr "最长时间" + +#: appserver/static/js/views/DataModelConfig.js:130 +msgid "Maximum concurrent searches" +msgstr "并发搜索的最大数目" + +#: appserver/static/js/views/DataModelConfig.js:141 +msgid "Manual rebuilds" +msgstr "手动重建" + +#: appserver/static/js/views/DataModelConfig.js:155 +msgid "Schedule priority" +msgstr "计划优先级" + +#: appserver/static/js/views/DataModelConfig.js:164 +msgid "default" +msgstr "默认" + +#: appserver/static/js/views/DataModelConfig.js:168 +msgid "higher" +msgstr "更高" + +#: appserver/static/js/views/DataModelConfig.js:172 +msgid "highest" +msgstr "最高" + +#: appserver/static/cim_setup.js:68 +msgid "enabled should be boolean" +msgstr "已启用应该为布尔表达式" + +#: appserver/static/cim_setup.js:71 +msgid "Invalid earliest time" +msgstr "无效最早时间" + +#: appserver/static/cim_setup.js:74 +msgid "Invalid backfill time" +msgstr "无效回填时间" + +#: appserver/static/cim_setup.js:77 +msgid "Backfill time should be more recent than earliest time" +msgstr "回填时间应该晚于最早时间" + +#: appserver/static/cim_setup.js:80 +msgid "Maximum time should be an integer" +msgstr "最长时间应该为整数" + +#: appserver/static/cim_setup.js:84 +msgid "Maximum concurrent should be an integer" +msgstr "最大并发数应该为整数" + +#: appserver/static/cim_setup.js:87 +msgid "Manual rebuilds should be boolean" +msgstr "手动重建应该为布尔表达式" + +#: appserver/static/cim_setup.js:177 +msgid "Saving" +msgstr "正在保存" + +#: appserver/static/cim_setup.js:242 appserver/static/js/views/CIMSetupView.js:96 +msgid "Save" +msgstr "保存" + +#: appserver/static/js/views/CIMSetupView.js:60 +msgid "Data Models" +msgstr "数据模型" + +#: appserver/static/js/views/CIMSetupView.js:65 appserver/static/js/views/CIMSetupView.js:71 +msgid "Indexes" +msgstr "索引" + +#: appserver/static/js/views/CIMSetupView.js:66 appserver/static/js/views/CIMSetupView.js:77 +msgid "Settings" +msgstr "设置" + +#: appserver/static/js/views/CIMSetupView.js:79 +msgid "Acceleration properties for the selected data model." +msgstr "所选数据模型的加速属性。" + +#: appserver/static/js/views/CIMSetupView.js:80 +msgid "Splunk help" +msgstr "Splunk 帮助" + +#: appserver/static/js/views/CIMSetupView.js:81 +msgid "Learn More" +msgstr "了解更多信息" + +#: appserver/static/js/views/CIMSetupView.js:93 +msgid "Cancel" +msgstr "取消" + +#: appserver/static/js/views/CIMSetupView.js:197 +msgid "Filter" +msgstr "过滤器" + +#: appserver/static/js/views/CIMSetupView.js:380 +msgid "Apps" +msgstr "应用" diff --git a/deps/apps/Splunk_SA_CIM/lookups/cam_action_modes.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cam_action_modes.csv.default new file mode 100644 index 000000000..e5c12204c --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cam_action_modes.csv.default @@ -0,0 +1,3 @@ +action_mode +adhoc +saved \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cam_action_statuses.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cam_action_statuses.csv.default new file mode 100644 index 000000000..3cc04e3b5 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cam_action_statuses.csv.default @@ -0,0 +1,3 @@ +action_status +success +failure \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cam_categories.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cam_categories.csv.default new file mode 100644 index 000000000..e02dac219 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cam_categories.csv.default @@ -0,0 +1,6 @@ +category +Information Conveyance +Information Gathering +Information Tracking +Permissions Control +Device Control diff --git a/deps/apps/Splunk_SA_CIM/lookups/cam_subjects.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cam_subjects.csv.default new file mode 100644 index 000000000..9a9305b60 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cam_subjects.csv.default @@ -0,0 +1,51 @@ +subject +device +endpoint +endpoint.workstation +endpoint.server +endpoint.laptop +endpoint.smart-phone +endpoint.tablet +endpoint.printer +endpoint.smart-meter +endpoint.pos-terminal +endpoint.digital-telephone-handset +endpoint.sensor +network +network.firewall +network.router +network.capture +network.ids +network.hub +network.bridge +network.switch +network.modem +network.wap +network.gateway +network.proxy +network.nic +network.vpn +network.guard +network.sensor +network.hips +network.ips +network.security_manager +network.sense_making +process +process.vulnerability-scanner +process.network-scanner +process.connection-scanner +process.anti-virus-scanner +process.file-scanner +process.aaa-server +process.virtualization-service +process.sandbox +process.dns-server +process.email-service +process.directory-service +process.remediation-service +process.reputation-service +process.location-service +splunk.event +threat.artifact +uba.anomaly \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cam_tasks.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cam_tasks.csv.default new file mode 100644 index 000000000..267fcfe18 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cam_tasks.csv.default @@ -0,0 +1,7 @@ +task +block +allow +create +update +delete +scan \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cam_workers.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cam_workers.csv.default new file mode 100644 index 000000000..1613ace29 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cam_workers.csv.default @@ -0,0 +1,2 @@ +worker_set,cam_workers +local,"[""local""]" \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_access_actions.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_access_actions.csv.default new file mode 100644 index 000000000..d286c3ea2 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_access_actions.csv.default @@ -0,0 +1,5 @@ +action +success +failure +pending +error diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_cloud_domains.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_cloud_domains.csv.default new file mode 100644 index 000000000..553dc63d9 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_cloud_domains.csv.default @@ -0,0 +1,13 @@ +domain,registrant,is_email,is_storage +"*drive.google.com",Google,false,true +"*gmail.google.com",Google,true,false +"*gmail.com",Google,true,false +"*google.com",Google,false,false +"*ymail.com","Yahoo Mail",true,false +"*aws.amazon.com","Amazon Web Services",false,false +"*inbox.com",Inbox,true,false +"*dropbox.com",Dropbox,false,true +"*box.com",Box,false,true +"*rackspace.com",Rackspace,false,false +"*softlayer.com",Softlayer,false,false +"*hotmail.com",Microsoft,true,false \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_corporate_email_domains.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_corporate_email_domains.csv.default new file mode 100644 index 000000000..7e558c26e --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_corporate_email_domains.csv.default @@ -0,0 +1,2 @@ +domain +*acmetech.com \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_corporate_web_domains.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_corporate_web_domains.csv.default new file mode 100644 index 000000000..2657d1128 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_corporate_web_domains.csv.default @@ -0,0 +1,2 @@ +domain +*acmetech.com diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_dlp_actions.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_dlp_actions.csv.default new file mode 100644 index 000000000..01b408dee --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_dlp_actions.csv.default @@ -0,0 +1,4 @@ +action +allowed +blocked +deferred \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_dlp_object_categories.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_dlp_object_categories.csv.default new file mode 100644 index 000000000..0d10dc373 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_dlp_object_categories.csv.default @@ -0,0 +1,15 @@ +object_category +config_setting +directory +directory_entry +file +group +hardware_component +network +policy +process +registry +service +system_object +system_state +user \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_dlp_types.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_dlp_types.csv.default new file mode 100644 index 000000000..dc39d139e --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_dlp_types.csv.default @@ -0,0 +1,5 @@ +dlp_type +application +host +network +gateway \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_dns_reply_codes2.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_dns_reply_codes2.csv.default new file mode 100644 index 000000000..2443a7cd1 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_dns_reply_codes2.csv.default @@ -0,0 +1,323 @@ +reply_code_id,reply_code +0,No Error +NoError,No Error +No Error,No Error +1,Format Error +FormErr,Format Error +Format Error,Format Error +2,Server Failure +ServFail,Server Failure +Server Failure,Server Failure +3,Non-Existent Domain +NXDomain,Non-Existent Domain +Non-Existent Domain,Non-Existent Domain +4,Not Implemented +NotImp,Not Implemented +Not Implemented,Not Implemented +5,Query Refused +Refused,Query Refused +Query Refused,Query Refused +6,Name Exists when it should not +YXDomain,Name Exists when it should not +Name Exists when it should not,Name Exists when it should not +7,RR Set Exists when it should not +YXRRSet,RR Set Exists when it should not +RR Set Exists when it should not,RR Set Exists when it should not +8,RR Set that should exist does not +NXRRSet,RR Set that should exist does not +RR Set that should exist does not,RR Set that should exist does not +9,Not Authorized +NotAuth,Not Authorized +Not Authorized,Not Authorized +10,Name not contained in zone +NotZone,Name not contained in zone +Name not contained in zone,Name not contained in zone +11,Unassigned +12,Unassigned +13,Unassigned +14,Unassigned +15,Unassigned +Unassigned,Unassigned +BADVERS,Bad OPT Version +Bad OPT Version,Bad OPT Version +16,TSIG Signature Failure +BADSIG,TSIG Signature Failure +TSIG Signature Failure,TSIG Signature Failure +17,Key not recognized +BADKEY,Key not recognized +Key not recognized,Key not recognized +18,Signature out of time window +BADTIME,Signature out of time window +Signature out of time window,Signature out of time window +19,Bad TKEY Mode +BADMODE,Bad TKEY Mode +Bad TKEY Mode,Bad TKEY Mode +20,Duplicate key name +BADNAME,Duplicate key name +Duplicate key name,Duplicate key name +21,Algorithm not supported +BADALG,Algorithm not supported +Algorithm not supported,Algorithm not supported +22,Bad Truncation +BADTRUNC,Bad Truncation +Bad Truncation,Bad Truncation +3841,Reserved for Private Use +3842,Reserved for Private Use +3843,Reserved for Private Use +3844,Reserved for Private Use +3845,Reserved for Private Use +3846,Reserved for Private Use +3847,Reserved for Private Use +3848,Reserved for Private Use +3849,Reserved for Private Use +3850,Reserved for Private Use +3851,Reserved for Private Use +3852,Reserved for Private Use +3853,Reserved for Private Use +3854,Reserved for Private Use +3855,Reserved for Private Use +3856,Reserved for Private Use +3857,Reserved for Private Use +3858,Reserved for Private Use +3859,Reserved for Private Use +3860,Reserved for Private Use +3861,Reserved for Private Use +3862,Reserved for Private Use +3863,Reserved for Private Use +3864,Reserved for Private Use +3865,Reserved for Private Use +3866,Reserved for Private Use +3867,Reserved for Private Use +3868,Reserved for Private Use +3869,Reserved for Private Use +3870,Reserved for Private Use +3871,Reserved for Private Use +3872,Reserved for Private Use +3873,Reserved for Private Use +3874,Reserved for Private Use +3875,Reserved for Private Use +3876,Reserved for Private Use +3877,Reserved for Private Use +3878,Reserved for Private Use +3879,Reserved for Private Use +3880,Reserved for Private Use +3881,Reserved for Private Use +3882,Reserved for Private Use +3883,Reserved for Private Use +3884,Reserved for Private Use +3885,Reserved for Private Use +3886,Reserved for Private Use +3887,Reserved for Private Use +3888,Reserved for Private Use +3889,Reserved for Private Use +3890,Reserved for Private Use +3891,Reserved for Private Use +3892,Reserved for Private Use +3893,Reserved for Private Use +3894,Reserved for Private Use +3895,Reserved for Private Use +3896,Reserved for Private Use +3897,Reserved for Private Use +3898,Reserved for Private Use +3899,Reserved for Private Use +3900,Reserved for Private Use +3901,Reserved for Private Use +3902,Reserved for Private Use +3903,Reserved for Private Use +3904,Reserved for Private Use +3905,Reserved for Private Use +3906,Reserved for Private Use +3907,Reserved for Private Use +3908,Reserved for Private Use +3909,Reserved for Private Use +3910,Reserved for Private Use +3911,Reserved for Private Use +3912,Reserved for Private Use +3913,Reserved for Private Use +3914,Reserved for Private Use +3915,Reserved for Private Use +3916,Reserved for Private Use +3917,Reserved for Private Use +3918,Reserved for Private Use +3919,Reserved for Private Use +3920,Reserved for Private Use +3921,Reserved for Private Use +3922,Reserved for Private Use +3923,Reserved for Private Use +3924,Reserved for Private Use +3925,Reserved for Private Use +3926,Reserved for Private Use +3927,Reserved for Private Use +3928,Reserved for Private Use +3929,Reserved for Private Use +3930,Reserved for Private Use +3931,Reserved for Private Use +3932,Reserved for Private Use +3933,Reserved for Private Use +3934,Reserved for Private Use +3935,Reserved for Private Use +3936,Reserved for Private Use +3937,Reserved for Private Use +3938,Reserved for Private Use +3939,Reserved for Private Use +3940,Reserved for Private Use +3941,Reserved for Private Use +3942,Reserved for Private Use +3943,Reserved for Private Use +3944,Reserved for Private Use +3945,Reserved for Private Use +3946,Reserved for Private Use +3947,Reserved for Private Use +3948,Reserved for Private Use +3949,Reserved for Private Use +3950,Reserved for Private Use +3951,Reserved for Private Use +3952,Reserved for Private Use +3953,Reserved for Private Use +3954,Reserved for Private Use +3955,Reserved for Private Use +3956,Reserved for Private Use +3957,Reserved for Private Use +3958,Reserved for Private Use +3959,Reserved for Private Use +3960,Reserved for Private Use +3961,Reserved for Private Use +3962,Reserved for Private Use +3963,Reserved for Private Use +3964,Reserved for Private Use +3965,Reserved for Private Use +3966,Reserved for Private Use +3967,Reserved for Private Use +3968,Reserved for Private Use +3969,Reserved for Private Use +3970,Reserved for Private Use +3971,Reserved for Private Use +3972,Reserved for Private Use +3973,Reserved for Private Use +3974,Reserved for Private Use +3975,Reserved for Private Use +3976,Reserved for Private Use +3977,Reserved for Private Use +3978,Reserved for Private Use +3979,Reserved for Private Use +3980,Reserved for Private Use +3981,Reserved for Private Use +3982,Reserved for Private Use +3983,Reserved for Private Use +3984,Reserved for Private Use +3985,Reserved for Private Use +3986,Reserved for Private Use +3987,Reserved for Private Use +3988,Reserved for Private Use +3989,Reserved for Private Use +3990,Reserved for Private Use +3991,Reserved for Private Use +3992,Reserved for Private Use +3993,Reserved for Private Use +3994,Reserved for Private Use +3995,Reserved for Private Use +3996,Reserved for Private Use +3997,Reserved for Private Use +3998,Reserved for Private Use +3999,Reserved for Private Use +4000,Reserved for Private Use +4001,Reserved for Private Use +4002,Reserved for Private Use +4003,Reserved for Private Use +4004,Reserved for Private Use +4005,Reserved for Private Use +4006,Reserved for Private Use +4007,Reserved for Private Use +4008,Reserved for Private Use +4009,Reserved for Private Use +4010,Reserved for Private Use +4011,Reserved for Private Use +4012,Reserved for Private Use +4013,Reserved for Private Use +4014,Reserved for Private Use +4015,Reserved for Private Use +4016,Reserved for Private Use +4017,Reserved for Private Use +4018,Reserved for Private Use +4019,Reserved for Private Use +4020,Reserved for Private Use +4021,Reserved for Private Use +4022,Reserved for Private Use +4023,Reserved for Private Use +4024,Reserved for Private Use +4025,Reserved for Private Use +4026,Reserved for Private Use +4027,Reserved for Private Use +4028,Reserved for Private Use +4029,Reserved for Private Use +4030,Reserved for Private Use +4031,Reserved for Private Use +4032,Reserved for Private Use +4033,Reserved for Private Use +4034,Reserved for Private Use +4035,Reserved for Private Use +4036,Reserved for Private Use +4037,Reserved for Private Use +4038,Reserved for Private Use +4039,Reserved for Private Use +4040,Reserved for Private Use +4041,Reserved for Private Use +4042,Reserved for Private Use +4043,Reserved for Private Use +4044,Reserved for Private Use +4045,Reserved for Private Use +4046,Reserved for Private Use +4047,Reserved for Private Use +4048,Reserved for Private Use +4049,Reserved for Private Use +4050,Reserved for Private Use +4051,Reserved for Private Use +4052,Reserved for Private Use +4053,Reserved for Private Use +4054,Reserved for Private Use +4055,Reserved for Private Use +4056,Reserved for Private Use +4057,Reserved for Private Use +4058,Reserved for Private Use +4059,Reserved for Private Use +4060,Reserved for Private Use +4061,Reserved for Private Use +4062,Reserved for Private Use +4063,Reserved for Private Use +4064,Reserved for Private Use +4065,Reserved for Private Use +4066,Reserved for Private Use +4067,Reserved for Private Use +4068,Reserved for Private Use +4069,Reserved for Private Use +4070,Reserved for Private Use +4071,Reserved for Private Use +4072,Reserved for Private Use +4073,Reserved for Private Use +4074,Reserved for Private Use +4075,Reserved for Private Use +4076,Reserved for Private Use +4077,Reserved for Private Use +4078,Reserved for Private Use +4079,Reserved for Private Use +4080,Reserved for Private Use +4081,Reserved for Private Use +4082,Reserved for Private Use +4083,Reserved for Private Use +4084,Reserved for Private Use +4085,Reserved for Private Use +4086,Reserved for Private Use +4087,Reserved for Private Use +4088,Reserved for Private Use +4089,Reserved for Private Use +4090,Reserved for Private Use +4091,Reserved for Private Use +4092,Reserved for Private Use +4093,Reserved for Private Use +4094,Reserved for Private Use +4095,Reserved for Private Use +Reserved for Private Use,Reserved for Private Use +65535,Reserved; can only be allocated by Standards Action +Reserved; can only be allocated by Standards Action,Reserved; can only be allocated by Standards Action +Reserved; can only be allocated by Standards Action.,Reserved; can only be allocated by Standards Action + \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_email_protocols.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_email_protocols.csv.default new file mode 100644 index 000000000..496a45945 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_email_protocols.csv.default @@ -0,0 +1,5 @@ +protocol +smtp +imap +pop3 +mapi \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_actions.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_actions.csv.default new file mode 100644 index 000000000..22ee8fe3a --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_actions.csv.default @@ -0,0 +1,5 @@ +action +created +deleted +modified +state_changed \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_object_categories.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_object_categories.csv.default new file mode 100644 index 000000000..0d10dc373 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_object_categories.csv.default @@ -0,0 +1,15 @@ +object_category +config_setting +directory +directory_entry +file +group +hardware_component +network +policy +process +registry +service +system_object +system_state +user \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_severities.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_severities.csv.default new file mode 100644 index 000000000..8a8548cac --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_severities.csv.default @@ -0,0 +1,6 @@ +severity +critical +high +medium +low +informational \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_statuses.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_statuses.csv.default new file mode 100644 index 000000000..bff9e13f2 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_statuses.csv.default @@ -0,0 +1,4 @@ +status +success +failure +deferred \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_user_types.