All Apps and Add-ons

Can I install Qualys Technology Add-on (TA) for Splunk on Indexer ??

kleber_silva
Engager

Hi Team

I have a Qualys Cloud Plataform and I need install app on Splunk, but my Heavy Forwarder is Windows Server.
Can I install Qualys TA app in Indexer server ?

Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Indexers should not also do data collection, they're supposed to be peas in a pot. By having one indexer be different from the rest you lose easy interchangeability, cluster-ability, and won't get loadbalanced searches on qualys data.

It'll work, but it'll suck.

I'd recommend standing up a Linux VM with a HF.

View solution in original post

0 Karma

nit123
Path Finder

You should install Qualys Technology Add-on (TA) for Splunk on the Forwarder (and enable data inputs that you need) only and no install required on Indexer. Only enable receiving on the indexer. The forwarder will forward data to indexer and the reporting apps installed on Search heads will talk to the indexer for the data on it.

Hope this information helps.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Indexers should not also do data collection, they're supposed to be peas in a pot. By having one indexer be different from the rest you lose easy interchangeability, cluster-ability, and won't get loadbalanced searches on qualys data.

It'll work, but it'll suck.

I'd recommend standing up a Linux VM with a HF.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...