We have installed "Qualys TA" in our HF instance, configured the credentials and data inputs for "fim events" but when we search the events in our search head it doesn't show up.
We get this error message : [idx-123-abc.splunkcloud.com] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
Do we need to install "Qualys TA Add On" on both HF and SH in the distributed environment?
We would like to see only "FIM Events" in SH.
I am getting this error message now in the Search Head:
[MainThread] ERROR: Error in connection: [Errno -5] No address associated with hostname . Sleeping for 300 seconds and retrying. Retry count: 3