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_user_types.csv.default new file mode 100644 index 000000000..29a555d98 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_endpoint_user_types.csv.default @@ -0,0 +1,4 @@ +user_type +user +process +stored_procedure \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_http_methods.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_http_methods.csv.default new file mode 100644 index 000000000..0c61dbb79 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_http_methods.csv.default @@ -0,0 +1,9 @@ +http_method,is_visible +OPTIONS,false +GET,true +HEAD,false +POST,true +PUT,false +DELETE,false +TRACE,false +CONNECT,false \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_http_statuses.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_http_statuses.csv.default new file mode 100644 index 000000000..02655cb53 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_http_statuses.csv.default @@ -0,0 +1,124 @@ +status,status_action,status_description,status_reference,status_type +100,allowed,Continue,RFC2616,Informational +100.*,allowed,Continue,,Informational +101,allowed,Switching Protocols,RFC2616,Informational +101.*,allowed,Switching Protocols,,Informational +102,allowed,Processing,RFC2518,Informational +102.*,allowed,Processing,,Informational +200,allowed,OK,RFC2616,Success +200.*,allowed,OK,,Success +201,allowed,Created,RFC2616,Success +201.*,allowed,Created,,Success +202,allowed,Accepted,RFC2616,Success +202.*,allowed,Accepted,,Success +203,allowed,Non-Authoritative Information,RFC2616,Success +203.*,allowed,Non-Authoritative Information,,Success +204,allowed,No Content,RFC2616,Success +204.*,allowed,No Content,,Success +205,allowed,Reset Content,RFC2616,Success +205.*,allowed,Reset Content,,Success +206,allowed,Partial Content,RFC2616,Success +206.*,allowed,Partial Content,,Success +207,allowed,Multi-Status,RFC4918,Success +207.*,allowed,Multi-Status,,Success +208,allowed,Already Reported,RFC5842,Success +208.*,allowed,Already Reported,,Success +226,allowed,IM Used,RFC3229,Success +226.*,allowed,IM Used,,Success +300,allowed,Multiple Choices,RFC2616,Redirection +300.*,allowed,Multiple Choices,,Redirection +301,allowed,Moved Permanently,RFC2616,Redirection +301.*,allowed,Moved Permanently,,Redirection +302,allowed,Found,RFC2616,Redirection +302.*,allowed,Found,,Redirection +303,allowed,See Other,RFC2616,Redirection +303.*,allowed,See Other,,Redirection +304,allowed,Not Modified,RFC2616,Redirection +304.*,allowed,Not Modified,,Redirection +305,allowed,Use Proxy,RFC2616,Redirection +305.*,allowed,Use Proxy,,Redirection +306,allowed,Reserved,RFC2616,Redirection +306.*,allowed,Reserved,,Redirection +307,allowed,Temporary Redirect,RFC2616,Redirection +307.*,allowed,Temporary Redirect,,Redirection +308,allowed,Permanent Redirect,RFC-reschke-http-status-308-07,Redirection +308.*,allowed,Permanent Redirect,,Redirection +400,blocked,Bad Request,RFC2616,Client Error +400.*,blocked,Bad Request,,Client Error +401,blocked,Unauthorized,RFC2616,Client Error +401.*,blocked,Unauthorized,,Client Error +402,blocked,Payment Required,RFC2616,Client Error +402.*,blocked,Payment Required,,Client Error +403,blocked,Forbidden,RFC2616,Client Error +403.*,blocked,Forbidden,,Client Error +404,blocked,Not Found,RFC2616,Client Error +404.*,blocked,Not Found,,Client Error +405,blocked,Method Not Allowed,RFC2616,Client Error +405.*,blocked,Method Not Allowed,,Client Error +406,blocked,Not Acceptable,RFC2616,Client Error +406.*,blocked,Not Acceptable,,Client Error +407,blocked,Proxy Authentication Required,RFC2616,Client Error +407.*,blocked,Proxy Authentication Required,,Client Error +408,blocked,Request Timeout,RFC2616,Client Error +408.*,blocked,Request Timeout,,Client Error +409,blocked,Conflict,RFC2616,Client Error +409.*,blocked,Conflict,,Client Error +410,blocked,Gone,RFC2616,Client Error +410.*,blocked,Gone,,Client Error +411,blocked,Length Required,RFC2616,Client Error +411.*,blocked,Length Required,,Client Error +412,blocked,Precondition Failed,RFC2616,Client Error +412.*,blocked,Precondition Failed,,Client Error +413,blocked,Request Entity Too Large,RFC2616,Client Error +413.*,blocked,Request Entity Too Large,,Client Error +414,blocked,Request-URI Too Long,RFC2616,Client Error +414.*,blocked,Request-URI Too Long,,Client Error +415,blocked,Unsupported Media Type,RFC2616,Client Error +415.*,blocked,Unsupported Media Type,,Client Error +416,blocked,Requested Range Not Satisfiable,RFC2616,Client Error +416.*,blocked,Requested Range Not Satisfiable,,Client Error +417,blocked,Expectation Failed,RFC2616,Client Error +417.*,blocked,Expectation Failed,,Client Error +422,blocked,Unprocessable Entity,RFC4918,Client Error +422.*,blocked,Unprocessable Entity,,Client Error +423,blocked,Locked,RFC4918,Client Error +423.*,blocked,Locked,,Client Error +424,blocked,Failed Dependency,RFC4918,Client Error +424.*,blocked,Failed Dependency,,Client Error +426,blocked,Upgrade Required,RFC2817,Client Error +426.*,blocked,Upgrade Required,,Client Error +428,blocked,Precondition Required,RFC6585,Client Error +428.*,blocked,Precondition Required,,Client Error +429,blocked,Too Many Requests,RFC6585,Client Error +429.*,blocked,Too Many Requests,,Client Error +431,blocked,Request Header Fields Too Large,RFC6585,Client Error +431.*,blocked,Request Header Fields Too Large,,Client Error +500,blocked,Internal Server Error,RFC2616,Server Error +500.*,blocked,Internal Server Error,,Server Error +501,blocked,Not Implemented,RFC2616,Server Error +501.*,blocked,Not Implemented,,Server Error +502,blocked,Bad Gateway,RFC2616,Server Error +502.*,blocked,Bad Gateway,,Server Error +503,blocked,Service Unavailable,RFC2616,Server Error +503.*,blocked,Service Unavailable,,Server Error +504,blocked,Gateway Timeout,RFC2616,Server Error +504.*,blocked,Gateway Timeout,,Server Error +505,blocked,HTTP Version Not Supported,RFC2616,Server Error +505.*,blocked,HTTP Version Not Supported,,Server Error +506,blocked,Variant Also Negotiates (Experimental),RFC2295,Server Error +506.*,blocked,Variant Also Negotiates (Experimental),,Server Error +507,blocked,Insufficient Storage,RFC4918,Server Error +507.*,blocked,Insufficient Storage,,Server Error +508,blocked,Loop Detected,RFC5842,Server Error +508.*,blocked,Loop Detected,,Server Error +510,blocked,Not Extended,RFC2774,Server Error +510.*,blocked,Not Extended,,Server Error +511,blocked,Network Authentication Required,RFC6585,Server Error +511.*,blocked,Network Authentication Required,,Server Error +551,blocked,Option not supported,,Server Error +551.*,blocked,Option not supported,,Server Error +598,blocked,Network Read Timeout Error,,Server Error +598.*,blocked,Network Read Timeout Error,,Server Error +599,blocked,Network Connection Timeout Error,,Server Error +599.*,blocked,Network Connection Timeout Error,,Server Error +unknown,unknown,Unknown,,Server Error \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_http_tld.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_http_tld.csv.default new file mode 100644 index 000000000..07fa670b9 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_http_tld.csv.default @@ -0,0 +1,634 @@ +tld +ac +academy +accountants +actor +ad +ae +aero +af +ag +agency +ai +airforce +al +am +an +ao +aq +ar +archi +arpa +as +asia +associates +at +au +aw +ax +axa +az +ba +bar +bargains +bayern +bb +bd +be +berlin +best +bf +bg +bh +bi +bid +bike +biz +bj +black +blackfriday +blue +bm +bn +bo +boutique +br +bs +bt +build +builders +buzz +bv +bw +by +bz +ca +cab +camera +camp +capital +cards +care +career +careers +cash +cat +catering +cc +cd +center +ceo +cf +cg +ch +cheap +christmas +ci +citic +ck +cl +claims +cleaning +clinic +clothing +club +cm +cn +co +codes +coffee +college +cologne +com +community +company +computer +condos +construction +consulting +contractors +cooking +cool +coop +country +cr +credit +creditcard +cruises +cu +cv +cw +cx +cy +cz +dance +dating +de +democrat +dental +desi +diamonds +digital +directory +discount +dj +dk +dm +dnp +do +domains +dz +ec +edu +education +ee +eg +email +engineering +enterprises +equipment +er +es +estate +et +eu +eus +events +exchange +expert +exposed +fail +farm +feedback +fi +finance +financial +fish +fishing +fitness +fj +fk +flights +florist +fm +fo +foo +foundation +fr +frogans +fund +furniture +futbol +ga +gal +gallery +gb +gd +ge +gf +gg +gh +gi +gift +gl +glass +globo +gm +gmo +gn +gop +gov +gp +gq +gr +graphics +gratis +gripe +gs +gt +gu +guitars +guru +gw +gy +haus +hk +hm +hn +holdings +holiday +horse +house +hr +ht +hu +id +ie +il +im +immobilien +in +industries +info +ink +institute +insure +int +international +investments +io +iq +ir +is +it +je +jetzt +jm +jo +jobs +jp +kaufen +ke +kg +kh +ki +kim +kitchen +kiwi +km +kn +koeln +kp +kr +kred +kw +ky +kz +la +land +lb +lc +lease +li +lighting +limited +limo +link +lk +london +lr +ls +lt +lu +luxury +lv +ly +ma +maison +management +mango +marketing +mc +md +me +media +meet +menu +mg +mh +miami +mil +mk +ml +mm +mn +mo +mobi +moda +moe +monash +moscow +mp +mq +mr +ms +mt +mu +museum +mv +mw +mx +my +mz +na +nagoya +name +nc +ne +net +neustar +nf +ng +ni +ninja +nl +no +np +nr +nu +nyc +nz +okinawa +om +onl +org +pa +paris +partners +parts +pe +pf +pg +ph +photo +photography +photos +pics +pictures +pink +pk +pl +plumbing +pm +pn +post +pr +pro +productions +properties +ps +pt +pub +pw +py +qa +qpon +quebec +re +recipes +red +reisen +ren +rentals +repair +report +rest +reviews +rich +ro +rocks +rodeo +rs +ru +ruhr +rw +ryukyu +sa +saarland +sb +sc +schule +sd +se +services +sexy +sg +sh +shiksha +shoes +si +singles +sj +sk +sl +sm +sn +so +social +sohu +solar +solutions +soy +sr +st +su +supplies +supply +support +surgery +sv +sx +sy +systems +sz +tattoo +tax +tc +td +technology +tel +tf +tg +th +tienda +tips +tj +tk +tl +tm +tn +to +today +tokyo +tools +town +toys +tp +tr +trade +training +travel +tt +tv +tw +tz +ua +ug +uk +university +uno +us +uy +uz +va +vacations +vc +ve +vegas +ventures +vg +vi +viajes +villas +vision +vn +vodka +vote +voting +voto +voyage +vu +wang +watch +webcam +wed +wf +wien +wiki +works +ws +wtc +wtf +xn--3bst00m +集团 +在线 +xn--3ds443g +xn--3e0b707e +한국 +xn--45brj9c +ভারত +公益 +xn--55qw42g +公司 +xn--55qx5d +移动 +xn--6frz82g +我爱你 +xn--6qq986b3xl +xn--80adxhks +москва +қаз +xn--80ao21a +xn--80asehdb +онлайн +сайт +xn--80aswg +xn--90a3ac +срб +орг +xn--c1avg +삼성 +xn--cg4bki +xn--clchc0ea0b2g2a9gcd +சிங்கப்பூர் +xn--czru2d +商城 +дети +xn--d1acj3b +xn--fiq228c5hs +中文网 +中信 +xn--fiq64b +中国 +xn--fiqs8s +xn--fiqz9s +中國 +భారత్ +xn--fpcrj9c3d +ලංකා +xn--fzc2c9e2c +ભારત +xn--gecrj9c +भारत +xn--h2brj9c +xn--i1b6b1a6a2e +संगठन +网络 +xn--io0a7i +укр +xn--j1amh +香港 +xn--j6w193g +台湾 +xn--kprw13d +xn--kpry57d +台灣 +xn--l1acc +мон +الجزائر +xn--lgbbat1ad8j +عمان +xn--mgb9awbf +xn--mgba3a4f16a +ایران +امارات +xn--mgbaam7a8h +xn--mgbab2bd +بازار +xn--mgbayh7gpa +الاردن +بھارت +xn--mgbbh1a71e +المغرب +xn--mgbc0a9azcg +xn--mgberp4a5d4ar +السعودية +مليسيا +xn--mgbx4cd0ab +xn--ngbc5azd +شبكة +xn--nqv7f +机构 +xn--nqv7fs00ema +组织机构 +ไทย +xn--o3cw4h +xn--ogbpf8fl +سورية +xn--p1ai +рф +xn--pgbs0dh +تونس +xn--q9jyb4c +みんな +世界 +xn--rhqv96g +ਭਾਰਤ +xn--s9brj9c +xn--ses554g +网址 +xn--unup4y +游戏 +مصر +xn--wgbh1c +قطر +xn--wgbl6a +இலங்கை +xn--xkc2al3hye2a +இந்தியா +xn--xkc2dl3a5ee0h +xn--yfro4i67o +新加坡 +فلسطين +xn--ygbi2ammx +xn--zfr164b +政务 +xxx +xyz +ye +yokohama +yt +za +zm +zone +zw \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_ids_severities.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_ids_severities.csv.default new file mode 100644 index 000000000..8a8548cac --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_ids_severities.csv.default @@ -0,0 +1,6 @@ +severity +critical +high +medium +low +informational \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_ids_types.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_ids_types.csv.default new file mode 100644 index 000000000..61e389bc6 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_ids_types.csv.default @@ -0,0 +1,5 @@ +ids_type +application +host +network +wireless \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_malware_actions.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_malware_actions.csv.default new file mode 100644 index 000000000..01b408dee --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_malware_actions.csv.default @@ -0,0 +1,4 @@ +action +allowed +blocked +deferred \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_traffic_actions.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_traffic_actions.csv.default new file mode 100644 index 000000000..6a5bc8edc --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_traffic_actions.csv.default @@ -0,0 +1,4 @@ +action +allowed +blocked +teardown \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_transport_protocols.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_transport_protocols.csv.default new file mode 100644 index 000000000..15a583f5f --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_transport_protocols.csv.default @@ -0,0 +1,4 @@ +transport +icmp +tcp +udp \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_update_statii.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_update_statii.csv.default new file mode 100644 index 000000000..0b2aba7c7 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_update_statii.csv.default @@ -0,0 +1,4 @@ +status +installed +"restart required" +available \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_vendor_product_tracker.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_vendor_product_tracker.csv.default new file mode 100644 index 000000000..66826e02c --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_vendor_product_tracker.csv.default @@ -0,0 +1 @@ +model,vendor_product,firstTime,lastTime \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/cim_vuln_severities.csv.default b/deps/apps/Splunk_SA_CIM/lookups/cim_vuln_severities.csv.default new file mode 100644 index 000000000..8a8548cac --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/cim_vuln_severities.csv.default @@ -0,0 +1,6 @@ +severity +critical +high +medium +low +informational \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/splunk_actions.csv b/deps/apps/Splunk_SA_CIM/lookups/splunk_actions.csv new file mode 100644 index 000000000..37e1f9c38 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/splunk_actions.csv @@ -0,0 +1,6 @@ +vendor_action,action,app +add,created, +delete,deleted, +update,modified, +failed,failure,splunk +succeeded,success,splunk \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/splunk_object_category.csv b/deps/apps/Splunk_SA_CIM/lookups/splunk_object_category.csv new file mode 100644 index 000000000..6486cef36 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/splunk_object_category.csv @@ -0,0 +1,3 @@ +vendor_object_category,object_category +0,file +1,directory \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/lookups/splunk_src.csv b/deps/apps/Splunk_SA_CIM/lookups/splunk_src.csv new file mode 100644 index 000000000..92b67a770 --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/lookups/splunk_src.csv @@ -0,0 +1,2 @@ +app,src +splunk,unspecified \ No newline at end of file diff --git a/deps/apps/Splunk_SA_CIM/metadata/default.meta b/deps/apps/Splunk_SA_CIM/metadata/default.meta new file mode 100644 index 000000000..edb1948cc --- /dev/null +++ b/deps/apps/Splunk_SA_CIM/metadata/default.meta @@ -0,0 +1,40 @@ + +[collections/cam_queue] +access = read : [ admin ], write : [ admin ] + +## shared Application-level permissions +[] +access = read : [ * ], write : [ admin ] +export = system + +[savedsearches] +owner = admin + +## Correlation Searches +[correlationsearches] +access = read : [ * ], write : [ * ] + +[governance] +access = read : [ * ], write : [ * ] + +## Managed Configurations +[managed_configurations] +access = read : [ * ], write : [ * ] + + +## Exclude export of custom alert actions +[alert_actions/email] +export = none + + +## ES Investigations. +[es_investigations] +access = read : [ * ], write : [ * ] + +## Sequence Templates +[sequence_templates] +access = read : [ * ], write : [ * ] + +## Analytic Stories +[analyticstories] +access = read : [ * ], write : [ * ] diff --git a/deps/apps/Splunk_SA_CIM/static/appIcon.png b/deps/apps/Splunk_SA_CIM/static/appIcon.png new file mode 100644 index 000000000..8c6ad1862 Binary files /dev/null and b/deps/apps/Splunk_SA_CIM/static/appIcon.png differ diff --git a/deps/apps/Splunk_SA_CIM/static/appIconAlt.png b/deps/apps/Splunk_SA_CIM/static/appIconAlt.png new file mode 100644 index 000000000..743ee28e1 Binary files /dev/null and b/deps/apps/Splunk_SA_CIM/static/appIconAlt.png differ diff --git a/deps/apps/Splunk_SA_CIM/static/appIconAlt_2x.png b/deps/apps/Splunk_SA_CIM/static/appIconAlt_2x.png new file mode 100644 index 000000000..b5a5f7f27 Binary files /dev/null and b/deps/apps/Splunk_SA_CIM/static/appIconAlt_2x.png differ diff --git a/deps/apps/Splunk_SA_CIM/static/appIcon_2x.png b/deps/apps/Splunk_SA_CIM/static/appIcon_2x.png new file mode 100644 index 000000000..f22afb125 Binary files /dev/null and b/deps/apps/Splunk_SA_CIM/static/appIcon_2x.png differ diff --git a/deps/build/addonfactory_test_matrix_splunk b/deps/build/addonfactory_test_matrix_splunk deleted file mode 160000 index 8c9e797ec..000000000 --- a/deps/build/addonfactory_test_matrix_splunk +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 8c9e797ecd2f1133ffde70d65caf47f49f74d0fb diff --git a/deps/build/addonfactory_test_matrix_splunk/.github/workflows/sc4s_matrix.yml b/deps/build/addonfactory_test_matrix_splunk/.github/workflows/sc4s_matrix.yml new file mode 100644 index 000000000..17bd8f58e --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/.github/workflows/sc4s_matrix.yml @@ -0,0 +1,42 @@ +name: Check Package Version +on: + schedule: + - cron: "0 05 * * SUN" + +jobs: + build: + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + os: [ubuntu-latest] + python-version: [3.7] + steps: + - uses: actions/checkout@v2 + with: + submodules: true + - name: Set up OS=${{ matrix.os }}::Python=${{ matrix.python-version }} + uses: actions/setup-python@v1 + with: + python-version: ${{ matrix.python-version }} + - name: Install HUB CLI + run: | + /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)" + test -d ~/.linuxbrew && eval $(~/.linuxbrew/bin/brew shellenv) + test -d /home/linuxbrew/.linuxbrew && eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv) + test -r ~/.bash_profile && echo "eval \$($(brew --prefix)/bin/brew shellenv)" >>~/.bash_profile + echo "eval \$($(brew --prefix)/bin/brew shellenv)" >>~/.profile + brew install hub + - name: Apply Configuration policy + run: | + test -d ~/.linuxbrew && eval $(~/.linuxbrew/bin/brew shellenv) + test -d /home/linuxbrew/.linuxbrew && eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv) + test -r ~/.bash_profile && echo "eval \$($(brew --prefix)/bin/brew shellenv)" >>~/.bash_profile + echo "eval \$($(brew --prefix)/bin/brew shellenv)" >>~/.profile + - name: Update SC4S Version + env: + GITHUB_USER: ${{ secrets.GH_USER }} + GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} + run: | + chmod +x sc4s_sync.sh + ./sc4s_sync.sh diff --git a/deps/build/addonfactory_test_matrix_splunk/.github/workflows/splunk_matrix.yml b/deps/build/addonfactory_test_matrix_splunk/.github/workflows/splunk_matrix.yml new file mode 100644 index 000000000..ff5e48775 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/.github/workflows/splunk_matrix.yml @@ -0,0 +1,42 @@ +name: Check Package Version +on: + schedule: + - cron: "0 03 * * SUN" + +jobs: + build: + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + os: [ubuntu-latest] + python-version: [3.7] + steps: + - uses: actions/checkout@v2 + with: + submodules: true + - name: Set up OS=${{ matrix.os }}::Python=${{ matrix.python-version }} + uses: actions/setup-python@v1 + with: + python-version: ${{ matrix.python-version }} + - name: Install HUB CLI + run: | + /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)" + test -d ~/.linuxbrew && eval $(~/.linuxbrew/bin/brew shellenv) + test -d /home/linuxbrew/.linuxbrew && eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv) + test -r ~/.bash_profile && echo "eval \$($(brew --prefix)/bin/brew shellenv)" >>~/.bash_profile + echo "eval \$($(brew --prefix)/bin/brew shellenv)" >>~/.profile + brew install hub + - name: Apply Configuration policy + run: | + test -d ~/.linuxbrew && eval $(~/.linuxbrew/bin/brew shellenv) + test -d /home/linuxbrew/.linuxbrew && eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv) + test -r ~/.bash_profile && echo "eval \$($(brew --prefix)/bin/brew shellenv)" >>~/.bash_profile + echo "eval \$($(brew --prefix)/bin/brew shellenv)" >>~/.profile + - name: