All Apps and Add-ons

Dashboard of "Qualys PC App for Splunk Enterprise" remains empty

rschutt
Explorer

It looks like no data for the "Policy Posture" is being fetched. The "WAS"- and "Host Detection"-inputs are working fine.

The Splunk-version is 6.5.2 and below are the events found in "ta_QualysCloudPlatform.log" that are related to this request (debug-mode is enabled). The setting with regards to "Policy Posture" are default.

TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19370 [MainThread] INFO: TA-QualysCloudPlatform - Index configured: qualys
TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform - Index configured: qualys
TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19406 [MainThread] INFO: TA-QualysCloudPlatform - Index configured: qualys
TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform [policy_posture_info] - Making request: https://qualysapi.qualys.eu/msp/about.php with params={}
TA-QualysCloudPlatform: 2018-07-05 02:10:31 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform [policy_posture_info] - Qualys PC Posture Populator started.
File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/qualys_log_populator.py", line 544, in _run
TA-QualysCloudPlatform: 2018-07-05 02:10:31 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform [policy_posture_info] - Qualys PC Posture Populator finished.

Does anyone have the same experience or any idea how we can solve this?

Many thanks!

0 Karma
1 Solution

rschutt
Explorer

We were able to solve this problem. The problem was caused by the fact that the TA has been deployed from the Forwarder-Manager. This means that we were not able to configure the app from the UI. As a result of the update the TA the Policy-Posture-fetches were added but needed to be configured. So I created an additional stanza in the inputs.conf for the Policy-Posture but the only thing it did was contacting the "About"-page of Qualys.

When I installed the TA on a different stand-alone system and set it up properly I discovered that there were additional options in the qualys.conf-file. Although these are assigning empty values I copied these options to my production-environment and this works.

So the message is, always use the UI to set this up.

Thanks!

View solution in original post

0 Karma

rschutt
Explorer

We were able to solve this problem. The problem was caused by the fact that the TA has been deployed from the Forwarder-Manager. This means that we were not able to configure the app from the UI. As a result of the update the TA the Policy-Posture-fetches were added but needed to be configured. So I created an additional stanza in the inputs.conf for the Policy-Posture but the only thing it did was contacting the "About"-page of Qualys.

When I installed the TA on a different stand-alone system and set it up properly I discovered that there were additional options in the qualys.conf-file. Although these are assigning empty values I copied these options to my production-environment and this works.

So the message is, always use the UI to set this up.

Thanks!

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...