Hello dear Splunkers,
I am trying to get information from 2 different Qualys instances, to do so i have set up two different Splunk servers with qualys TA. Everything seems to work fine but I need to get both connections to work from a single Splunk server.
Q1- Is it possible to configure two connections from a single TA-QualysCloudPlatform ? If so, how ?
Q2- If Q1 is impossible, how can I get 2 TA-QualysCloudPlatform to work on the same splunk instance (each one will connect to a seperate Qualys instance) ? I tried copying the TA-QualysCloudPlatform folder and renaming it and also renaming the app but that doesn't seem to work properly..
Any tip would be greatly appreciated..
a. Option 1
You can have separate splunk instances and TA installed on each of them to do data pull operations from different qualys instances. As of now, TA does not allow you have multiple server configurations on same setup.
Setup X can have TA with X inputs enabled for Y Qualys Instance.
Been quite a while, so I don't remember what I ended up doing, but the possible solutions back then were :
Hope this helps!