topic Re: Qualys-TA ignores index setting in inputs.conf in All Apps and Add-ons

Qualys-TA ignores index setting in inputs.conf

DATEVeG — Mon, 18 Feb 2019 15:13:36 GMT

Hi,

we are using version 1.4 of Qualys Technology Add-on (TA) for Splunk.
Our $SPLUNK_HOME/etc/apps/TA-QualysCloudPlatform/local/inputs.conf is:

[qualys://host_detection]
duration = 0 * * * *
index = vulnerabilities
start_date = 1999-01-01T00:00:00Z
disabled = 0

However the gathered information ist written to the main index:

[...]
TA-QualysCloudPlatform: 2019-02-18 16:00:31 PID=89627 [MainThread] INFO: TA-QualysCloudPlatform - Running for knowledge_base. Host name to be used: our_host. Index configured: main. Run duration: 0 * * * *. Default start date: 1999-01-01T00:00:00Z.
[...]

The TA is installed on a heavy forwarder. The index vulnerabilities is defined on our indexpeers, but not on the heavy forwarder.

How can i configure the TA to write to the index vulnerabilities instead of main?

Thanks!

Lorenz

Re: Qualys-TA ignores index setting in inputs.conf

MattibergB — Tue, 19 Feb 2019 10:54:45 GMT

Some simple checks could help

Did you restart the HF after changing the inputs.conf?
If you use btool on the HF and on the Indexers do you see the correct values? \splunkpath\splunk cmd btool list inputs --debug

Change the path for you splunk bin directory

Re: Qualys-TA ignores index setting in inputs.conf

lakshman239 — Tue, 19 Feb 2019 12:40:56 GMT

Change your default start date to more recent one start_date = 2019-01-01T00:00:00Z

Restart HF and Indexers.

Re: Qualys-TA ignores index setting in inputs.conf

DATEVeG — Tue, 19 Feb 2019 15:06:24 GMT

Thanks for your input!

My restart command didn't work, because of the new splunk systemd service file.
After checking and restarting splunk manually everything works fine now.

Re: Qualys-TA ignores index setting in inputs.conf

DATEVeG — Tue, 19 Feb 2019 15:07:02 GMT

My restart command didn't work, because of the new splunk systemd service file.
After checking and restarting splunk manually everything works fine now.