All Apps and Add-ons

Qualys Technology Add-on (TA) for Splunk: Why are we getting "Error while posting to url=/servicesNS/nobody.../setupentity" during setup?

srinathd
Contributor

While trying to setup TA-QualysCloudPlatform, I'm getting the below error. I have the correct proxy and the Qualys server details set up.

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/qualys/qualys_configure/setupentity

Why it is giving this error and how to resolve this?

0 Karma

stoomart
Explorer

I only needed to rename the passwords.conf file and restart the service to update the password:

$SPLUNK_HOME$/etc/apps/TA-QualysCloudPlatform/local/passwords.conf

0 Karma

TonyLeeVT
Builder

Similar to justinbarta, this is what worked for me:

0) Make a note of the settings that are currently working from the TA setup page (I copy and pasted it into Word)

1) Delete or move to a temp directory, the config files in: $SPLUNK_HOME$/etc/apps/TA-QualysCloudPlatform/local
(app.conf and qualys.conf)

2) Restart Splunk

3) Enter information in TA setup page again with new credentials

Re-installation of the TA was not needed.

0 Karma

prabhasgupte
Communicator

There's a new version 1.1.0 of Qualys TA for Splunk available in Splunkbase. I would suggest you upgrade to that. There's a major difference between 1.1.0 and earlier versions regarding how the API credentials are stored. That would help you get rid of this error.

0 Karma

justinbarta
Explorer

I'm on 1.1.0 and have this error.

Any suggestions?

0 Karma

prabhasgupte
Communicator

Do you see any error being reported in _internal index (or anywhere else)?

0 Karma

prabhasgupte
Communicator

As a second thought, have you tried deleting app.conf, qualys.conf from your /local directory, then restarting the Splunk and then trying to set it up again?

0 Karma

justinbarta
Explorer

This worked for me. Deleting the conf files, restarting, and resetting up the app Worked !!
I did not need to reinstall.
Thank you

0 Karma

justinbarta
Explorer

FYI this still occurred with 1.1.0 and still occurs with 1.2.3.

Qualys requires a password changed every 60-90 days.
Each time I'm forced to delete the the conf files and re-setup the app.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...