Can I install Qualys Technology Add-on (TA) for Splunk on Indexer ??

[kleber_silva]

Hi Team

I have a Qualys Cloud Plataform and I need install app on Splunk, but my Heavy Forwarder is Windows Server.
Can I install Qualys TA app in Indexer server ?

Thanks

[nit123]

You should install Qualys Technology Add-on (TA) for Splunk on the Forwarder (and enable data inputs that you need) only and no install required on Indexer. Only enable receiving on the indexer. The forwarder will forward data to indexer and the reporting apps installed on Search heads will talk to the indexer for the data on it.

Hope this information helps.

[martin_mueller · Accepted solution]

Indexers should not also do data collection, they're supposed to be peas in a pot. By having one indexer be different from the rest you lose easy interchangeability, cluster-ability, and won't get loadbalanced searches on qualys data.

It'll work, but it'll suck.

I'd recommend standing up a Linux VM with a HF.