When first entering a set of user/password credentials into the Qualys TA setup page, everything works as expected.
Once the credentials expire in the API and I attempt to update the password in the setup page, I get this error:
Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/storage/passwords/
Looking at the _internal index, I can see the POST fail with a 409 status code, Conflict.
In order to update the changes successfully into the Qualys TA for Splunk, please follow the below steps:
1)From Settings> Data Inputs disable the TA Inputs
2)Delete passwords.conf file.
3)Reboot the splunk instance.
4)Go to TA config in Splunk UI and give the credentials again.
5)Check if the passwords.conf file created
6)Enable TA inputs from data Inputs
My gut feeling says it's a problem with using the setup.xml to update credentials, it always forces a POST to the storage/passwords/_new entity, which is a create/insert... that fails when the key (=username) already exists.
We had the same issue with updating our credentials on our cloud instance and to get Splunk Support to assist, apparently it is a know issue but what we did was exactly what you did.... delete the passwords.conf to allow the new credentials to take, an absolute pain as it left us without data for a few days