Update Splunk Builds + env: + GITHUB_USER: ${{ secrets.GH_USER }} + GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} + run: | + chmod +x splunk_sync.sh + ./splunk_sync.sh diff --git a/deps/build/addonfactory_test_matrix_splunk/LICENSE b/deps/build/addonfactory_test_matrix_splunk/LICENSE new file mode 100644 index 000000000..261eeb9e9 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/deps/build/addonfactory_test_matrix_splunk/README.md b/deps/build/addonfactory_test_matrix_splunk/README.md new file mode 100644 index 000000000..86ec384b3 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/README.md @@ -0,0 +1,19 @@ +# addonfactory_test_matrix_splunk +This repository is used to control the specific versions of Splunk Docker used in add-on test matrix. + +The format of this repository list a single conf file in the root 'splunk_matrix.conf' with a stanza in the pattern of MAJOR.MINOR and a attribute VERSION=semver + +We have added Gihub Action file which run on schedule configured time for checking new version of SC4S and Splunk released or not and based on that it will run workflow and update the version details directly in master branch. + +``` +SC4S Version +[1] +VERSION=1.51.6 +``` + +``` +Splunk Version +[8.1] +VERSION=8.1.1 +``` +# Additional notes diff --git a/deps/build/addonfactory_test_matrix_splunk/SC4S_matrix.conf b/deps/build/addonfactory_test_matrix_splunk/SC4S_matrix.conf new file mode 100644 index 000000000..f5f39d77b --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/SC4S_matrix.conf @@ -0,0 +1,3 @@ +#SC4S Major versions +[1] +VERSION=1.103.1 diff --git a/deps/build/addonfactory_test_matrix_splunk/packages/all/addon_factory_web/web.conf b/deps/build/addonfactory_test_matrix_splunk/packages/all/addon_factory_web/web.conf new file mode 100644 index 000000000..0234bfc50 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/packages/all/addon_factory_web/web.conf @@ -0,0 +1,2 @@ +[settings] +enableSplunkWebSSL = 1 \ No newline at end of file diff --git a/deps/build/addonfactory_test_matrix_splunk/packages/all/common/addonfactory_indexes/default/indexes.conf b/deps/build/addonfactory_test_matrix_splunk/packages/all/common/addonfactory_indexes/default/indexes.conf new file mode 100644 index 000000000..3eb4820c1 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/packages/all/common/addonfactory_indexes/default/indexes.conf @@ -0,0 +1,150 @@ +[default] +lastChanceIndex = lastchance + +[syslogng_metrics] +datatype=metric +homePath = $SPLUNK_DB/syslogng_metrics/db +coldPath = $SPLUNK_DB/syslogng_metrics/colddb +thawedPath = $SPLUNK_DB/syslogng_metrics/thaweddb + +[comms] +homePath = $SPLUNK_DB/comms/db +coldPath = $SPLUNK_DB/comms/colddb +thawedPath = $SPLUNK_DB/comms/thaweddb + +[email] +homePath = $SPLUNK_DB/email/db +coldPath = $SPLUNK_DB/email/colddb +thawedPath = $SPLUNK_DB/email/thaweddb + +[epav] +homePath = $SPLUNK_DB/epav/db +coldPath = $SPLUNK_DB/epav/colddb +thawedPath = $SPLUNK_DB/epav/thaweddb + +[fireeye] +homePath = $SPLUNK_DB/fireeye/db +coldPath = $SPLUNK_DB/fireeye/colddb +thawedPath = $SPLUNK_DB/fireeye/thaweddb + +[epintel] +homePath = $SPLUNK_DB/epintel/db +coldPath = $SPLUNK_DB/epintel/colddb +thawedPath = $SPLUNK_DB/epintel/thaweddb + +[em_logs] +homePath = $SPLUNK_DB/em_logs/db +coldPath = $SPLUNK_DB/em_logs/colddb +thawedPath = $SPLUNK_DB/em_logs/thaweddb + +[em_meta] +homePath = $SPLUNK_DB/em_meta/db +coldPath = $SPLUNK_DB/em_meta/colddb +thawedPath = $SPLUNK_DB/em_meta/thaweddb + +[em_metrics] +datatype=metric +homePath = $SPLUNK_DB/em_metrics/db +coldPath = $SPLUNK_DB/em_metrics/colddb +thawedPath = $SPLUNK_DB/em_metrics/thaweddb + +[syslogng_fallback] +homePath = $SPLUNK_DB/syslogng_fallback/db +coldPath = $SPLUNK_DB/syslogng_fallback/colddb +thawedPath = $SPLUNK_DB/syslogng_fallback/thaweddb + + +[test] +homePath = $SPLUNK_DB/test/db +coldPath = $SPLUNK_DB/test/colddb +thawedPath = $SPLUNK_DB/test/thaweddb + +[test2] +homePath = $SPLUNK_DB/test2/db +coldPath = $SPLUNK_DB/test2/colddb +thawedPath = $SPLUNK_DB/test2/thaweddb + +[infraops] +homePath = $SPLUNK_DB/infraops/db +coldPath = $SPLUNK_DB/infraops/colddb +thawedPath = $SPLUNK_DB/infraops/thaweddb + +[osnix] +homePath = $SPLUNK_DB/osnix/db +coldPath = $SPLUNK_DB/osnix/colddb +thawedPath = $SPLUNK_DB/osnix/thaweddb + +[oswin] +homePath = $SPLUNK_DB/oswin/db +coldPath = $SPLUNK_DB/oswin/colddb +thawedPath = $SPLUNK_DB/oswin/thaweddb + +[oswinsec] +homePath = $SPLUNK_DB/oswinsec/db +coldPath = $SPLUNK_DB/oswinsec/colddb +thawedPath = $SPLUNK_DB/oswinsec/thaweddb + +[netauth] +homePath = $SPLUNK_DB/netauth/db +coldPath = $SPLUNK_DB/netauth/colddb +thawedPath = $SPLUNK_DB/netauth/thaweddb + +[netdlp] +homePath = $SPLUNK_DB/netdlp/db +coldPath = $SPLUNK_DB/netdlp/colddb +thawedPath = $SPLUNK_DB/netdlp/thaweddb + +[netdns] +homePath = $SPLUNK_DB/netdns/db +coldPath = $SPLUNK_DB/netdns/colddb +thawedPath = $SPLUNK_DB/netdns/thaweddb + +[netfw] +homePath = $SPLUNK_DB/netfw/db +coldPath = $SPLUNK_DB/netfw/colddb +thawedPath = $SPLUNK_DB/netfw/thaweddb + +[netids] +homePath = $SPLUNK_DB/netids/db +coldPath = $SPLUNK_DB/netids/colddb +thawedPath = $SPLUNK_DB/netids/thaweddb + +[netipam] +homePath = $SPLUNK_DB/netipam/db +coldPath = $SPLUNK_DB/netipam/colddb +thawedPath = $SPLUNK_DB/netipam/thaweddb + +[netlb] +homePath = $SPLUNK_DB/netlb/db +coldPath = $SPLUNK_DB/netlb/colddb +thawedPath = $SPLUNK_DB/netlb/thaweddb + +[netops] +homePath = $SPLUNK_DB/netops/db +coldPath = $SPLUNK_DB/netops/colddb +thawedPath = $SPLUNK_DB/netops/thaweddb + +[netproxy] +homePath = $SPLUNK_DB/netproxy/db +coldPath = $SPLUNK_DB/netproxy/colddb +thawedPath = $SPLUNK_DB/netproxy/thaweddb + +[netwaf] +homePath = $SPLUNK_DB/netwaf/db +coldPath = $SPLUNK_DB/netwaf/colddb +thawedPath = $SPLUNK_DB/netwaf/thaweddb + +[print] +homePath = $SPLUNK_DB/print/db +coldPath = $SPLUNK_DB/print/colddb +thawedPath = $SPLUNK_DB/print/thaweddb + +[gitops] +homePath = $SPLUNK_DB/gitops/db +coldPath = $SPLUNK_DB/gitops/colddb +thawedPath = $SPLUNK_DB/gitops/thaweddb + +[lastchance] +homePath = $SPLUNK_DB/lastchance/db +coldPath = $SPLUNK_DB/lastchance/colddb +thawedPath = $SPLUNK_DB/lastchance/thaweddb diff --git a/deps/build/addonfactory_test_matrix_splunk/packages/all/common/disable_popups/default/user-prefs.conf b/deps/build/addonfactory_test_matrix_splunk/packages/all/common/disable_popups/default/user-prefs.conf new file mode 100644 index 000000000..9c3cfdd12 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/packages/all/common/disable_popups/default/user-prefs.conf @@ -0,0 +1,8 @@ +[general] +render_version_messages = 0 +hideInstrumentationOptInModal = 1 +dismissedInstrumentationOptInVersion = 2 + +[general_default] +hideInstrumentationOptInModal = 1 +showWhatsNew = 0 diff --git a/deps/build/addonfactory_test_matrix_splunk/packages/all/sh/addonfactor_disable_popup/default/user-prefs.conf b/deps/build/addonfactory_test_matrix_splunk/packages/all/sh/addonfactor_disable_popup/default/user-prefs.conf new file mode 100644 index 000000000..9c3cfdd12 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/packages/all/sh/addonfactor_disable_popup/default/user-prefs.conf @@ -0,0 +1,8 @@ +[general] +render_version_messages = 0 +hideInstrumentationOptInModal = 1 +dismissedInstrumentationOptInVersion = 2 + +[general_default] +hideInstrumentationOptInModal = 1 +showWhatsNew = 0 diff --git a/deps/build/addonfactory_test_matrix_splunk/packages/all/sh/addonfactory_auth/default/authorize.conf b/deps/build/addonfactory_test_matrix_splunk/packages/all/sh/addonfactory_auth/default/authorize.conf new file mode 100644 index 000000000..7df4b6058 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/packages/all/sh/addonfactory_auth/default/authorize.conf @@ -0,0 +1,5 @@ +[role_admin] +grantableRoles = admin +importRoles = can_delete;power;user +srchIndexesDefault = main +srchMaxTime = 8640000 \ No newline at end of file diff --git a/deps/build/addonfactory_test_matrix_splunk/requirements.txt b/deps/build/addonfactory_test_matrix_splunk/requirements.txt new file mode 100644 index 000000000..5411eed88 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/requirements.txt @@ -0,0 +1,3 @@ +requests +packaging +configparser diff --git a/deps/build/addonfactory_test_matrix_splunk/sc4s_sync.sh b/deps/build/addonfactory_test_matrix_splunk/sc4s_sync.sh new file mode 100644 index 000000000..47e64f4a3 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/sc4s_sync.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# echo all the commands +set -x + +REPOORG=splunk +if [[ $GITHUB_USER && ${GITHUB_USER-x} ]] +then + echo "GITHUB_USER Found" +else + echo "GITHUB_USER Not Found" + exit 1 +fi +if [[ $GITHUB_TOKEN && ${GITHUB_TOKEN-x} ]] +then + echo "GITHUB_TOKEN Found" +else + echo "GITHUB_TOKEN Not Found" + exit 1 +fi + +current_tag=$(cat SC4S_matrix.conf | grep -oP 'VERSION\s*=\s*([0-9\.]+)') +echo $current_tag +re='VERSION\s*=\s*([0-9.]+)' +if [[ $current_tag =~ $re ]] +then + current_tag_value=${BASH_REMATCH[1]} +fi +echo $current_tag_value + +latest_tag=$(curl -s https://api.github.com/repos/splunk/splunk-connect-for-syslog/releases/latest | grep "tag_name" | cut -d : -f 2) +new_value=$(echo $latest_tag | rev | cut -c3- | rev) +new_value=$(echo $new_value | cut -c3-) +echo $new_value + +pip install pip --upgrade +python -m pip install packaging + +var=`python -c "from packaging import version; print('True' if(version.parse(str('$new_value')) > version.parse(str('$current_tag'))) else 'False')"` +echo $var + +if [ "$var" = "True" ]; +then + + git config --global user.email "addonfactory@splunk.com" + git config --global user.name "Addon Factory template" + BRANCH=test/sc4s-version-update + git checkout -b $BRANCH + sed -i "s/$current_tag_value/$new_value/g" SC4S_matrix.conf + git diff + git add SC4S_matrix.conf + git status + git commit -m "test: new sc4s version $new_value update" + git push -f --set-upstream origin $BRANCH + git log | head + git checkout master + git merge test/sc4s-version-update + git push origin master + git branch -d test/sc4s-version-update +else + echo "SC4S version update not required" +fi diff --git a/deps/build/addonfactory_test_matrix_splunk/splunk_matrix.conf b/deps/build/addonfactory_test_matrix_splunk/splunk_matrix.conf new file mode 100644 index 000000000..9e1364ae6 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/splunk_matrix.conf @@ -0,0 +1,53 @@ +[GENERAL] +LATEST = 9.0 +OLDEST = 8.1 + +[9.0] +VERSION = 9.0.1 +BUILD = 82c987350fde +SUPPORTED = 2024-06-14 +PYTHON3 = true +PYTHON2 = false +SWC = true +METRICS_MULTI = true +INPUT_LOOKUP = true + +[8.2] +VERSION = 8.2.1 +BUILD = ddff1c41e5cf +SUPPORTED = 2023-05-12 +PYTHON3 = true +PYTHON2 = true +METRICS_MULTI = true + +[8.1] +VERSION = 8.1.4 +BUILD = 17f862b42a7c +SUPPORTED = 2022-10-19 +PYTHON3 = true +PYTHON2 = true +METRICS_MULTI = true + +[8.0] +VERSION = 8.0.9 +BUILD = 153839c8b72f +SUPPORTED = 2021-10-22 +PYTHON3 = true +PYTHON2 = true +METRICS_MULTI = true + +[7.3] +VERSION = 7.3.9 +BUILD = 39a78bf1bc5b +SUPPORTED = 2021-10-22 +PYTHON3 = false +PYTHON2 = true +METRICS_MULTI = false + +[7.2] +VERSION = 7.2.10.1 +BUILD = 40b15aa1f501 +SUPPORTED = 2021-04-30 +PYTHON3 = false +PYTHON2 = true +METRICS_MULTI = false diff --git a/deps/build/addonfactory_test_matrix_splunk/splunk_matrix_update.py b/deps/build/addonfactory_test_matrix_splunk/splunk_matrix_update.py new file mode 100644 index 000000000..1c913f7cb --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/splunk_matrix_update.py @@ -0,0 +1,116 @@ +import requests +import re +import configparser +import json +import os +from packaging import version + + +def get_token(): + splunk_token_url = "https://auth.docker.io/token?service=registry.docker.io&scope=repository:splunk/splunk:pull" + response = requests.get(splunk_token_url) + response_json = json.loads(response.text) + token = response_json["token"] + return token + + +def get_images_list(token): + headers = {"Authorization": "Bearer {}".format(token)} + splunk_image_list_url = "https://registry.hub.docker.com/v2/splunk/splunk/tags/list" + response = requests.get(splunk_image_list_url, headers=headers) + response_json = json.loads(response.text) + return response_json["tags"] + + +def get_latest_image(stanza, images): + stanza = stanza.split(".") + stanza = "\.".join(stanza) + regex_image = r"'{}\.\d+'|'{}\.\d+\.\d+'".format(stanza, stanza) + filtered_images = re.findall(regex_image, str(images)) + if filtered_images: + for i in range(len(filtered_images)): + filtered_images[i] = filtered_images[i].replace("'", "") + filtered_images.sort(key=lambda s: list(map(int, s.split(".")))) + return filtered_images[-1] + + +def check_image_version(latest_image, stanza_image): + if version.parse(latest_image) > version.parse(stanza_image): + return True + else: + return False + + +def filter_image_list(images_list): + regex_filter_images = r"\'[0-9a-z]{12}\'" + filter_images = re.findall(regex_filter_images, str(images_list)) + if filter_images: + for i in range(len(filter_images)): + filter_images[i] = filter_images[i].replace("'", "") + return filter_images + + +def get_image_digest(token, image): + headers = { + "Authorization": "Bearer {}".format(token), + "Accept": "application/vnd.docker.distribution.manifest.v2+json", + } + image_digest_url = ( + "https://registry.hub.docker.com/v2/splunk/splunk/manifests/{}".format(image) + ) + response = requests.get(image_digest_url, headers=headers) + if response.headers["Docker-Content-Digest"]: + return response.headers["Docker-Content-Digest"] + else: + token = get_token() + headers = { + "Authorization": "Bearer {}".format(token), + "Accept": "application/vnd.docker.distribution.manifest.v2+json", + } + image_digest_url = ( + "https://registry.hub.docker.com/v2/splunk/splunk/manifests/{}".format( + image + ) + ) + response = requests.get(image_digest_url, headers=headers) + return response.headers["Docker-Content-Digest"] + + +def get_build_number(token, filter_images, latest_image_digest): + for image in filter_images: + if get_image_digest(token, image) == latest_image_digest: + return image + + +def update_splunk_version(token): + if os.path.isfile("splunk_matrix.conf"): + config = configparser.ConfigParser() + config.optionxform = str + config.read("splunk_matrix.conf") + update_file = False + images_list = get_images_list(token) + filter_images = filter_image_list(images_list) + for stanza in config.sections(): + latest_image_version = get_latest_image(stanza, images_list) + stanza_image_version = config.get(stanza, "VERSION") + + if check_image_version(latest_image_version, stanza_image_version): + config.set(stanza, "VERSION", latest_image_version) + latest_image_digest = get_image_digest(token, latest_image_version) + build_number = get_build_number( + token, filter_images, latest_image_digest + ) + config.set(stanza, "BUILD", build_number) + update_file = True + + if update_file: + with open("splunk_matrix.conf", "w") as configfile: + config.write(configfile) + return "True" + return "False" + + +if __name__ == "__main__": + token = get_token() + update_file = update_splunk_version(token) + print(update_file) diff --git a/deps/build/addonfactory_test_matrix_splunk/splunk_sync.sh b/deps/build/addonfactory_test_matrix_splunk/splunk_sync.sh new file mode 100755 index 000000000..e00106d74 --- /dev/null +++ b/deps/build/addonfactory_test_matrix_splunk/splunk_sync.sh @@ -0,0 +1,44 @@ +#!/bin/bash +# echo all the commands +set -x + +REPOORG=splunk +if [[ $GITHUB_USER && ${GITHUB_USER-x} ]] +then + echo "GITHUB_USER Found" +else + echo "GITHUB_USER Not Found" + exit 1 +fi +if [[ $GITHUB_TOKEN && ${GITHUB_TOKEN-x} ]] +then + echo "GITHUB_TOKEN Found" +else + echo "GITHUB_TOKEN Not Found" + exit 1 +fi + +pip install pip --upgrade +python -m pip install -r requirements.txt +splunk_version=$(python splunk_matrix_update.py) +echo $splunk_version + +if [ "$splunk_version" = "True" ]; +then + + git config --global user.email "addonfactory@splunk.com" + git config --global user.name "Addon Factory template" + BRANCH=test/splunk-version-update + git checkout -b $BRANCH + git diff + git add . + git status + git commit -m "test: splunk build update" + git push -f --set-upstream origin $BRANCH + git checkout master + git merge test/splunk-version-update + git push origin master + git branch -d test/splunk-version-update +else + echo "Splunk build update not required" +fi diff --git a/pytest_splunk_addon/app_test_generator.py b/pytest_splunk_addon/app_test_generator.py index a4f9c8e56..e4a25cd0c 100644 --- a/pytest_splunk_addon/app_test_generator.py +++ b/pytest_splunk_addon/app_test_generator.py @@ -45,13 +45,16 @@ class AppTestGenerator(object): def __init__(self, pytest_config): self.pytest_config = pytest_config self.seen_tests = set() + self.ingest_with_uuid = self.pytest_config.getoption("ingest_with_uuid") + self.config_path = self.pytest_config.getoption("splunk_data_generator") + self.store_events = self.pytest_config.getoption("store_events") - store_events = self.pytest_config.getoption("store_events") - config_path = self.pytest_config.getoption("splunk_data_generator") sample_generator = SampleXdistGenerator( - self.pytest_config.getoption("splunk_app"), config_path + self.pytest_config.getoption("splunk_app"), + self.ingest_with_uuid, + self.config_path, ) - store_sample = sample_generator.get_samples(store_events) + store_sample = sample_generator.get_samples(self.store_events) self.tokenized_events = store_sample.get("tokenized_events") LOGGER.debug("Initializing FieldTestGenerator to generate the test cases") self.fieldtest_generator = FieldTestGenerator( @@ -71,6 +74,38 @@ def __init__(self, pytest_config): ) self.indextime_test_generator = IndexTimeTestGenerator() + def _generate_indextime_tests(self, fixture): + """ + Generate index time tests based on the fixture type. + + Args: + fixture (str): The fixture name containing the test type + + Returns: + list: List of pytest parameters for the specified test type + """ + app_path = self.pytest_config.getoption("splunk_app") + config_path = self.pytest_config.getoption("splunk_data_generator") + + if "key_fields" in fixture: + test_type = "key_fields" + elif "_time" in fixture: + test_type = "_time" + elif "line_breaker" in fixture: + test_type = "line_breaker" + else: + return [] + + return list( + self.indextime_test_generator.generate_tests( + self.store_events, + app_path=app_path, + config_path=config_path, + test_type=test_type, + ingest_with_uuid=self.ingest_with_uuid, + ) + ) + def generate_tests(self, fixture): """ Generate the test cases based on the fixture provided @@ -100,47 +135,8 @@ def generate_tests(self, fixture): self.cim_test_generator.generate_tests(fixture), fixture, ) - elif fixture.startswith("splunk_indextime"): - # TODO: What should be the id of the test case? - # Sourcetype + Host + Key field + _count - - pytest_params = None - - store_events = self.pytest_config.getoption("store_events") - app_path = self.pytest_config.getoption("splunk_app") - config_path = self.pytest_config.getoption("splunk_data_generator") - - if "key_fields" in fixture: - pytest_params = list( - self.indextime_test_generator.generate_tests( - store_events, - app_path=app_path, - config_path=config_path, - test_type="key_fields", - ) - ) - - elif "_time" in fixture: - pytest_params = list( - self.indextime_test_generator.generate_tests( - store_events, - app_path=app_path, - config_path=config_path, - test_type="_time", - ) - ) - - elif "line_breaker" in fixture: - pytest_params = list( - self.indextime_test_generator.generate_tests( - store_events, - app_path=app_path, - config_path=config_path, - test_type="line_breaker", - ) - ) - + pytest_params = self._generate_indextime_tests(fixture) yield from sorted(pytest_params, key=lambda param: param.id) def dedup_tests(self, test_list, fixture): diff --git a/pytest_splunk_addon/event_ingestors/hec_event_ingestor.py b/pytest_splunk_addon/event_ingestors/hec_event_ingestor.py index bc806822f..d33494ec0 100644 --- a/pytest_splunk_addon/event_ingestors/hec_event_ingestor.py +++ b/pytest_splunk_addon/event_ingestors/hec_event_ingestor.py @@ -14,7 +14,6 @@ # limitations under the License. # import json - from .base_event_ingestor import EventIngestor import requests from time import time, mktime @@ -86,13 +85,14 @@ def ingest(self, events, thread_count): """ data = list() for event in events: - event_dict = { "sourcetype": event.metadata.get("sourcetype", "pytest_splunk_addon"), "source": event.metadata.get("source", "pytest_splunk_addon:hec:event"), "event": event.event, "index": event.metadata.get("index", "main"), } + if