All Apps and Add-ons
Highlighted

Qualys-TA ignores index setting in inputs.conf

Path Finder

Hi,

we are using version 1.4 of Qualys Technology Add-on (TA) for Splunk.
Our $SPLUNK_HOME/etc/apps/TA-QualysCloudPlatform/local/inputs.conf is:

[qualys://host_detection]
duration = 0 * * * *
index = vulnerabilities
start_date = 1999-01-01T00:00:00Z
disabled = 0

However the gathered information ist written to the main index:

[...]
TA-QualysCloudPlatform: 2019-02-18 16:00:31 PID=89627 [MainThread] INFO: TA-QualysCloudPlatform - Running for knowledge_base. Host name to be used: our_host. Index configured: main. Run duration: 0 * * * *. Default start date: 1999-01-01T00:00:00Z.
[...]

The TA is installed on a heavy forwarder. The index vulnerabilities is defined on our indexpeers, but not on the heavy forwarder.

How can i configure the TA to write to the index vulnerabilities instead of main?

Thanks!

  • Lorenz
0 Karma
Highlighted

Re: Qualys-TA ignores index setting in inputs.conf

Path Finder

Some simple checks could help

  • Did you restart the HF after changing the inputs.conf?
  • If you use btool on the HF and on the Indexers do you see the correct values? \splunkpath\splunk cmd btool list inputs --debug

Change the path for you splunk bin directory

Highlighted

Re: Qualys-TA ignores index setting in inputs.conf

Path Finder

Thanks for your input!

My restart command didn't work, because of the new splunk systemd service file.
After checking and restarting splunk manually everything works fine now.

0 Karma
Highlighted

Re: Qualys-TA ignores index setting in inputs.conf

SplunkTrust
SplunkTrust

Change your default start date to more recent one start_date = 2019-01-01T00:00:00Z

Restart HF and Indexers.

0 Karma
Highlighted

Re: Qualys-TA ignores index setting in inputs.conf

Path Finder

My restart command didn't work, because of the new splunk systemd service file.
After checking and restarting splunk manually everything works fine now.

View solution in original post

0 Karma