All Apps and Add-ons

Qualys Technology Add-on (TA) for Splunk: Why are we getting "Error while posting to url=/servicesNS/nobody.../setupentity" during setup?

srinathd
Contributor

While trying to setup TA-QualysCloudPlatform, I'm getting the below error. I have the correct proxy and the Qualys server details set up.

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/qualys/qualys_configure/setupentity

Why it is giving this error and how to resolve this?

0 Karma

stoomart
Path Finder

I only needed to rename the passwords.conf file and restart the service to update the password:

$SPLUNK_HOME$/etc/apps/TA-QualysCloudPlatform/local/passwords.conf

0 Karma

TonyLeeVT
Builder

Similar to justinbarta, this is what worked for me:

0) Make a note of the settings that are currently working from the TA setup page (I copy and pasted it into Word)

1) Delete or move to a temp directory, the config files in: $SPLUNK_HOME$/etc/apps/TA-QualysCloudPlatform/local
(app.conf and qualys.conf)

2) Restart Splunk

3) Enter information in TA setup page again with new credentials

Re-installation of the TA was not needed.

0 Karma

prabhasgupte
Communicator

There's a new version 1.1.0 of Qualys TA for Splunk available in Splunkbase. I would suggest you upgrade to that. There's a major difference between 1.1.0 and earlier versions regarding how the API credentials are stored. That would help you get rid of this error.

0 Karma

justinbarta
Explorer

I'm on 1.1.0 and have this error.

Any suggestions?

0 Karma

prabhasgupte
Communicator

Do you see any error being reported in _internal index (or anywhere else)?

0 Karma

prabhasgupte
Communicator

As a second thought, have you tried deleting app.conf, qualys.conf from your /local directory, then restarting the Splunk and then trying to set it up again?

0 Karma

justinbarta
Explorer

This worked for me. Deleting the conf files, restarting, and resetting up the app Worked !!
I did not need to reinstall.
Thank you

0 Karma

justinbarta
Explorer

FYI this still occurred with 1.1.0 and still occurs with 1.2.3.

Qualys requires a password changed every 60-90 days.
Each time I'm forced to delete the the conf files and re-setup the app.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...