event.metadata.get("ingest_with_uuid"): + event_dict["fields"] = {"unique_identifier": event.unique_identifier} if event.metadata.get("host_type") in ("plugin", None): host = event.metadata.get("host") diff --git a/pytest_splunk_addon/event_ingestors/ingestor_helper.py b/pytest_splunk_addon/event_ingestors/ingestor_helper.py index c73e13fc9..56a7f7d01 100644 --- a/pytest_splunk_addon/event_ingestors/ingestor_helper.py +++ b/pytest_splunk_addon/event_ingestors/ingestor_helper.py @@ -95,7 +95,9 @@ def ingest_events( thread_count (int): number of threads to use for ingestion store_events (bool): Boolean param for generating json files with tokenised events """ - sample_generator = SampleXdistGenerator(addon_path, config_path) + sample_generator = SampleXdistGenerator( + addon_path, ingest_meta_data["ingest_with_uuid"], config_path + ) store_sample = sample_generator.get_samples(store_events) tokenized_events = store_sample.get("tokenized_events") ingestor_dict = cls.get_consolidated_events(tokenized_events) diff --git a/pytest_splunk_addon/fields_tests/test_generator.py b/pytest_splunk_addon/fields_tests/test_generator.py index 273ae192c..e842af52f 100644 --- a/pytest_splunk_addon/fields_tests/test_generator.py +++ b/pytest_splunk_addon/fields_tests/test_generator.py @@ -190,11 +190,14 @@ def generate_requirements_datamodels_tests(self): datamodel.replace(" ", "_").replace(":", "_") for datamodel in datamodels ] + sample_event = { + "datamodels": datamodels, + "stanza": escaped_event, + } + if event.metadata.get("ingest_with_uuid"): + sample_event["unique_identifier"] = event.unique_identifier yield pytest.param( - { - "datamodels": datamodels, - "stanza": escaped_event, - }, + sample_event, id=f"{'-'.join(datamodels)}::sample_name::{event.sample_name}::host::{event.metadata.get('host')}", ) @@ -246,9 +249,8 @@ def generate_requirements_tests(self): escaped_event = xml_event_parser.escape_char_event(stripped_event) exceptions = event.requirement_test_data.get("exceptions", {}) - metadata = event.metadata modinput_params = { - "sourcetype": metadata.get("sourcetype_to_search"), + "sourcetype": event.metadata.get("sourcetype_to_search"), } cim_fields = event.requirement_test_data.get("cim_fields", {}) @@ -261,12 +263,17 @@ def generate_requirements_tests(self): for field, value in requirement_fields.items() if field not in exceptions } + sample_event = { + "escaped_event": escaped_event, + "fields": requirement_fields, + "modinput_params": modinput_params, + } + + if event.metadata.get("ingest_with_uuid"): + sample_event["unique_identifier"] = event.unique_identifier + yield pytest.param( - { - "escaped_event": escaped_event, - "fields": requirement_fields, - "modinput_params": modinput_params, - }, + sample_event, id=f"sample_name::{event.sample_name}::host::{event.metadata.get('host')}", ) diff --git a/pytest_splunk_addon/fields_tests/test_templates.py b/pytest_splunk_addon/fields_tests/test_templates.py index fde16489c..2621ae3a5 100644 --- a/pytest_splunk_addon/fields_tests/test_templates.py +++ b/pytest_splunk_addon/fields_tests/test_templates.py @@ -162,15 +162,18 @@ def test_requirements_fields( """ # Search Query - record_property( - "stanza_name", splunk_searchtime_fields_requirements["escaped_event"] + unique_identifier = splunk_searchtime_fields_requirements.get( + "unique_identifier" ) + escaped_event = splunk_searchtime_fields_requirements.get("escaped_event") + event_identifier = unique_identifier or escaped_event + + record_property("Event_with", event_identifier) record_property("fields", splunk_searchtime_fields_requirements["fields"]) record_property( "modinput_params", splunk_searchtime_fields_requirements["modinput_params"] ) - escaped_event = splunk_searchtime_fields_requirements["escaped_event"] fields = splunk_searchtime_fields_requirements["fields"] modinput_params = splunk_searchtime_fields_requirements["modinput_params"] @@ -185,7 +188,14 @@ def test_requirements_fields( if param_value is not None: basic_search += f" {param}={param_value}" - search = f"search {index_list} {basic_search} {escaped_event} | fields *" + if unique_identifier: + selector = f'unique_identifier="{unique_identifier}"' + elif escaped_event: + selector = escaped_event + else: + selector = "" + + search = f"search {index_list} {basic_search} {selector} | fields *" self.logger.info(f"Executing the search query: {search}") @@ -222,11 +232,15 @@ def test_requirements_fields( if not wrong_value_fields == {}: self.logger.error("Wrong field values:\n" + wrong_values_table) - assert wrong_value_fields == {}, ( + error_message = ( f"\nNot all required fields have correct values or some fields are missing in Splunk. Wrong field values:\n{wrong_values_table}" f"{format_search_query_log(search)}" ) + error_message += f"Test failed for event: {event_identifier}\n" + + assert wrong_value_fields == {}, error_message + @pytest.mark.splunk_searchtime_fields @pytest.mark.splunk_searchtime_fields_negative def test_props_fields_no_dash_not_empty( @@ -392,13 +406,10 @@ def test_datamodels( record_property (fixture): Document facts of test cases to provide more info in the test failure reports. caplog (fixture): fixture to capture logs. """ - esacaped_event = splunk_searchtime_fields_datamodels["stanza"] + escaped_event = splunk_searchtime_fields_datamodels["stanza"] datamodels = splunk_searchtime_fields_datamodels["datamodels"] - self.logger.info( - f"Testing for tag {datamodels} with tag_query {esacaped_event}" - ) - record_property("Event_with", esacaped_event) + record_property("Event_with", escaped_event) record_property("datamodels", datamodels) index_list = ( @@ -406,7 +417,21 @@ def test_datamodels( + " OR index=".join(splunk_search_util.search_index.split(",")) + ")" ) - search = f"search {index_list} {esacaped_event} | fields *" + + if splunk_searchtime_fields_datamodels.get("unique_identifier"): + unique_identifier = splunk_searchtime_fields_datamodels["unique_identifier"] + record_property("Event_with", unique_identifier) + + self.logger.info( + f'Testing for tag {datamodels} with unique_identifier="{unique_identifier}"' + ) + + search = f'search {index_list} unique_identifier="{unique_identifier}" | fields *' + else: + self.logger.info( + f"Testing for tag {datamodels} with tag_query {escaped_event}" + ) + search = f"search {index_list} {escaped_event} | fields *" self.logger.info(f"Search: {search}") @@ -465,9 +490,12 @@ def test_datamodels( ], ) - assert ( - missing_datamodels == [] and wrong_datamodels == [] - ), f"Incorrect datamodels found:\n{exc_message}" + error_message = f"Incorrect datamodels found:\n{exc_message}" + + if splunk_searchtime_fields_datamodels.get("unique_identifier"): + error_message += f"\nTest failed for event: {escaped_event}\n" + + assert missing_datamodels == [] and wrong_datamodels == [], error_message @pytest.mark.splunk_searchtime_fields @pytest.mark.splunk_searchtime_fields_eventtypes diff --git a/pytest_splunk_addon/index_tests/test_generator.py b/pytest_splunk_addon/index_tests/test_generator.py index 9f20243d8..5d200a45d 100644 --- a/pytest_splunk_addon/index_tests/test_generator.py +++ b/pytest_splunk_addon/index_tests/test_generator.py @@ -32,7 +32,9 @@ class IndexTimeTestGenerator(object): for the Add-on. """ - def generate_tests(self, store_events, app_path, config_path, test_type): + def generate_tests( + self, store_events, app_path, config_path, test_type, ingest_with_uuid=False + ): """ Generates the test cases based on test_type @@ -41,12 +43,13 @@ def generate_tests(self, store_events, app_path, config_path, test_type): app_path (str): Path of the app package config_path (str): Path of package which contains pytest-splunk-addon-data.conf test_type (str): Type of test case + ingest_with_uuid (bool): Whether to ingest events with UUID Yields: pytest.params for the test templates """ - sample_generator = SampleXdistGenerator(app_path, config_path) + sample_generator = SampleXdistGenerator(app_path, ingest_with_uuid, config_path) store_sample = sample_generator.get_samples(store_events) tokenized_events = store_sample.get("tokenized_events") if not store_sample.get("conf_name") == "psa-data-gen": diff --git a/pytest_splunk_addon/plugin.py b/pytest_splunk_addon/plugin.py index 8236286f2..0493649ac 100644 --- a/pytest_splunk_addon/plugin.py +++ b/pytest_splunk_addon/plugin.py @@ -130,7 +130,8 @@ def pytest_sessionstart(session): app_path = session.config.getoption("splunk_app") config_path = session.config.getoption("splunk_data_generator") store_events = session.config.getoption("store_events") - sample_generator = SampleXdistGenerator(app_path, config_path) + ingest_with_uuid = session.config.getoption("ingest_with_uuid") + sample_generator = SampleXdistGenerator(app_path, ingest_with_uuid, config_path) sample_generator.get_samples(store_events) if session.config.getoption("splunk_app", None): test_generator = AppTestGenerator(session.config) diff --git a/pytest_splunk_addon/sample_generation/pytest_splunk_addon_data_parser.py b/pytest_splunk_addon/sample_generation/pytest_splunk_addon_data_parser.py index 381b234f4..a05658b16 100644 --- a/pytest_splunk_addon/sample_generation/pytest_splunk_addon_data_parser.py +++ b/pytest_splunk_addon/sample_generation/pytest_splunk_addon_data_parser.py @@ -40,12 +40,13 @@ class PytestSplunkAddonDataParser: conf_name = " " - def __init__(self, addon_path: str, config_path: str): + def __init__(self, addon_path: str, config_path: str, ingest_with_uuid: str): self._conf_parser = conf_parser.TABConfigParser() self.config_path = config_path self._psa_data = None self.addon_path = addon_path self.match_stanzas = set() + self.ingest_with_uuid = ingest_with_uuid self._path_to_samples = self._get_path_to_samples() def _get_path_to_samples(self): @@ -106,7 +107,9 @@ def get_sample_stanzas(self): results = [] for sample_name, stanza_params in sorted(_psa_data.items()): sample_path = os.path.join(self._path_to_samples, sample_name) - results.append(SampleStanza(sample_path, stanza_params)) + results.append( + SampleStanza(sample_path, stanza_params, self.ingest_with_uuid) + ) return results def _get_psa_data_stanzas(self): diff --git a/pytest_splunk_addon/sample_generation/sample_generator.py b/pytest_splunk_addon/sample_generation/sample_generator.py index bb5113957..90d3b238f 100644 --- a/pytest_splunk_addon/sample_generation/sample_generator.py +++ b/pytest_splunk_addon/sample_generation/sample_generator.py @@ -33,10 +33,11 @@ class SampleGenerator(object): sample_stanzas = [] conf_name = " " - def __init__(self, addon_path, config_path=None, process_count=4): + def __init__(self, addon_path, ingest_with_uuid, config_path=None, process_count=4): self.addon_path = addon_path self.process_count = process_count self.config_path = config_path + self.ingest_with_uuid = ingest_with_uuid def get_samples(self): """ @@ -44,7 +45,9 @@ def get_samples(self): """ if not SampleGenerator.sample_stanzas: psa_data_parser = PytestSplunkAddonDataParser( - self.addon_path, config_path=self.config_path + addon_path=self.addon_path, + config_path=self.config_path, + ingest_with_uuid=self.ingest_with_uuid, ) sample_stanzas = psa_data_parser.get_sample_stanzas() SampleGenerator.conf_name = psa_data_parser.conf_name diff --git a/pytest_splunk_addon/sample_generation/sample_stanza.py b/pytest_splunk_addon/sample_generation/sample_stanza.py index 0d75aab4e..054e218ea 100644 --- a/pytest_splunk_addon/sample_generation/sample_stanza.py +++ b/pytest_splunk_addon/sample_generation/sample_stanza.py @@ -16,6 +16,7 @@ import os import re import copy +import uuid from . import Rule from . import raise_warning from . import SampleEvent @@ -47,12 +48,13 @@ class SampleStanza(object): psa_data_params (dict): Dictionary representing pytest-splunk-addon-data.conf """ - def __init__(self, sample_path, psa_data_params): + def __init__(self, sample_path, psa_data_params, ingest_with_uuid: bool): self.sample_path = sample_path self.sample_name = os.path.basename(sample_path) self.metadata = self._parse_meta(psa_data_params) self.sample_rules = list(self._parse_rules(psa_data_params, self.sample_path)) self.input_type = self.metadata.get("input_type", "default") + self.metadata["ingest_with_uuid"] = ingest_with_uuid self.host_count = 0 def get_raw_events(self): @@ -102,6 +104,9 @@ def tokenize(self, conf_name): if each_rule: raw_event[event_counter] = each_rule.apply(raw_event[event_counter]) for event in raw_event[event_counter]: + if event.metadata.get("ingest_with_uuid"): + event.unique_identifier = str(uuid.uuid4()) + host_value = event.metadata.get("host") host = token_value(key=host_value, value=host_value) event.update_requirement_test_field("host", "##host##", host) diff --git a/pytest_splunk_addon/sample_generation/sample_xdist_generator.py b/pytest_splunk_addon/sample_generation/sample_xdist_generator.py index 6d1dd1e71..376a7612c 100644 --- a/pytest_splunk_addon/sample_generation/sample_xdist_generator.py +++ b/pytest_splunk_addon/sample_generation/sample_xdist_generator.py @@ -33,10 +33,13 @@ class SampleXdistGenerator: process_count (num): generate {no} process for execution """ - def __init__(self, addon_path, config_path=None, process_count=4): + def __init__( + self, addon_path, ingest_with_uuid: bool, config_path=None, process_count=4 + ): self.addon_path = addon_path self.process_count = process_count self.config_path = config_path + self.ingest_with_uuid = ingest_with_uuid def get_samples(self, store_events): """ @@ -67,7 +70,7 @@ def get_samples(self, store_events): store_sample = pickle.load(file_obj) else: sample_generator = SampleGenerator( - self.addon_path, self.config_path + self.addon_path, self.ingest_with_uuid, self.config_path ) tokenized_events = list(sample_generator.get_samples()) store_sample = { @@ -79,7 +82,9 @@ def get_samples(self, store_events): with open(file_path, "wb") as file_obj: pickle.dump(store_sample, file_obj) else: - sample_generator = SampleGenerator(self.addon_path, self.config_path) + sample_generator = SampleGenerator( + self.addon_path, self.ingest_with_uuid, self.config_path + ) tokenized_events = list(sample_generator.get_samples()) store_sample = { "conf_name": SampleGenerator.conf_name, @@ -125,6 +130,7 @@ def store_events(self, tokenized_events): "sourcetype": each_event.metadata.get("sourcetype"), "timestamp_type": each_event.metadata.get("timestamp_type"), "input_type": each_event.metadata.get("input_type"), + "ingest_with_uuid": self.ingest_with_uuid, "expected_event_count": expected_count, "index": each_event.metadata.get("index", "main"), }, @@ -137,14 +143,21 @@ def store_events(self, tokenized_events): } ], } + if self.ingest_with_uuid: + tokenized_samples_dict[each_event.sample_name]["events"][0][ + "unique_identifier" + ] = each_event.unique_identifier else: + sample_event = { + "event": each_event.event, + "key_fields": each_event.key_fields, + "time_values": each_event.time_values, + "requirement_test_data": each_event.requirement_test_data, + } + if self.ingest_with_uuid: + sample_event["unique_identifier"] = each_event.unique_identifier tokenized_samples_dict[each_event.sample_name]["events"].append( - { - "event": each_event.event, - "key_fields": each_event.key_fields, - "time_values": each_event.time_values, - "requirement_test_data": each_event.requirement_test_data, - } + sample_event ) for sample_name, tokenized_sample in tokenized_samples_dict.items(): diff --git a/pytest_splunk_addon/splunk.py b/pytest_splunk_addon/splunk.py index 5916dda5b..2bc7e36cf 100644 --- a/pytest_splunk_addon/splunk.py +++ b/pytest_splunk_addon/splunk.py @@ -48,6 +48,13 @@ def pytest_addoption(parser): by another process such as a ci/cd pipeline """ group = parser.getgroup("splunk-addon") + group.addoption( + "--use-uuid", + action="store_true", + dest="ingest_with_uuid", + default=False, + help="Use generated UUID for ingesting and searching events. Setting this flag will lead to matching events in search by the ID and not by escaped _raw.", + ) group.addoption( "--splunk-app", @@ -733,6 +740,7 @@ def splunk_ingest_data(request, splunk_hec_uri, sc4s, uf, splunk_events_cleanup) "splunk_hec_uri": splunk_hec_uri[1], "sc4s_host": sc4s[0], # for sc4s "sc4s_port": sc4s[1][514], # for sc4s + "ingest_with_uuid": request.config.getoption("ingest_with_uuid"), } thread_count = int(request.config.getoption("thread_count")) store_events = request.config.getoption("store_events") diff --git a/tests/e2e/constants.py b/tests/e2e/constants.py index 62e657af3..f1f2b488a 100644 --- a/tests/e2e/constants.py +++ b/tests/e2e/constants.py @@ -766,6 +766,8 @@ "*test_splunk_fiction_indextime_broken.py::Test_App::test_requirements_fields[splunk_searchtime_fields_requirements0* SKIPPED*", "*test_splunk_fiction_indextime_broken.py::Test_App::test_cim_fields_recommended[splunk_searchtime_cim_fields_recommended0* SKIPPED*", ] + + TA_REQ_TRANSITION_PASSED = [ "*test_splunk_app_req.py::Test_App::test_events_with_untokenised_values PASSED*", "*test_splunk_app_req.py::Test_App::test_indextime_time[test:data:1::* PASSED*", @@ -1038,3 +1040,323 @@ Defined the TA_cim_addon add-on skipped test case list. """ TA_CIM_MODEL_SKIPPED = [] + + +""" +Define the TA_fiction with uuid add-on passed test case list. +""" +TA_FICTION_UUID_PASSED = [ + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_events_with_untokenised_values PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_splunk_internal_errors PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*/opt/splunk/var/log/splunk/splunkd.log* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*/opt/splunk/var/log/splunk/splunkd.log*::field::component* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields**/opt/splunk/var/log/splunk/splunkd.log** PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields**/opt/splunk/var/log/splunk/splunkd.log*::field::splunk_server* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields**/opt/splunk/var/log/splunk/splunkd_access.log** PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields**/opt/splunk/var/log/splunk/splunkd_access.log*::field::splunk_server* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-one* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractone* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-two* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extracttwoA* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extracttwoB* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-three* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractthree* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-four* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractfourA* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractfourB* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-five* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractfive* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-six* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractsixA* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractsixB* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-seven* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractsevenA* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractsevenB* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::extractsevenC* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-0* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::hotwarmpath_extract* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-eight* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::hotWarmPath_in* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-nine* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::hotWarmPath_IN* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-ten* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::hotWarmPath_In* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-eleven* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::hotWarmPath_iN* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-twelve* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::hotWarmPath_in_opt* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::hotWarmPath_in_other* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-thirteen* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::date_value_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::time_value_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::hotwarmpath_extract_multiple* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::EXTRACT-fiction-fourteen* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::date_only_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::hotwarmpath_extract_two* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::REPORT-fiction-tsc-delim-fields::fiction-tsc-delim-fields* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::day_id* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::event_id* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::end_time* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::start_time* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::REPORT-fiction-tsc-sk-regex-format::fiction-tsc-sk-regex-format* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::component* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::comp* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::REPORT-fiction-tsc-sk-delim-format::fiction-tsc-sk-delim-format* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::server_contact_mode* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::dest* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::REPORT-fiction-tsc-regex-format::fiction-tsc-regex* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::REPORT-fiction-tsc-regex-format::fiction-tsc-regex-format* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::size1* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::size2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::myeval* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliasone* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliastwo* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliasthree* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliasfour* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliasfive* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliassix* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliasseven* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliaseight* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliasnine* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliasten* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliaseleven* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::aliastwelve* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::fiction_context_test1* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::fiction_context_test2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::name* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::fiction_context_test_alternative* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::fiction_context_test_alternative2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::status2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::fiction_context_test_alternative3* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::fiction_context_test_alternative4* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::fiction_context_test_alternative5* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::status.test* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::type* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::fiction_context_test* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::test_name* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::field::status_test* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_AS_and_as_keyword* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_AS_keyword* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_and_AS_keyword2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input_output_multiple* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_input_outputnew_multiple* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_keyword* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_as_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_command_spelling_output3* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_command_spelling_outputnew3* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_input* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_input_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_input_outputnew* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_multiple_outputnew* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_no_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP-test_string_outputfield* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP_test_command_spelling_output1* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUP_test_command_spelling_outputnew* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUPtest_command_spelling_output2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields*splunkd::LOOKUPtest_command_spelling_outputnew2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*/opt/splunk/var/log/splunk/splunkd.log::field::component* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty**/opt/splunk/var/log/splunk/splunkd.log*::field::splunk_server* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty**/opt/splunk/var/log/splunk/splunkd_access.log*::field::splunk_server* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-one* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractone* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-two* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extracttwoA* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extracttwoB* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-three* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractthree* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-four* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractfourA* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractfourB* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-five* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractfive* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-six* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractsixA* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractsixB* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-seven* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractsevenA* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractsevenB* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::extractsevenC* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-0* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::hotwarmpath_extract* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-eight* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::hotWarmPath_in* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-nine* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::hotWarmPath_IN* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-ten* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::hotWarmPath_In* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-eleven* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::hotWarmPath_iN* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-twelve* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::hotWarmPath_in_opt* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::hotWarmPath_in_other* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-thirteen* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::date_value_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::time_value_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::hotwarmpath_extract_multiple* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::EXTRACT-fiction-fourteen* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::date_only_in_hotwarmpath_event* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::hotwarmpath_extract_two* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-fiction-tsc-delim-fields::fiction-tsc-delim-fields* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::day_id* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::event_id* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::end_time* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::start_time* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-fiction-tsc-sk-regex-format::fiction-tsc-sk-regex-format* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::component* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::comp* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-fiction-tsc-sk-delim-format::fiction-tsc-sk-delim-format* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::server_contact_mode* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::dest* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-fiction-tsc-regex-format::fiction-tsc-regex* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::REPORT-fiction-tsc-regex-format::fiction-tsc-regex-format* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::size1* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::size2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::myeval* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliasone* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliastwo* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliasthree* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliasfour* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliasfive* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliassix* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliasseven* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliaseight* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliasnine* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliasten* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliaseleven* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::aliastwelve* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::fiction_context_test1* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::fiction_context_test2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::name* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::fiction_context_test_alternative* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::fiction_context_test_alternative2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::status2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::fiction_context_test_alternative3* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::fiction_context_test_alternative4* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::fiction_context_test_alternative5* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::status.test* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::type* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::fiction_context_test* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::test_name* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::field::status_test* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_AS_and_as_keyword* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_AS_keyword* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_and_AS_keyword2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input_output_multiple* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_input_outputnew_multiple* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_keyword* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_as_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields[splunkd::LOOKUP-test_as_host_keyword* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_command_spelling_output3* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_command_spelling_outputnew3* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_input* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_input_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_input_outputnew* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_multiple_outputnew* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_no_output* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP-test_string_outputfield* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP_test_command_spelling_output1* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUP_test_command_spelling_outputnew* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUPtest_command_spelling_output2* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty*splunkd::LOOKUPtest_command_spelling_outputnew2* PASSED*", + '*test_splunk_app_fiction_with_uuid.py::Test_App::test_tags*eventtype="fiction_for_tags_positive"::tag::tags_positive_event* PASSED*', + '*test_splunk_app_fiction_with_uuid.py::Test_App::test_tags*eventtype="fiction_for_tags_positive"::tag::tags_disabled_event* PASSED*', + '*test_splunk_app_fiction_with_uuid.py::Test_App::test_tags*source="/opt/splunk/var/log/splunk/splunkd.log"::tag::tags_positive_event* PASSED*', + '*test_splunk_app_fiction_with_uuid.py::Test_App::test_tags*source="/opt/splunk/var/log/splunk/splunkd.log"::tag::tags_disabled_event* PASSED*', + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_eventtype*eventtype::fiction_is_splunkd* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_eventtype*eventtype::fiction_for_tags_positive* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_eventtype*eventtype::fiction_is_splunkd-%host%* PASSED*", + '*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields[splunkd::field::"as_host"* PASSED*', + '*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields[splunkd::field::"AS_port"* PASSED*', + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields[splunkd::field::AS_port* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields[splunkd::field::as_host* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[splunkd::LOOKUP-test_as_host_keyword* PASSED*", + '*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[splunkd::field::"as_host"* PASSED*', + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[splunkd::field::as_host* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[splunkd::field::AS_port* PASSED*", + '*test_splunk_app_fiction_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[splunkd::field::"AS_port"* PASSED*', + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_savedsearches*search_earliest_time_latest_time* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_savedsearches*basic_search* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_savedsearches*search_earliest_time* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_savedsearches*search_latest_time* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_savedsearches*empty_search* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_savedsearches*empty_search_latest_time* PASSED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_savedsearches*no_search_no_time* PASSED*", +] + +TA_FICTION_UUID_SKIPPED = [ + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_requirements_fields[splunk_searchtime_fields_requirements0* SKIPPED*", + "*test_splunk_app_fiction_with_uuid.py::Test_App::test_datamodels[splunk_searchtime_fields_datamodels0* SKIPPED*", +] + +TA_REQ_WITH_UUID_TRANSITION_PASSED = [ + "*test_splunk_app_req_with_uuid.py::Test_App::test_events_with_untokenised_values PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_indextime_time[test:data:1::* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_indextime_time[test:data:1::* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_indextime_time[test:data:1::* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_indextime_time[test:data:1::* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_indextime_line_breaker[test:data:1::sample_modinput.xml* PASSED*", + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*', + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*', + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*', + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*', + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*', + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*', + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*', + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*', + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Successful_Authentication* PASSED*', + '*test_splunk_app_req_with_uuid.py::Test_App::test_cim_fields_not_allowed_in_search[eventtype="test_auth"::Authentication* PASSED*', + "*test_splunk_app_req_with_uuid.py::Test_App::test_cim_fields_not_allowed_in_props[searchtime_cim_fields* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_eventtype_mapped_multiple_cim_datamodel[mapped_datamodel_tests* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_cim_fields_recommended[Authentication-*::sample_name::sample_modinput.xml::* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_cim_fields_recommended[Authentication-*::sample_name::sample_modinput.xml::* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_cim_fields_recommended[Authentication-*::sample_name::sample_modinput.xml::* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_splunk_internal_errors PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1* PASSED *", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::access* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::action* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::app* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::dest* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::host* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::ip* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::result* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::src* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::status* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::tester* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::user* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields[test:data:1::field::vendor_product* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1-7* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1-8* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1-9* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_requirements_fields[sample_name::sample_modinput.xml::host::so1* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::access* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::action* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::app* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::dest* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::host* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::ip* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::result* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::src* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::status* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::tester* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::user* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_props_fields_no_dash_not_empty[test:data:1::field::vendor_product* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_datamodels[Authentication::sample_name::sample_modinput.xml::host::so1-7* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_datamodels[Authentication::sample_name::sample_modinput.xml::host::so1-8* PASSED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_datamodels[Authentication::sample_name::sample_modinput.xml::host::so1-9* PASSED*", + '*test_splunk_app_req_with_uuid.py::Test_App::test_tags[eventtype="test_auth"::tag::authentication* PASSED*', + "*test_splunk_app_req_with_uuid.py::Test_App::test_eventtype[eventtype::test_auth* PASSED*", +] + +TA_REQ_WITH_UUID_TRANSITION_SKIPPED = [ + "*test_splunk_app_req_with_uuid.py::Test_App::test_savedsearches[splunk_searchtime_fields_savedsearches0* SKIPPED*", + "*test_splunk_app_req_with_uuid.py::Test_App::test_indextime_key_fields[splunk_indextime_key_fields0* SKIPPED*", +] + +TA_REQ_WITH_UUID_TRANSITION_FAILED = [] diff --git a/tests/e2e/test_splunk_addon.py b/tests/e2e/test_splunk_addon.py index 553841310..d5f199376 100644 --- a/tests/e2e/test_splunk_addon.py +++ b/tests/e2e/test_splunk_addon.py @@ -810,3 +810,109 @@ def empty_method(): # Here we are not interested in the failures or errors, # we are basically checking that we get results and test execution does not get stuck assert result.parseoutcomes().get("passed") > 0 + + +@pytest.mark.docker +@pytest.mark.splunk_app_fiction_with_uuid +def test_splunk_app_fiction_with_uuid(testdir, request): + """Make sure that pytest accepts our fixture.""" + + testdir.makepyfile( + """ + from pytest_splunk_addon.standard_lib.addon_basic import Basic + class Test_App(Basic): + def empty_method(): + pass + + """ + ) + + shutil.copytree( + os.path.join(testdir.request.fspath.dirname, "addons/TA_fiction"), + os.path.join(testdir.tmpdir, "package"), + ) + + setup_test_dir(testdir) + SampleGenerator.clean_samples() + Rule.clean_rules() + + # run pytest with the following cmd args + result = testdir.runpytest( + f"--splunk-version={request.config.getoption('splunk_version')}", + "--splunk-type=docker", + "-v", + "-m splunk_searchtime_fields", + "--search-interval=4", + "--search-retry=4", + "--search-index=*,_internal", + "--use-uuid", + ) + + logger.info(result.outlines) + result.stdout.fnmatch_lines_random( + constants.TA_FICTION_UUID_PASSED + constants.TA_FICTION_UUID_SKIPPED + ) + result.assert_outcomes( + passed=len(constants.TA_FICTION_UUID_PASSED), + failed=0, + skipped=len(constants.TA_FICTION_UUID_SKIPPED), + ) + + # make sure that we get a '0' exit code for the testsuite + assert result.ret == 0 + + +@pytest.mark.docker +@pytest.mark.splunk_app_req_with_uuid +def test_splunk_app_req_with_uuid(testdir, request): + """Make sure that pytest accepts our fixture.""" + + testdir.makepyfile( + """ + from pytest_splunk_addon.standard_lib.addon_basic import Basic + class Test_App(Basic): + def empty_method(): + pass + """ + ) + + shutil.copytree( + os.path.join(testdir.request.fspath.dirname, "addons/TA_transition_from_req"), + os.path.join(testdir.tmpdir, "package"), + ) + + shutil.copytree( + os.path.join(testdir.request.fspath.dirname, "test_data_models"), + os.path.join(testdir.tmpdir, "tests/data_models"), + ) + + setup_test_dir(testdir) + SampleGenerator.clean_samples() + Rule.clean_rules() + + # run pytest with the following cmd args + result = testdir.runpytest( + f"--splunk-version={request.config.getoption('splunk_version')}", + "--splunk-type=docker", + "-v", + "--search-interval=4", + "--search-retry=4", + "--search-index=*", + "--splunk-data-generator=tests/addons/TA_transition_from_req/default", + "--use-uuid", + ) + logger.info(result.outlines) + + result.stdout.fnmatch_lines_random( + constants.TA_REQ_WITH_UUID_TRANSITION_PASSED + + constants.TA_REQ_WITH_UUID_TRANSITION_FAILED + + constants.TA_REQ_WITH_UUID_TRANSITION_SKIPPED + ) + result.assert_outcomes( + passed=len(constants.TA_REQ_WITH_UUID_TRANSITION_PASSED), + failed=len(constants.TA_REQ_WITH_UUID_TRANSITION_FAILED), + skipped=len(constants.TA_REQ_WITH_UUID_TRANSITION_SKIPPED), + ) + + # make sure that we get a non '0' exit code for the testsuite as it contains failure + assert result.ret == 0, "result not equal to 0" diff --git a/tests/unit/tests_standard_lib/test_app_test_generator.py b/tests/unit/tests_standard_lib/test_app_test_generator.py index a22821e9f..ac4a3f1cb 100644 --- a/tests/unit/tests_standard_lib/test_app_test_generator.py +++ b/tests/unit/tests_standard_lib/test_app_test_generator.py @@ -11,6 +11,7 @@ "store_events": True, "splunk_data_generator": "psa.conf", "requirement_test": "fake_requirement_path", + "ingest_with_uuid": False, } pytest_config = namedtuple("Config", ["getoption"]) test_config = pytest_config(getoption=lambda x, *y: config[x]) @@ -87,7 +88,7 @@ def test_app_test_generator_instantiation( ( "splunk_indextime_key_fields", "indextime_test_generator", - lambda x, app_path, config_path, test_type: ( + lambda x, app_path=None, config_path=None, test_type=None, **kwargs: ( params(values=f"splunk_indextime_{test_type}_test_{3 - i}", id=3 - i) for i in range(3) ), @@ -96,6 +97,7 @@ def test_app_test_generator_instantiation( "app_path": "fake_app", "config_path": "psa.conf", "test_type": "key_fields", + "ingest_with_uuid": False, }, [ params(values=f"splunk_indextime_key_fields_test_1", id=1), @@ -107,12 +109,17 @@ def test_app_test_generator_instantiation( ( "splunk_indextime_time", "indextime_test_generator", - lambda x, app_path, config_path, test_type: ( + lambda x, app_path=None, config_path=None, test_type=None, **kwargs: ( params(values=f"splunk_indextime_{test_type}_test_{3 - i}", id=3 - i) for i in range(3) ), [True], - {"app_path": "fake_app", "config_path": "psa.conf", "test_type": "_time"}, + { + "app_path": "fake_app", + "config_path": "psa.conf", + "test_type": "_time", + "ingest_with_uuid": False, + }, [ params(values=f"splunk_indextime__time_test_1", id=1), params(values=f"splunk_indextime__time_test_2", id=2), @@ -123,7 +130,7 @@ def test_app_test_generator_instantiation( ( "splunk_indextime_line_breaker", "indextime_test_generator", - lambda x, app_path, config_path, test_type: ( + lambda x, app_path=None, config_path=None, test_type=None, **kwargs: ( params(values=f"splunk_indextime_{test_type}_test_{3 - i}", id=3 - i) for i in range(3) ), @@ -132,6 +139,7 @@ def test_app_test_generator_instantiation( "app_path": "fake_app", "config_path": "psa.conf", "test_type": "line_breaker", + "ingest_with_uuid": False, }, [ params(values=f"splunk_indextime_line_breaker_test_1", id=1), diff --git a/tests/unit/tests_standard_lib/test_event_ingestors/conftest.py b/tests/unit/tests_standard_lib/test_event_ingestors/conftest.py index 492b6e455..2d8cccff3 100644 --- a/tests/unit/tests_standard_lib/test_event_ingestors/conftest.py +++ b/tests/unit/tests_standard_lib/test_event_ingestors/conftest.py @@ -11,6 +11,10 @@ class SampleEvent: key_fields: dict = None time_values: list = None + def __post_init__(self): + if self.metadata.get("ingest_with_uuid") == True: + self.unique_identifier = "uuid" + @pytest.fixture() def modinput_events(): @@ -28,6 +32,7 @@ def modinput_events(): "sample_count": "2", "host": "modinput_host_event_time_plugin.samples_1", "expected_event_count": 2, + "ingest_with_uuid": True, }, sample_name="modinput_host_event_time_plugin.samples", ), @@ -44,6 +49,7 @@ def modinput_events(): "sample_count": "2", "host": "modinput_host_event_time_plugin.samples_2", "expected_event_count": 2, + "ingest_with_uuid": False, }, sample_name="modinput_host_event_time_plugin.samples", ), @@ -56,6 +62,7 @@ def modinput_events(): "index": "fake_index", "timestamp_type": "event", "host": "fake host", + "ingest_with_uuid": False, }, sample_name="fake.samples", time_values=[1234.5678, 1234.5679], @@ -73,6 +80,7 @@ def modinput_posts_sent(): '"source": "pytest-splunk-addon:modinput", ' '"event": "test_modinput_1 host=modinput_host_event_time_plugin.samples_1", ' '"index": "main", ' + '"fields": {"unique_identifier": "uuid"}, ' '"host": "modinput_host_event_time_plugin.samples_1"' "}\n{" '"sourcetype": "test:indextime:sourcetype:modinput_host_event_time_plugin", ' @@ -112,6 +120,7 @@ def file_monitor_events(): "sample_count": "2", "host": "file_monitor_host_prefix.sample", "expected_event_count": 1, + "ingest_with_uuid": False, }, sample_name="file_monitor_host_prefix.sample", ), @@ -130,6 +139,7 @@ def file_monitor_events(): "host": "failing-samples-1", "id": "failing.samples_1", "expected_event_count": 2, + "ingest_with_uuid": False, }, sample_name="failing.samples", ), @@ -138,6 +148,7 @@ def file_monitor_events(): metadata={ "input_type": "file_monitor", "index": "fake_index", + "ingest_with_uuid": False, }, sample_name="fake.samples", ), @@ -234,6 +245,7 @@ def requirement_events(): "sample_count": "2", "host": "requirement_host_prefix.sample", "expected_event_count": 1, + "ingest_with_uuid": False, }, sample_name="requirement_test", ), @@ -256,6 +268,7 @@ def sc4s_events(): "host": "sc4s-host-plugin-time-sample-31", "id": "sc4s_host_plugin_time.sample_31", "expected_event_count": 2, + "ingest_with_uuid": False, }, sample_name="sc4s_host_plugin_time.sample", ), @@ -272,6 +285,7 @@ def sc4s_events(): "host": "sc4s-host-plugin-time-sample-32", "id": "sc4s-host-plugin-time-sample-32", "expected_event_count": 2, + "ingest_with_uuid": False, }, sample_name="sc4s_host_plugin_time.sample", ), diff --git a/tests/unit/tests_standard_lib/test_event_ingestors/test_ingestor_helper.py b/tests/unit/tests_standard_lib/test_event_ingestors/test_ingestor_helper.py index 3d9a37dc6..380c9c279 100644 --- a/tests/unit/tests_standard_lib/test_event_ingestors/test_ingestor_helper.py +++ b/tests/unit/tests_standard_lib/test_event_ingestors/test_ingestor_helper.py @@ -22,7 +22,6 @@ def ingestors_mocks(): ) as hec_metric_event_mock, patch( f"{EVENT_INGESTOR_PATH}.sc4s_event_ingestor.SC4SEventIngestor" ) as sc4s_event_mock: - hec_event_mock.return_value = HEC_EVENT_INGESTOR_RETURN_VALUE hec_raw_event_mock.return_value = HEC_RAW_EVENT_INGESTOR_RETURN_VALUE hec_metric_event_mock.return_value = HEC_METRIC_EVENT_INGESTOR_RETURN_VALUE @@ -125,7 +124,7 @@ def test_events_can_be_ingested( get_ingestor_mock, sample_mock, file_monitor_events, modinput_events ): event_ingestors.ingestor_helper.IngestorHelper.ingest_events( - ingest_meta_data={}, + ingest_meta_data={"ingest_with_uuid": False}, addon_path="fake_path", config_path="tests/unit/event_ingestors", thread_count=20, @@ -133,7 +132,11 @@ def test_events_can_be_ingested( ) assert get_ingestor_mock.call_count == 2 get_ingestor_mock.assert_has_calls( - [call("file_monitor", {}), call("modinput", {})], any_order=True + [ + call("file_monitor", {"ingest_with_uuid": False}), + call("modinput", {"ingest_with_uuid": False}), + ], + any_order=True, ) assert get_ingestor_mock.ingest.call_count == 2 get_ingestor_mock.ingest.assert_has_calls( diff --git a/tests/unit/tests_standard_lib/test_fields_tests/test_test_generator.py b/tests/unit/tests_standard_lib/test_fields_tests/test_test_generator.py index e57daefa5..8d7fbce86 100644 --- a/tests/unit/tests_standard_lib/test_fields_tests/test_test_generator.py +++ b/tests/unit/tests_standard_lib/test_fields_tests/test_test_generator.py @@ -24,6 +24,15 @@ def field_3(): field_3.__dict__.update({"name": "field_3"}) +@pytest.fixture +def mock_uuid4(): + with patch( + "uuid.uuid4", + return_value="uuid", + ) as mock_uuid: + yield mock_uuid + + @pytest.fixture() def addon_parser_mock(monkeypatch): ap = MagicMock() @@ -422,6 +431,7 @@ def test_generate_field_tests( "input_type": "modinput", "sourcetype_to_search": "dummy_sourcetype", "host": "dummy_host", + "ingest_with_uuid": False, }, sample_name="file1.xml", requirement_test_data={ @@ -445,6 +455,7 @@ def test_generate_field_tests( "input_type": "syslog_tcp", "sourcetype_to_search": "dummy_sourcetype", "host": "dummy_host_syslog", + "ingest_with_uuid": False, }, sample_name="file1.xml", requirement_test_data={}, @@ -455,6 +466,7 @@ def test_generate_field_tests( "input_type": "syslog_tcp", "sourcetype_to_search": "dummy_sourcetype", "host": "dummy_host_syslog", + "ingest_with_uuid": False, }, sample_name="file1.xml", requirement_test_data={ @@ -522,6 +534,62 @@ def test_generate_requirement_tests(tokenised_events, expected_output): assert param_mock.call_count == len(expected_output) +def test_generate_requirement_tests_with_uuid(mock_uuid4): + event = SampleEvent( + event_string="escaped_event", + metadata={ + "input_type": "modinput", + "sourcetype_to_search": "dummy_sourcetype", + "host": "dummy_host", + "ingest_with_uuid": True, + }, + sample_name="file1.xml", + requirement_test_data={ + "cim_fields": { + "severity": "low", + "signature_id": "405001", + "src": "192.168.0.1", + "type": "event", + }, + }, + ) + + # Simulate tokenization UUID assignment + event.unique_identifier = "uuid" + + tokenised_events = [event] + + expected_output = [ + ( + { + "escaped_event": "escaped_event", + "unique_identifier": "uuid", + "fields": { + "severity": "low", + "signature_id": "405001", + "src": "192.168.0.1", + "type": "event", + }, + "modinput_params": {"sourcetype": "dummy_sourcetype"}, + }, + "sample_name::file1.xml::host::dummy_host", + ) + ] + + with patch.object( + xml_event_parser, "escape_char_event", return_value="escaped_event" + ), patch.object(pytest, "param", side_effect=lambda x, id: (x, id)) as param_mock: + out = list( + FieldTestGenerator( + "app_path", + tokenised_events, + "field_bank", + ).generate_requirements_tests() + ) + assert out == expected_output + assert param_mock.call_count == len(expected_output) + + @pytest.mark.parametrize( "tokenised_events, expected_output", [ @@ -596,3 +664,46 @@ def test_generate_requirement_datamodel_tests(tokenised_events, expected_output) ) assert out == expected_output assert param_mock.call_count == len(expected_output) + + +def test_generate_requirement_datamodel_tests_with_uuid(mock_uuid4): + event = SampleEvent( + event_string="escaped_event", + metadata={ + "input_type": "modinput", + "sourcetype_to_search": "dummy_sourcetype", + "host": "dummy_host", + "ingest_with_uuid": True, + }, + sample_name="file1.xml", + requirement_test_data={"datamodels": {"model": "Alerts"}}, + ) + + # Simulate tokenization UUID assignment + event.unique_identifier = "uuid" + + tokenised_events = [event] + + expected_output = [ + ( + { + "datamodels": ["Alerts"], + "stanza": "escaped_event", + "unique_identifier": "uuid", + }, + "Alerts::sample_name::file1.xml::host::dummy_host", + ) + ] + + with patch.object( + xml_event_parser, "escape_char_event", return_value="escaped_event" + ), patch.object(pytest, "param", side_effect=lambda x, id: (x, id)) as param_mock: + out = list( + FieldTestGenerator( + "app_path", + tokenised_events, + "field_bank", + ).generate_requirements_datamodels_tests() + ) + assert out == expected_output + assert param_mock.call_count == len(expected_output) diff --git a/tests/unit/tests_standard_lib/tests_sample_generation/test_pytest_splunk_addon_data_parser.py b/tests/unit/tests_standard_lib/tests_sample_generation/test_pytest_splunk_addon_data_parser.py index ce9130c7e..23f5e7f17 100644 --- a/tests/unit/tests_standard_lib/tests_sample_generation/test_pytest_splunk_addon_data_parser.py +++ b/tests/unit/tests_standard_lib/tests_sample_generation/test_pytest_splunk_addon_data_parser.py @@ -11,7 +11,7 @@ def test_psa_data_when_no_config(): with tempfile.TemporaryDirectory() as tempdir: with pytest.raises(FileNotFoundError): - psa_data_parser = PytestSplunkAddonDataParser(tempdir, tempdir) + psa_data_parser = PytestSplunkAddonDataParser(tempdir, tempdir, "false") _ = psa_data_parser.psa_data @@ -20,6 +20,7 @@ def test_path_to_samples(): psa_data_parser = PytestSplunkAddonDataParser( path, path, + "false", ) assert os.path.join(path, "samples") == psa_data_parser._path_to_samples @@ -29,6 +30,7 @@ def test_get_psa_data_stanzas_with_samples(): psa_data_parser = PytestSplunkAddonDataParser( path, path, + "false", ) expected_result = { "test1.samples": { @@ -101,6 +103,7 @@ def test_get_sample_stanzas_without_samples(caplog): parser = PytestSplunkAddonDataParser( tempdir, config_path, + "false", ) parser.get_sample_stanzas() assert "No sample file found for stanza : test1.samples" in caplog.messages diff --git a/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_event.py b/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_event.py index c2fa51566..3da17afab 100644 --- a/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_event.py +++ b/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_event.py @@ -8,7 +8,7 @@ EVENT_STRING = "Event_string dad ad dfd ddas Value_5." UPDATED_STRING = "Updated_string" SAMPLE_NAME = "Sample_name" -METADATA = {"Metadata": "metadata"} +METADATA = {"Metadata": "metadata", "ingest_with_uuid": False} RULE = "Rule" SAMPLE_HOST = "sample_host" FAKE_IPV4 = "222.222.222.222" @@ -33,6 +33,29 @@ def samp_eve(): ) +def test_sample_event_generates_uuid(): + METADATA["ingest_with_uuid"] = True + event = pytest_splunk_addon.sample_generation.sample_event.SampleEvent( + event_string=EVENT_STRING, + metadata=METADATA, + sample_name=SAMPLE_NAME, + ) + + # UUID should not be generated during SampleEvent creation anymore + assert not hasattr( + event, "unique_identifier" + ), "UUID should not be assigned during SampleEvent creation" + + # Simulate tokenization where UUID is assigned + with patch("uuid.uuid4", return_value="uuid") as mock_uuid: + if event.metadata.get("ingest_with_uuid"): + event.unique_identifier = str(mock_uuid()) + + mock_uuid.assert_called_once() # Ensures uuid4 was called during tokenization simulation + assert hasattr(event, "unique_identifier") # The field was set + assert event.unique_identifier == "uuid" + + def check_host_count(value): assert pytest_splunk_addon.sample_generation.sample_event.host_count == value diff --git a/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_generator.py b/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_generator.py index 87c87b5b7..72100e55d 100644 --- a/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_generator.py +++ b/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_generator.py @@ -11,11 +11,11 @@ class TestSampleGenerator: def test_init(self): - sg = SampleGenerator(ADDON_PATH, CONFIG_PATH) + sg = SampleGenerator(ADDON_PATH, "false", CONFIG_PATH) assert sg.addon_path == ADDON_PATH assert sg.config_path == CONFIG_PATH assert sg.process_count == 4 - sg = SampleGenerator(ADDON_PATH, CONFIG_PATH, 2) + sg = SampleGenerator(ADDON_PATH, "false", CONFIG_PATH, 2) assert sg.addon_path == ADDON_PATH assert sg.config_path == CONFIG_PATH assert sg.process_count == 2 @@ -36,7 +36,7 @@ def test_get_samples(self): sample_stanza_mock.get_raw_events = ["event_1", "event_2"] sample_stanza_mock.tokenize = lambda x, y: (x, y) psa_data_mock.conf_name = CONFIG_PATH - sg = SampleGenerator(ADDON_PATH) + sg = SampleGenerator(ADDON_PATH, "false") assert list(sg.get_samples()) == [tks_1, tks_2, tks_1, tks_2] def test_clean_samples(self): diff --git a/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_stanza.py b/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_stanza.py index 92da36e37..3f173479a 100644 --- a/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_stanza.py +++ b/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_stanza.py @@ -27,7 +27,11 @@ def get_params_for_get_raw_sample(): }, [ "sample_raw", - {"input_type": input_type, "host": "path_to.file_1"}, + { + "input_type": input_type, + "host": "path_to.file_1", + "ingest_with_uuid": False, + }, "path_to.file", ], ) @@ -47,7 +51,11 @@ def get_params_for_get_raw_sample(): }, [ "sample_raw", - {"input_type": input_type, "host": "path_to.file"}, + { + "input_type": input_type, + "host": "path_to.file", + "ingest_with_uuid": False, + }, "path_to.file", ], ) @@ -66,7 +74,7 @@ def func( "pytest_splunk_addon.sample_generation.sample_stanza.Rule", MagicMock(return_value=rule_mock_value), ): - ss = SampleStanza(SAMPLE_PATH, psa_data_params) + ss = SampleStanza(SAMPLE_PATH, psa_data_params, False) return ss return func @@ -186,6 +194,7 @@ def test_parse_meta( "expected_event_count": "hh", "count": "ll", "index": 1, + "ingest_with_uuid": False, "input_type": input_type, "tokens": { "token_1": {"replacementType": "all"}, @@ -199,6 +208,7 @@ def test_parse_meta( "host": host, "host_type": "plugin", "index": 1, + "ingest_with_uuid": False, "input_type": input_type_expected, "sample_count": "1", "timestamp_type": "plugin", @@ -213,6 +223,7 @@ def test_get_eventmetadata(self, sample_stanza): assert ss.get_eventmetadata() == { "host": "path_to.file_1", "input_type": "default", + "ingest_with_uuid": False, } assert ss.host_count == 1 @@ -246,6 +257,7 @@ def test_break_events(self, sample_stanza, sample_raw, expected): "breaker": "aa", "host": "path_to.file_1", "input_type": "default", + "ingest_with_uuid": False, }, "path_to.file", ], diff --git a/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_xdist_generator.py b/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_xdist_generator.py index 0b7f5236c..ba2a6ccae 100644 --- a/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_xdist_generator.py +++ b/tests/unit/tests_standard_lib/tests_sample_generation/test_sample_xdist_generator.py @@ -12,6 +12,7 @@ "sample_name", "metadata", "event", + "unique_identifier", "key_fields", "time_values", "requirement_test_data", @@ -30,6 +31,7 @@ "input_type": "modinput", }, "event_field", + None, # No UUID when ingest_with_uuid is false "key_fields_field", "time_values_field", "requirement_test_data", @@ -46,6 +48,7 @@ "sample_count": 4, }, "event_field", + None, # No UUID when ingest_with_uuid is false "key_fields_field", "time_values_field", "requirement_test_data", @@ -62,6 +65,7 @@ "sample_count": 4, }, "event_field", + None, # No UUID when ingest_with_uuid is false "key_fields_field_3", "time_values_field_3", "requirement_test_data", @@ -71,7 +75,7 @@ class TestSampleXdistGenerator: def test_init(self): - sample_xdist_generator = SampleXdistGenerator("path", "config_path", 5) + sample_xdist_generator = SampleXdistGenerator("path", "false", "config_path", 5) assert sample_xdist_generator.addon_path == "path" assert sample_xdist_generator.config_path == "config_path" assert sample_xdist_generator.process_count == 5 @@ -104,7 +108,7 @@ def test_init(self): ) def test_get_samples(self, pickle_mock, exists_value, environ, expected): pickle_mock.load.return_value = "pickle_loaded" - sample_xdist_generator = SampleXdistGenerator("path") + sample_xdist_generator = SampleXdistGenerator("path", "false") sample_xdist_generator.store_events = MagicMock() with patch("os.path.exists", MagicMock(return_value=exists_value)), patch( "os.environ", @@ -118,16 +122,20 @@ def test_get_samples(self, pickle_mock, exists_value, environ, expected): assert sample_xdist_generator.get_samples(True) == expected @pytest.mark.parametrize( - "exists_value, makedirs_calls", - [(True, []), (False, [call("/path/to/cwd/.tokenized_events")])], + "exists_value, makedirs_calls, ingest_with_uuid", + [ + (True, [], False), + (False, [call("/path/to/cwd/.tokenized_events")], False), + (False, [call("/path/to/cwd/.tokenized_events")], False), + ], ) - def test_store_events(self, exists_value, makedirs_calls): + def test_store_events(self, exists_value, makedirs_calls, ingest_with_uuid): with patch("os.path.exists", MagicMock(return_value=exists_value)), patch( "os.getcwd", MagicMock(return_value="/path/to/cwd") ), patch("os.makedirs", MagicMock()) as mock_makedirs, patch( "builtins.open", mock_open() ) as open_mock: - sample_xdist_generator = SampleXdistGenerator("path") + sample_xdist_generator = SampleXdistGenerator("path", ingest_with_uuid) sample_xdist_generator.store_events(tokenized_events) mock_makedirs.assert_has_calls(makedirs_calls) open_mock.assert_has_calls( @@ -140,10 +148,81 @@ def test_store_events(self, exists_value, makedirs_calls): open_mock().write.assert_has_calls( [ call( - '{\n\t"sample_name_1": {\n\t\t"metadata": {\n\t\t\t"host": "host_1",\n\t\t\t"source": "source_1",\n\t\t\t"sourcetype": "sourcetype_1",\n\t\t\t"timestamp_type": "timestamp_type_1",\n\t\t\t"input_type": "modinput",\n\t\t\t"expected_event_count": 1,\n\t\t\t"index": "main"\n\t\t},\n\t\t"events": [\n\t\t\t{\n\t\t\t\t"event": "event_field",\n\t\t\t\t"key_fields": "key_fields_field",\n\t\t\t\t"time_values": "time_values_field",\n\t\t\t\t"requirement_test_data": "requirement_test_data"\n\t\t\t},\n\t\t\t{\n\t\t\t\t"event": "event_field",\n\t\t\t\t"key_fields": "key_fields_field_3",\n\t\t\t\t"time_values": "time_values_field_3",\n\t\t\t\t"requirement_test_data": "requirement_test_data"\n\t\t\t}\n\t\t]\n\t}\n}' + '{\n\t"sample_name_1": {\n\t\t"metadata": {\n\t\t\t"host": "host_1",\n\t\t\t"source": "source_1",\n\t\t\t"sourcetype": "sourcetype_1",\n\t\t\t"timestamp_type": "timestamp_type_1",\n\t\t\t"input_type": "modinput",\n\t\t\t"ingest_with_uuid": false,\n\t\t\t"expected_event_count": 1,\n\t\t\t"index": "main"\n\t\t},\n\t\t"events": [\n\t\t\t{\n\t\t\t\t"event": "event_field",\n\t\t\t\t"key_fields": "key_fields_field",\n\t\t\t\t"time_values": "time_values_field",\n\t\t\t\t"requirement_test_data": "requirement_test_data"\n\t\t\t},\n\t\t\t{\n\t\t\t\t"event": "event_field",\n\t\t\t\t"key_fields": "key_fields_field_3",\n\t\t\t\t"time_values": "time_values_field_3",\n\t\t\t\t"requirement_test_data": "requirement_test_data"\n\t\t\t}\n\t\t]\n\t}\n}' + ), + call( + '{\n\t"sample_name_2": {\n\t\t"metadata": {\n\t\t\t"host": "host_2",\n\t\t\t"source": "source_2",\n\t\t\t"sourcetype": "sourcetype_2",\n\t\t\t"timestamp_type": "timestamp_type_2",\n\t\t\t"input_type": "input_else",\n\t\t\t"ingest_with_uuid": false,\n\t\t\t"expected_event_count": 8,\n\t\t\t"index": "main"\n\t\t},\n\t\t"events": [\n\t\t\t{\n\t\t\t\t"event": "event_field",\n\t\t\t\t"key_fields": "key_fields_field",\n\t\t\t\t"time_values": "time_values_field",\n\t\t\t\t"requirement_test_data": "requirement_test_data"\n\t\t\t}\n\t\t]\n\t}\n}' ), + ] + ) + + def test_store_events_with_uuid(self): + tokenized_event = namedtuple( + "tokenized_event", + [ + "sample_name", + "metadata", + "event", + "unique_identifier", + "key_fields", + "time_values", + "requirement_test_data", + ], + ) + + tokenized_events = [ + tokenized_event( + "sample_with_uuid", + { + "expected_event_count": 1, + "host": "host_1", + "source": "source_1", + "sourcetype": "sourcetype_1", + "timestamp_type": "timestamp_type_1", + "input_type": "modinput", + }, + "event_field", + "uuid", + "key_fields_field", + "time_values_field", + "requirement_test_data", + ), + tokenized_event( + "sample_with_uuid", + { + "expected_event_count": 2, + "host": "host_2", + "source": "source_2", + "sourcetype": "sourcetype_2", + "timestamp_type": "timestamp_type_2", + "input_type": "input_else", + "sample_count": 4, + }, + "event_field", + "uuid", + "key_fields_field_3", + "time_values_field_3", + "requirement_test_data", + ), + ] + with patch("os.path.exists", MagicMock(return_value=False)), patch( + "os.getcwd", MagicMock(return_value="/path/to/cwd") + ), patch("os.makedirs", MagicMock()) as mock_makedirs, patch( + "builtins.open", mock_open() + ) as open_mock: + sample_xdist_generator = SampleXdistGenerator("path", True) + sample_xdist_generator.store_events(tokenized_events) + mock_makedirs.assert_has_calls([call("/path/to/cwd/.tokenized_events")]) + open_mock.assert_has_calls( + [ + call("/path/to/cwd/.tokenized_events/sample_with_uuid.json", "w"), + ], + any_order=True, + ) + open_mock().write.assert_has_calls( + [ call( - '{\n\t"sample_name_2": {\n\t\t"metadata": {\n\t\t\t"host": "host_2",\n\t\t\t"source": "source_2",\n\t\t\t"sourcetype": "sourcetype_2",\n\t\t\t"timestamp_type": "timestamp_type_2",\n\t\t\t"input_type": "input_else",\n\t\t\t"expected_event_count": 8,\n\t\t\t"index": "main"\n\t\t},\n\t\t"events": [\n\t\t\t{\n\t\t\t\t"event": "event_field",\n\t\t\t\t"key_fields": "key_fields_field",\n\t\t\t\t"time_values": "time_values_field",\n\t\t\t\t"requirement_test_data": "requirement_test_data"\n\t\t\t}\n\t\t]\n\t}\n}' + '{\n\t"sample_with_uuid": {\n\t\t"metadata": {\n\t\t\t"host": "host_1",\n\t\t\t"source": "source_1",\n\t\t\t"sourcetype": "sourcetype_1",\n\t\t\t"timestamp_type": "timestamp_type_1",\n\t\t\t"input_type": "modinput",\n\t\t\t"ingest_with_uuid": true,\n\t\t\t"expected_event_count": 1,\n\t\t\t"index": "main"\n\t\t},\n\t\t"events": [\n\t\t\t{\n\t\t\t\t"event": "event_field",\n\t\t\t\t"key_fields": "key_fields_field",\n\t\t\t\t"time_values": "time_values_field",\n\t\t\t\t"requirement_test_data": "requirement_test_data",\n\t\t\t\t"unique_identifier": "uuid"\n\t\t\t},\n\t\t\t{\n\t\t\t\t"event": "event_field",\n\t\t\t\t"key_fields": "key_fields_field_3",\n\t\t\t\t"time_values": "time_values_field_3",\n\t\t\t\t"requirement_test_data": "requirement_test_data",\n\t\t\t\t"unique_identifier": "uuid"\n\t\t\t}\n\t\t]\n\t}\n}' ), ] ) diff --git a/tests/unit/tests_standard_lib/tests_sample_generation/test_uuid_e2e_flow.py b/tests/unit/tests_standard_lib/tests_sample_generation/test_uuid_e2e_flow.py new file mode 100644 index 000000000..65a2b9890 --- /dev/null +++ b/tests/unit/tests_standard_lib/tests_sample_generation/test_uuid_e2e_flow.py @@ -0,0 +1,744 @@ +# -*- coding: utf-8 -*- +""" +End-to-End tests for UUID flow through the entire pytest-splunk-addon pipeline. +Tests Priority #2: End-to-End UUID Flow Tests +""" +import pytest +import json +import tempfile +import os +import uuid +from unittest.mock import patch, MagicMock, mock_open +from collections import namedtuple + +from pytest_splunk_addon.sample_generation import SampleGenerator, SampleXdistGenerator +from pytest_splunk_addon.sample_generation.sample_event import SampleEvent +from pytest_splunk_addon.sample_generation.sample_stanza import SampleStanza +from pytest_splunk_addon.event_ingestors.hec_event_ingestor import HECEventIngestor +from pytest_splunk_addon.fields_tests.test_generator import FieldTestGenerator + + +def _simulate_tokenization_uuid_assignment(event): + """Helper to simulate UUID assignment that happens during tokenization""" + if event.metadata.get("ingest_with_uuid") == True: + event.unique_identifier = str(uuid.uuid4()) + + +class TestUUIDFlowThroughPipeline: + """Test UUID propagation through the entire sample generation pipeline""" + + def test_uuid_propagates_from_stanza_to_event(self): + """Verify UUID flag propagates from SampleStanza to SampleEvent""" + with tempfile.TemporaryDirectory() as tmpdir: + sample_path = os.path.join(tmpdir, "test.sample") + with open(sample_path, "w") as f: + f.write("test event line 1\ntest event line 2") + + psa_data_params = { + "sourcetype": "test:sourcetype", + "input_type": "modinput", + "tokens": {}, # Add tokens to avoid KeyError + } + + # Test with UUID enabled + stanza = SampleStanza(sample_path, psa_data_params, ingest_with_uuid=True) + assert stanza.metadata["ingest_with_uuid"] == True + + # Test with UUID disabled + stanza_no_uuid = SampleStanza( + sample_path, psa_data_params, ingest_with_uuid=False + ) + assert stanza_no_uuid.metadata["ingest_with_uuid"] == False + + def test_uuid_in_sample_generator_initialization(self): + """Verify SampleGenerator properly initializes with UUID flag""" + addon_path = "/fake/addon/path" + config_path = "/fake/config/path" + + # Test with UUID enabled + generator = SampleGenerator( + addon_path, ingest_with_uuid=True, config_path=config_path + ) + assert generator.ingest_with_uuid == True + + # Test with UUID disabled + generator_no_uuid = SampleGenerator( + addon_path, ingest_with_uuid=False, config_path=config_path + ) + assert generator_no_uuid.ingest_with_uuid == False + + def test_uuid_in_sample_xdist_generator_initialization(self): + """Verify SampleXdistGenerator properly initializes with UUID flag""" + addon_path = "/fake/addon/path" + config_path = "/fake/config/path" + + # Test with UUID enabled + xdist_generator = SampleXdistGenerator( + addon_path, ingest_with_uuid=True, config_path=config_path + ) + assert xdist_generator.ingest_with_uuid == True + + # Test with UUID disabled + xdist_generator_no_uuid = SampleXdistGenerator( + addon_path, ingest_with_uuid=False, config_path=config_path + ) + assert xdist_generator_no_uuid.ingest_with_uuid == False + + +class TestUUIDInHECPayload: + """Test UUID inclusion in HEC event payloads""" + + def test_uuid_added_to_hec_payload_when_enabled(self): + """Verify UUID is added to HEC payload when flag is enabled""" + # Create a sample event with UUID + metadata = { + "ingest_with_uuid": True, + "sourcetype": "test:sourcetype", + "source": "/var/log/test.log", + "index": "main", + "host": "test-host", + "host_type": "plugin", + "timestamp_type": "plugin", + } + + event = SampleEvent( + event_string="test event for HEC", + metadata=metadata, + sample_name="test.sample", + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + # Verify event has UUID + assert hasattr(event, "unique_identifier") + uuid_value = event.unique_identifier + + # Create HEC ingestor and mock the actual HTTP POST + required_configs = { + "splunk_hec_uri": "https://splunk:8088", + "session_headers": {"Authorization": "Splunk test-token"}, + } + ingestor = HECEventIngestor(required_configs) + + # Mock the requests.post to capture what gets sent + with patch( + "pytest_splunk_addon.event_ingestors.hec_event_ingestor.requests.post" + ) as mock_post: + mock_post.return_value = MagicMock(status_code=200) + + # Call the actual ingest method + ingestor.ingest([event], thread_count=1) + + # Verify post was called + assert mock_post.called, "requests.post should have been called" + + # Get the actual data that was sent + call_args = mock_post.call_args + sent_data = call_args[1].get("data") if call_args else None + + assert sent_data is not None, "Data should have been sent to HEC" + + # Parse the JSON that was sent + hec_events = [ + json.loads(line) for line in sent_data.strip().split("\n") if line + ] + + # Verify UUID is in the actual HEC payload + assert len(hec_events) > 0, "Should have at least one HEC event" + hec_event = hec_events[0] + + # This is what we're really testing - did the ingestor add the UUID field? + assert "fields" in hec_event, "HEC event should have fields" + assert ( + "unique_identifier" in hec_event["fields"] + ), "HEC event fields should contain unique_identifier" + assert ( + hec_event["fields"]["unique_identifier"] == uuid_value + ), "UUID value should match the event's unique_identifier" + + def test_uuid_not_added_to_hec_payload_when_disabled(self): + """Verify UUID is NOT added to HEC payload when flag is disabled""" + metadata = { + "ingest_with_uuid": False, + "sourcetype": "test:sourcetype", + "source": "/var/log/test.log", + "index": "main", + "host": "test-host", + "host_type": "plugin", + "timestamp_type": "plugin", + } + + event = SampleEvent( + event_string="test event without UUID", + metadata=metadata, + sample_name="test.sample", + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + # Verify event doesn't have UUID + assert not hasattr(event, "unique_identifier") + + # Create HEC ingestor and test actual implementation + required_configs = { + "splunk_hec_uri": "https://splunk:8088", + "session_headers": {"Authorization": "Splunk test-token"}, + } + ingestor = HECEventIngestor(required_configs) + + # Mock requests.post to capture what gets sent + with patch( + "pytest_splunk_addon.event_ingestors.hec_event_ingestor.requests.post" + ) as mock_post: + mock_post.return_value = MagicMock(status_code=200) + + # Call the actual ingest method + ingestor.ingest([event], thread_count=1) + + # Get the actual data that was sent + call_args = mock_post.call_args + sent_data = call_args[1].get("data") if call_args else None + + if sent_data: + hec_events = [ + json.loads(line) for line in sent_data.strip().split("\n") if line + ] + hec_event = hec_events[0] + + # Verify fields key is NOT in the actual HEC payload + assert ( + "fields" not in hec_event + ), "HEC event should not have fields when UUID is disabled" + + def test_hec_payload_structure_with_uuid(self): + """Verify complete HEC payload structure includes UUID and other fields correctly""" + metadata = { + "ingest_with_uuid": True, + "sourcetype": "test:sourcetype", + "source": "/var/log/test.log", + "index": "main", + "host": "test-host", + "host_type": "plugin", + "timestamp_type": "event", + } + + event = SampleEvent( + event_string="test event with complete metadata", + metadata=metadata, + sample_name="test.sample", + ) + event.time_values = [1234567890.123] + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + # Verify event has UUID + assert hasattr(event, "unique_identifier") + uuid_value = event.unique_identifier + + # Create HEC ingestor and test actual implementation + required_configs = { + "splunk_hec_uri": "https://splunk:8088", + "session_headers": {"Authorization": "Splunk test-token"}, + } + ingestor = HECEventIngestor(required_configs) + + # Mock requests.post to capture what gets sent + with patch( + "pytest_splunk_addon.event_ingestors.hec_event_ingestor.requests.post" + ) as mock_post: + mock_post.return_value = MagicMock(status_code=200) + + ingestor.ingest([event], thread_count=1) + + call_args = mock_post.call_args + sent_data = call_args[1].get("data") if call_args else None + + assert sent_data is not None + hec_events = [ + json.loads(line) for line in sent_data.strip().split("\n") if line + ] + hec_event = hec_events[0] + + # Verify the actual HEC payload structure + assert "sourcetype" in hec_event + assert "source" in hec_event + assert "event" in hec_event + assert "index" in hec_event + assert "host" in hec_event + assert ( + "time" in hec_event + ), "time should be present when timestamp_type is 'event'" + assert ( + "fields" in hec_event + ), "fields should be present when UUID is enabled" + assert hec_event["fields"]["unique_identifier"] == uuid_value + + +class TestUUIDInTestGeneration: + """Test UUID usage in test parameter generation""" + + def test_uuid_in_requirement_test_params(self): + """Verify UUID is included in requirement test parameters""" + # Create a tokenized event with UUID + metadata = { + "ingest_with_uuid": True, + "input_type": "modinput", + "sourcetype_to_search": "test:sourcetype", + "host": "test-host", + } + + event = SampleEvent( + event_string="test event", + metadata=metadata, + sample_name="test.sample", + requirement_test_data={ + "cim_fields": {"severity": "low", "signature_id": "12345"} + }, + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + # Verify UUID was generated + assert hasattr(event, "unique_identifier") + assert event.unique_identifier is not None + + # Create field test generator + test_generator = FieldTestGenerator( + app_path="fake/path", tokenized_events=[event], field_bank=None + ) + + # Generate requirement tests + with patch( + "pytest_splunk_addon.fields_tests.test_generator.xml_event_parser.escape_char_event" + ) as mock_escape: + mock_escape.return_value = "escaped_event" + + with patch("pytest.param") as mock_param: + mock_param.side_effect = lambda x, id: (x, id) + + params = list(test_generator.generate_requirements_tests()) + + # Verify params were generated + assert len(params) > 0 + param_data, param_id = params[0] + + # Verify UUID is in the parameters + assert ( + "unique_identifier" in param_data + ), "unique_identifier should be in test parameters when UUID is enabled" + assert param_data["unique_identifier"] is not None + + def test_uuid_in_datamodel_test_params(self): + """Verify UUID is included in datamodel test parameters""" + metadata = { + "ingest_with_uuid": True, + "input_type": "modinput", + "sourcetype_to_search": "test:sourcetype", + "host": "test-host", + } + + event = SampleEvent( + event_string="test event for datamodel", + metadata=metadata, + sample_name="test.sample", + requirement_test_data={"datamodels": {"model": "Authentication"}}, + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + # Verify UUID was generated + assert hasattr(event, "unique_identifier") + + # Create field test generator + test_generator = FieldTestGenerator( + app_path="fake/path", tokenized_events=[event], field_bank=None + ) + + # Generate datamodel tests + with patch( + "pytest_splunk_addon.fields_tests.test_generator.xml_event_parser.escape_char_event" + ) as mock_escape: + mock_escape.return_value = "escaped_event" + + with patch("pytest.param") as mock_param: + mock_param.side_effect = lambda x, id: (x, id) + + params = list(test_generator.generate_requirements_datamodels_tests()) + + # Verify params were generated + assert len(params) > 0 + param_data, param_id = params[0] + + # Verify UUID is in the parameters + assert "unique_identifier" in param_data + assert param_data["unique_identifier"] is not None + + def test_uuid_not_in_params_when_disabled(self): + """Verify UUID is NOT in test parameters when flag is disabled""" + metadata = { + "ingest_with_uuid": False, + "input_type": "modinput", + "sourcetype_to_search": "test:sourcetype", + "host": "test-host", + } + + event = SampleEvent( + event_string="test event without UUID", + metadata=metadata, + sample_name="test.sample", + requirement_test_data={"cim_fields": {"severity": "low"}}, + ) + + # Verify no UUID was generated + assert not hasattr(event, "unique_identifier") + + # Create field test generator + test_generator = FieldTestGenerator( + app_path="fake/path", tokenized_events=[event], field_bank=None + ) + + # Generate requirement tests + with patch( + "pytest_splunk_addon.fields_tests.test_generator.xml_event_parser.escape_char_event" + ) as mock_escape: + mock_escape.return_value = "escaped_event" + + with patch("pytest.param") as mock_param: + mock_param.side_effect = lambda x, id: (x, id) + + params = list(test_generator.generate_requirements_tests()) + + if len(params) > 0: + param_data, param_id = params[0] + + # Verify UUID is NOT in the parameters + assert ( + "unique_identifier" not in param_data + ), "unique_identifier should not be in test parameters when UUID is disabled" + + +class TestUUIDInStoredEvents: + """Test UUID persistence in stored tokenized events""" + + def test_uuid_stored_in_tokenized_events_json(self): + """Verify UUID is included in stored tokenized events JSON""" + tokenized_event = namedtuple( + "tokenized_event", + [ + "sample_name", + "metadata", + "event", + "unique_identifier", + "key_fields", + "time_values", + "requirement_test_data", + ], + ) + + events = [ + tokenized_event( + "test_sample", + { + "host": "test-host", + "source": "/var/log/test.log", + "sourcetype": "test:sourcetype", + "timestamp_type": "event", + "input_type": "modinput", + "expected_event_count": 1, + }, + "test event content", + "uuid-12345-67890", + {"field1": "value1"}, + [1234567890], + {"cim_fields": {"severity": "low"}}, + ) + ] + + with patch("os.path.exists", return_value=False), patch( + "os.getcwd", return_value="/fake/path" + ), patch("os.makedirs"), patch("builtins.open", mock_open()) as open_mock: + + xdist_generator = SampleXdistGenerator( + "/fake/addon", "true", "/fake/config" + ) + xdist_generator.store_events(events) + + # Get the written JSON + write_calls = [call.args[0] for call in open_mock().write.call_args_list] + assert len(write_calls) > 0 + + # Parse the JSON + json_content = write_calls[0] + stored_data = json.loads(json_content) + + # Verify UUID is in the stored data + assert "test_sample" in stored_data + sample_data = stored_data["test_sample"] + assert "metadata" in sample_data + # Accept both boolean True and string "true" for JSON compatibility + ingest_uuid_value = sample_data["metadata"]["ingest_with_uuid"] + assert ingest_uuid_value