topic Re: Qualys VM App for Splunk Enterprise: Why are Qualys data input scripts not listed under data inputs? in All Apps and Add-ons

Qualys VM App for Splunk Enterprise: Why are Qualys data input scripts not listed under data inputs?

rahul_jasrotia — Fri, 08 Jul 2016 05:32:01 GMT

Hi All,

I have installed the latest version of Qualys VM App for Splunk enterprise, as well as the ta-qualyscloudplatform needed in order to bring the Aualys data into Splunk. I have successfully configured the App and the TA, but somehow the scripts that bring the data from the server listed under Settings->Data Inputs are not coming, and hence, I am not able to retrieve any data.

This was working fine with the previous Qualys app that I had on my Forwarder. Does anyone have a clue regarding this? I have followed the exact steps written in the documentation provided with the TA. Looking for a reply.

Re: Qualys VM App for Splunk Enterprise: Why are Qualys data input scripts not listed under data inputs?

Lindaiyu — Mon, 11 Jul 2016 08:30:49 GMT

Hello rahul_jasrotia,

I got the same situation as you did.
Try the url directly "http://your splunk url/en-US/manager/launcher/data/inputs/qualys"
And you will find the page and you need to set them enable.

Hope it work for you.
Thanks,
Daiyu

Re: Qualys VM App for Splunk Enterprise: Why are Qualys data input scripts not listed under data inputs?

rahul_jasrotia — Mon, 11 Jul 2016 13:31:55 GMT

Hi Lindaiyu,
Thanks yes i was able to see the scripts on the link mentioned by you.
But somehow they are not executing even after trying to make them run 4-5 times. Any idea what can be the reason for the same?

Re: Qualys VM App for Splunk Enterprise: Why are Qualys data input scripts not listed under data inputs?

Lindaiyu — Mon, 11 Jul 2016 13:34:28 GMT

Hello rahul_jasrotia,

I got the same situation as you did.
Try the url directly "http://your splunk url/en-US/manager/launcher/data/inputs/qualys"
And you will find the page and you need to set them enable.

Hope it work for you.
Thanks,
Daiyu

Re: Qualys VM App for Splunk Enterprise: Why are Qualys data input scripts not listed under data inputs?

Lindaiyu — Mon, 11 Jul 2016 13:35:47 GMT

you talk about the "interval"?

Re: Qualys VM App for Splunk Enterprise: Why are Qualys data input scripts not listed under data inputs?

rahul_jasrotia — Wed, 20 Jul 2016 05:33:01 GMT

Hi All,
Got in touch with the app developer from Qualys, this app should be installed on the Indexer and then you would find the configurations as mentioned in the supporting doc. Still not sure why it won't work on the Heavy Forwarder since we have more than 2 indexers on our test and production servers and that would involve installing the app on every indexer.
I am in touch with the developer for this as well.

One more thing is to be very sure that the account that you're using is active and there is internet access on the server you;re configuring the app because that was the case with me.