All Apps and Add-ons
Highlighted

Splunk TA_QualysCloudPlatform

Builder

Hi All ,
i am trying to insert Qualys data to the splunk but no luck at all.
I Install the Addon to the Heavy forwarder, and APP to search head .
tried to put all the credentials in addon setup ,
after a minute i got this :

6/11/18 3:56:34.000 AM  
TA-QualysCloudPlatform: 2018-06-11 07:56:34 PID=20341 [MainThread] INFO: TA-QualysCloudPlatform [host_detection] - ERROR: Time interval input 86400 is not valid.Using default time interval 1d.
host =hf2 source =/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log sourcetype =ta_QualysCloudPlatform-too_small


6/11/18 3:56:30.000 AM  
TA-QualysCloudPlatform: 2018-06-11 07:56:30 PID=20350 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - ERROR: Time interval input 86400 is not valid.Using default time interval 1d.
host =hf2 source =/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log sourcetype =    ta_QualysCloudPlatform-too_small


6/11/18 3:56:30.000 AM  
TA-QualysCloudPlatform: 2018-06-11 07:56:30 PID=20350 [MainThread] ERROR: TA-QualysCloudPlatform [was_findings] - could not load API response. Reason: API ERROR. Code=UNAUTHORIZED Message=You do not have access to module WAS required by this API.
host =hf2  source =/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log sourcetype =ta_QualysCloudPlatform-too_small

Could someone explain me why im encountering this ?And how to solve this .
i read that "You do not have access to module WAS required by this API" how can i enable it for me to got data?
Thanks in advance.

0 Karma
Highlighted

Re: Splunk TA_QualysCloudPlatform

Communicator

@jadengoho, you need to contact your Qualys technical account manager (TAM) to enable WAS Access, and possibly API access as well. That will solve your "UNAUTHORIZED" issue.

The Qualys TA recommends using cron format to have more control on your data input execution time. So, it would be better if you switch to that. It still supports the older way of w/d/h/m/s (weeks/days/hours/minutes/seconds), but that works differently. When using these older options, the TA will sleep for that many duration before running again. (and trust me, that is risky!)
For the duration field, you set 86400, which does not fit in either of old way or cron way, hence that error.

0 Karma
Highlighted

Re: Splunk TA_QualysCloudPlatform

Builder

Hi prabhasgupte,
If 86400 is not the best fit , could you suggest what we should use ?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.