is True or ingest_uuid_value == "true" + assert "events" in sample_data + assert len(sample_data["events"]) > 0 + assert "unique_identifier" in sample_data["events"][0] + assert sample_data["events"][0]["unique_identifier"] == "uuid-12345-67890" + + def test_uuid_not_stored_when_disabled(self): + """Verify UUID is NOT stored when flag is disabled""" + tokenized_event = namedtuple( + "tokenized_event", + [ + "sample_name", + "metadata", + "event", + "unique_identifier", + "key_fields", + "time_values", + "requirement_test_data", + ], + ) + + events = [ + tokenized_event( + "test_sample_no_uuid", + { + "host": "test-host", + "source": "/var/log/test.log", + "sourcetype": "test:sourcetype", + "timestamp_type": "event", + "input_type": "file_monitor", + "expected_event_count": 1, + }, + "test event without UUID", + None, # unique_identifier should be None when disabled + {"field1": "value1"}, + [], + None, + ) + ] + + with patch("os.path.exists", return_value=False), patch( + "os.getcwd", return_value="/fake/path" + ), patch("os.makedirs"), patch("builtins.open", mock_open()) as open_mock: + + xdist_generator = SampleXdistGenerator("/fake/addon", False, "/fake/config") + xdist_generator.store_events(events) + + # Get the written JSON + write_calls = [call.args[0] for call in open_mock().write.call_args_list] + + if write_calls: + json_content = write_calls[0] + stored_data = json.loads(json_content) + + sample_data = stored_data["test_sample_no_uuid"] + assert sample_data["metadata"]["ingest_with_uuid"] == False + + # Verify unique_identifier is NOT in events + for event in sample_data["events"]: + assert "unique_identifier" not in event + + +class TestUUIDSearchQueryGeneration: + """Test UUID usage in search query generation + + Note: These tests verify the logical behavior that UUID changes search approach. + They test decision logic rather than implementation, which is acceptable for + documenting expected behavior. The actual search execution is tested in e2e tests. + """ + + def test_search_params_contain_uuid_when_enabled(self): + """Verify test parameters include UUID when flag is enabled""" + # This tests that the test parameter generation includes UUID + metadata = { + "ingest_with_uuid": True, + "input_type": "modinput", + "sourcetype_to_search": "test:sourcetype", + "host": "test-host", + } + + event = SampleEvent( + event_string="test event", + metadata=metadata, + sample_name="test.sample", + requirement_test_data={"cim_fields": {"severity": "low"}}, + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + test_generator = FieldTestGenerator( + app_path="fake/path", tokenized_events=[event], field_bank=None + ) + + with patch( + "pytest_splunk_addon.fields_tests.test_generator.xml_event_parser.escape_char_event" + ) as mock_escape: + mock_escape.return_value = "escaped_event" + + with patch("pytest.param") as mock_param: + mock_param.side_effect = lambda x, id: (x, id) + + params = list(test_generator.generate_requirements_tests()) + param_data, _ = params[0] + + # The key assertion: parameters have UUID, not just escaped event + assert "unique_identifier" in param_data + assert param_data["unique_identifier"] is not None + # This means searches will use UUID instead of escaped event + + def test_search_params_lack_uuid_when_disabled(self): + """Verify test parameters do NOT include UUID when flag is disabled""" + metadata = { + "ingest_with_uuid": False, + "input_type": "modinput", + "sourcetype_to_search": "test:sourcetype", + "host": "test-host", + } + + event = SampleEvent( + event_string="test event", + metadata=metadata, + sample_name="test.sample", + requirement_test_data={"cim_fields": {"severity": "low"}}, + ) + + test_generator = FieldTestGenerator( + app_path="fake/path", tokenized_events=[event], field_bank=None + ) + + with patch( + "pytest_splunk_addon.fields_tests.test_generator.xml_event_parser.escape_char_event" + ) as mock_escape: + mock_escape.return_value = "escaped_event" + + with patch("pytest.param") as mock_param: + mock_param.side_effect = lambda x, id: (x, id) + + params = list(test_generator.generate_requirements_tests()) + + if params: + param_data, _ = params[0] + + # The key assertion: parameters don't have UUID, use escaped event approach + assert "unique_identifier" not in param_data + assert "escaped_event" in param_data + # This means searches will use traditional escaped event method + + +class TestUUIDEndToEndIntegration: + """Integration tests for complete UUID flow""" + + def test_complete_uuid_flow_modinput(self): + """Test complete UUID flow for modinput events""" + # This test simulates the complete flow: + # 1. Event creation with UUID + # 2. HEC payload generation + # 3. Test parameter generation + # 4. Assert parameters drive UUID-based search (without reimplementing query builder) + + metadata = { + "ingest_with_uuid": True, + "input_type": "modinput", + "sourcetype": "test:sourcetype", + "source": "pytest-splunk-addon:modinput", + "index": "main", + "host": "test-host", + "host_type": "plugin", + "timestamp_type": "plugin", + "sourcetype_to_search": "test:sourcetype", + } + + # Step 1: Create event + event = SampleEvent( + event_string="integration test event", + metadata=metadata, + sample_name="integration.sample", + requirement_test_data={"cim_fields": {"severity": "high"}}, + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + # Verify UUID was created + assert hasattr(event, "unique_identifier") + + # Step 2: Verify HEC payload would include UUID + assert event.metadata.get("ingest_with_uuid") == True + + # Step 3: Generate test parameters + test_generator = FieldTestGenerator( + app_path="fake/path", tokenized_events=[event], field_bank=None + ) + + with patch( + "pytest_splunk_addon.fields_tests.test_generator.xml_event_parser.escape_char_event" + ) as mock_escape: + mock_escape.return_value = "escaped_integration_event" + + with patch("pytest.param") as mock_param: + mock_param.side_effect = lambda x, id: (x, id) + + params = list(test_generator.generate_requirements_tests()) + + assert len(params) > 0 + param_data, _ = params[0] + + # Verify UUID is in parameters and escaped_event is still present but not required for UUID path + assert "unique_identifier" in param_data + # Key assertion: when UUID is present, consumers should use it (do not manually build search here) + assert ( + "escaped_event" in param_data + ) # present for backward compatibility + + def test_complete_flow_without_uuid(self): + """Test complete flow works correctly without UUID (backward compatibility)""" + metadata = { + "ingest_with_uuid": False, + "input_type": "modinput", + "sourcetype": "test:sourcetype", + "source": "pytest-splunk-addon:modinput", + "index": "main", + "host": "test-host", + "host_type": "plugin", + "timestamp_type": "plugin", + "sourcetype_to_search": "test:sourcetype", + } + + # Step 1: Create event without UUID + event = SampleEvent( + event_string="test event without uuid", + metadata=metadata, + sample_name="test.sample", + requirement_test_data={"cim_fields": {"severity": "medium"}}, + ) + + # Verify no UUID was created + assert not hasattr(event, "unique_identifier") + + # Step 2: Generate test parameters + test_generator = FieldTestGenerator( + app_path="fake/path", tokenized_events=[event], field_bank=None + ) + + with patch( + "pytest_splunk_addon.fields_tests.test_generator.xml_event_parser.escape_char_event" + ) as mock_escape: + mock_escape.return_value = "escaped_test_event" + + with patch("pytest.param") as mock_param: + mock_param.side_effect = lambda x, id: (x, id) + + params = list(test_generator.generate_requirements_tests()) + + if len(params) > 0: + param_data, _ = params[0] + + # Verify UUID is NOT in parameters, and escaped event is present for traditional search path + assert "unique_identifier" not in param_data + assert param_data["escaped_event"] == "escaped_test_event" diff --git a/tests/unit/tests_standard_lib/tests_sample_generation/test_uuid_generation.py b/tests/unit/tests_standard_lib/tests_sample_generation/test_uuid_generation.py new file mode 100644 index 000000000..6aae9875f --- /dev/null +++ b/tests/unit/tests_standard_lib/tests_sample_generation/test_uuid_generation.py @@ -0,0 +1,320 @@ +# -*- coding: utf-8 -*- +""" +Unit tests for UUID generation and uniqueness in sample events. +Tests Priority #1: UUID Generation & Uniqueness Tests +""" +import pytest +import uuid +from unittest.mock import patch, MagicMock +from pytest_splunk_addon.sample_generation.sample_event import SampleEvent +from pytest_splunk_addon.sample_generation.sample_stanza import SampleStanza + + +def _simulate_tokenization_uuid_assignment(event): + """Helper to simulate UUID assignment that happens during tokenization""" + if event.metadata.get("ingest_with_uuid"): + event.unique_identifier = str(uuid.uuid4()) + + +class TestUUIDGeneration: + """Test suite for UUID generation functionality""" + + def test_uuid_generated_when_flag_enabled(self): + """Verify UUID is generated when ingest_with_uuid is True""" + metadata = {"ingest_with_uuid": True, "index": "main"} + event = SampleEvent( + event_string="test event", metadata=metadata, sample_name="test.sample" + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + assert hasattr( + event, "unique_identifier" + ), "unique_identifier attribute should exist" + assert ( + event.unique_identifier is not None + ), "unique_identifier should not be None" + assert isinstance( + event.unique_identifier, str + ), "unique_identifier should be a string" + + def test_uuid_not_generated_when_flag_disabled(self): + """Verify UUID is NOT generated when ingest_with_uuid is False""" + metadata = {"ingest_with_uuid": False, "index": "main"} + event = SampleEvent( + event_string="test event", metadata=metadata, sample_name="test.sample" + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + assert not hasattr( + event, "unique_identifier" + ), "unique_identifier attribute should not exist when flag is disabled" + + def test_uuid_not_generated_when_flag_missing(self): + """Verify UUID is NOT generated when ingest_with_uuid is not specified""" + metadata = {"index": "main"} + event = SampleEvent( + event_string="test event", metadata=metadata, sample_name="test.sample" + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + assert not hasattr( + event, "unique_identifier" + ), "unique_identifier attribute should not exist when flag is missing" + + def test_uuid_format_is_valid(self): + """Verify generated UUID follows UUID4 format""" + metadata = {"ingest_with_uuid": True, "index": "main"} + event = SampleEvent( + event_string="test event", metadata=metadata, sample_name="test.sample" + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + # Validate UUID format by attempting to parse it + try: + uuid_obj = uuid.UUID(event.unique_identifier, version=4) + assert ( + str(uuid_obj) == event.unique_identifier + ), "UUID should be properly formatted" + assert uuid_obj.version == 4, "UUID should be version 4" + except ValueError: + pytest.fail( + f"Generated UUID '{event.unique_identifier}' is not a valid UUID4" + ) + + +class TestUUIDUniqueness: + """Test suite for UUID uniqueness across multiple events""" + + def test_multiple_events_get_unique_uuids(self): + """Verify each event gets a different UUID""" + metadata = {"ingest_with_uuid": True, "index": "main"} + num_events = 100 + + events = [ + SampleEvent( + event_string=f"test event {i}", + metadata=metadata.copy(), + sample_name=f"test.sample{i}", + ) + for i in range(num_events) + ] + + # Simulate tokenization UUID assignment for all events + for event in events: + _simulate_tokenization_uuid_assignment(event) + + uuids = [event.unique_identifier for event in events] + + # Check all UUIDs are unique + assert ( + len(set(uuids)) == num_events + ), f"All {num_events} events should have unique UUIDs, but got {len(set(uuids))} unique values" + + def test_same_event_string_gets_different_uuids(self): + """Verify identical events get different UUIDs""" + metadata = {"ingest_with_uuid": True, "index": "main"} + event_string = "identical test event" + + event1 = SampleEvent( + event_string=event_string, + metadata=metadata.copy(), + sample_name="test.sample", + ) + + event2 = SampleEvent( + event_string=event_string, + metadata=metadata.copy(), + sample_name="test.sample", + ) + + # Simulate tokenization UUID assignment for both events + _simulate_tokenization_uuid_assignment(event1) + _simulate_tokenization_uuid_assignment(event2) + + assert ( + event1.unique_identifier != event2.unique_identifier + ), "Identical events should receive different UUIDs" + + def test_uuid_persistence_through_event_lifecycle(self): + """Verify UUID remains constant throughout event lifecycle""" + metadata = {"ingest_with_uuid": True, "index": "main"} + event = SampleEvent( + event_string="test event", metadata=metadata, sample_name="test.sample" + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + original_uuid = event.unique_identifier + + # Modify event properties + event.update("modified event string") + event.key_fields = {"field1": "value1"} + event.time_values = [1234567890] + + # UUID should remain the same + assert ( + event.unique_identifier == original_uuid + ), "UUID should remain constant after event modifications" + + +# TestUUIDCaseSensitivity class removed - no longer relevant with boolean flags + + +class TestUUIDWithRequirementData: + """Test suite for UUID generation with requirement test data""" + + def test_uuid_with_requirement_test_data(self): + """Verify UUID is generated when requirement_test_data is present""" + metadata = {"ingest_with_uuid": True, "index": "main"} + requirement_data = {"cim_fields": {"severity": "low", "signature_id": "12345"}} + + event = SampleEvent( + event_string="test event", + metadata=metadata, + sample_name="test.sample", + requirement_test_data=requirement_data, + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + assert hasattr( + event, "unique_identifier" + ), "UUID should be generated even with requirement_test_data" + assert ( + event.requirement_test_data == requirement_data + ), "requirement_test_data should be preserved" + + def test_uuid_without_requirement_test_data(self): + """Verify UUID is generated when requirement_test_data is None""" + metadata = {"ingest_with_uuid": True, "index": "main"} + + event = SampleEvent( + event_string="test event", + metadata=metadata, + sample_name="test.sample", + requirement_test_data=None, + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + assert hasattr( + event, "unique_identifier" + ), "UUID should be generated even without requirement_test_data" + assert event.requirement_test_data is None + + +class TestUUIDMocking: + """Test suite for UUID mocking and deterministic testing""" + + def test_uuid_can_be_mocked(self): + """Verify UUID generation can be mocked for deterministic tests""" + expected_uuid = "12345678-1234-5678-1234-567812345678" + + with patch("uuid.uuid4") as mock_uuid: + mock_uuid.return_value = expected_uuid + + metadata = {"ingest_with_uuid": True, "index": "main"} + event = SampleEvent( + event_string="test event", metadata=metadata, sample_name="test.sample" + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + mock_uuid.assert_called_once() + assert event.unique_identifier == expected_uuid + + def test_uuid_generation_called_once_per_event(self): + """Verify UUID is generated exactly once per event""" + with patch("uuid.uuid4") as mock_uuid: + mock_uuid.return_value = "test-uuid" + + metadata = {"ingest_with_uuid": True, "index": "main"} + event = SampleEvent( + event_string="test event", metadata=metadata, sample_name="test.sample" + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + # Access the UUID multiple times + _ = event.unique_identifier + _ = event.unique_identifier + + # uuid4 should only be called once during tokenization + mock_uuid.assert_called_once() + + +class TestUUIDWithDifferentMetadata: + """Test suite for UUID generation with various metadata configurations""" + + def test_uuid_with_minimal_metadata(self): + """Verify UUID is generated with minimal metadata""" + metadata = {"ingest_with_uuid": True} + event = SampleEvent( + event_string="test event", metadata=metadata, sample_name="test.sample" + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + assert hasattr(event, "unique_identifier") + + def test_uuid_with_extensive_metadata(self): + """Verify UUID is generated with extensive metadata""" + metadata = { + "ingest_with_uuid": True, + "index": "main", + "sourcetype": "test:sourcetype", + "source": "/var/log/test.log", + "host": "test-host", + "host_type": "plugin", + "timestamp_type": "event", + "input_type": "modinput", + "sample_count": "10", + } + + event = SampleEvent( + event_string="test event with extensive metadata", + metadata=metadata, + sample_name="test.sample", + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + assert hasattr(event, "unique_identifier") + assert event.metadata == metadata + + @pytest.mark.parametrize( + "input_type", ["modinput", "file_monitor", "syslog_tcp", "default", "sc4s"] + ) + def test_uuid_with_different_input_types(self, input_type): + """Verify UUID is generated regardless of input type""" + metadata = { + "ingest_with_uuid": True, + "input_type": input_type, + "index": "main", + } + + event = SampleEvent( + event_string="test event", metadata=metadata, sample_name="test.sample" + ) + + # Simulate tokenization UUID assignment + _simulate_tokenization_uuid_assignment(event) + + assert hasattr( + event, "unique_identifier" + ), f"UUID should be generated for input_type={input_type}" diff --git a/tests/unit/tests_standard_lib/tests_sample_generation/test_uuid_tokenization_timing.py b/tests/unit/tests_standard_lib/tests_sample_generation/test_uuid_tokenization_timing.py new file mode 100644 index 000000000..9ffd77828 --- /dev/null +++ b/tests/unit/tests_standard_lib/tests_sample_generation/test_uuid_tokenization_timing.py @@ -0,0 +1,88 @@ +# -*- coding: utf-8 -*- +""" +Test for UUID timing fix - ensures UUIDs are assigned per finalized event after tokenization. +""" +import pytest +import tempfile +import os +from pytest_splunk_addon.sample_generation.sample_stanza import SampleStanza + + +class TestUUIDTokenizationTiming: + """Test UUID assignment timing during tokenization""" + + def test_uuid_assigned_post_tokenization(self): + """Test that UUIDs are assigned after tokenization, ensuring uniqueness per event""" + + with tempfile.TemporaryDirectory() as tmpdir: + sample_path = os.path.join(tmpdir, "test.sample") + with open(sample_path, "w") as f: + # Multiple events to ensure we get multiple UUIDs + f.write("Event 1\nEvent 2\nEvent 3\n") + + psa_data_params = { + "sourcetype": "test:sourcetype", + "input_type": "modinput", # This will create one event per line + "tokens": {}, # No tokens needed for this test + } + + stanza = SampleStanza(sample_path, psa_data_params, ingest_with_uuid=True) + + # Tokenize to generate events with UUIDs + stanza.tokenize("psa-data-gen") + + events = stanza.tokenized_events + + # Verify events were created + assert ( + len(events) >= 3 + ), f"Should create events for each line, got {len(events)}" + + # Collect UUIDs + uuids = [] + for event in events: + assert hasattr( + event, "unique_identifier" + ), f"Event should have unique_identifier: {event.event}" + assert event.unique_identifier is not None, "UUID should not be None" + assert ( + len(event.unique_identifier) == 36 + ), "UUID should be 36 characters (standard UUID format)" + uuids.append(event.unique_identifier) + + # Verify all UUIDs are unique (this was the core bug we fixed) + unique_uuids = set(uuids) + assert len(unique_uuids) == len( + uuids + ), f"All UUIDs should be unique! Got {len(unique_uuids)} unique out of {len(uuids)} total" + + print( + f"✓ Generated {len(events)} events with {len(unique_uuids)} unique UUIDs" + ) + print(f"✓ UUID timing fix successful - no duplication across events") + + def test_uuid_not_assigned_when_disabled(self): + """Test that UUIDs are not assigned when flag is disabled""" + + with tempfile.TemporaryDirectory() as tmpdir: + sample_path = os.path.join(tmpdir, "test.sample") + with open(sample_path, "w") as f: + f.write("Test event without UUID\n") + + psa_data_params = { + "sourcetype": "test:sourcetype", + "input_type": "modinput", + "tokens": {}, + } + + stanza = SampleStanza( + sample_path, psa_data_params, ingest_with_uuid=False # UUID disabled + ) + + stanza.tokenize("psa-data-gen") + events = stanza.tokenized_events + + for event in events: + assert not hasattr( + event, "unique_identifier" + ), "Event should not have unique_identifier when UUID is disabled"