All Apps and Add-ons

Can I install Qualys Technology Add-on (TA) for Splunk on Indexer ??

kleber_silva
Engager

Hi Team

I have a Qualys Cloud Plataform and I need install app on Splunk, but my Heavy Forwarder is Windows Server.
Can I install Qualys TA app in Indexer server ?

Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Indexers should not also do data collection, they're supposed to be peas in a pot. By having one indexer be different from the rest you lose easy interchangeability, cluster-ability, and won't get loadbalanced searches on qualys data.

It'll work, but it'll suck.

I'd recommend standing up a Linux VM with a HF.

View solution in original post

0 Karma

nit123
Path Finder

You should install Qualys Technology Add-on (TA) for Splunk on the Forwarder (and enable data inputs that you need) only and no install required on Indexer. Only enable receiving on the indexer. The forwarder will forward data to indexer and the reporting apps installed on Search heads will talk to the indexer for the data on it.

Hope this information helps.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Indexers should not also do data collection, they're supposed to be peas in a pot. By having one indexer be different from the rest you lose easy interchangeability, cluster-ability, and won't get loadbalanced searches on qualys data.

It'll work, but it'll suck.

I'd recommend standing up a Linux VM with a HF.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...