- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- When will the Qualys App for Splunk Enterprise be ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When will the Qualys App for Splunk Enterprise be compatible with search head clustering?
When will the Qualys App for Splunk Enterprise be compatible with search head clustering? We're currently running the app on a standalone search head and would like it integrated with our SHC. If there's any steps to get this working on a SHC, that'd be fantastic.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Knowledgebase dashboard is based on a lookup, lookup located on indexers, not on SHC, so we put a input monitor on the lookuphave and scheduled a basic search :
index=qualys | table * | outputlookup qualys kb.csv
Now all is working as expected
Regards,
Vince
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have opened a dev issue internally at Qualys to evaluate this. Currently no timeframe.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Problem is with knowledebase lookup
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What issues are you having. I am also facing some incomplete search results/warnings from qualys index deployed on a SH but we have a distributed environment.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why this can not be installed on a SHC ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For all intents and purposes, it can be provided you don't configure any of the data pulling. You need to configure the app on a standalone server to do the data pull to populate the index and run the app on the SHC only to query the index.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So does this mean that if you do it this way, the dashboards won't populate? I ask because I'm looking at installing this on an indexer (to avoid filling up a search head with data that the app pulls down), but I also want to install the app on the search heads for viewing the data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a similar issue. I am getting data from Qualys App from Splunk,created custom app and most of the dashboards are giving "empty csv error" on various indexers in random. Most of the searches/dashboards are giving consistent results. By the way, I have a distributed environment; not SHC.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any advice on deploying this in a distributed environment?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
