All Apps and Add-ons

Will the Qualys VM App for Splunk Enterprise run on a search head cluster?

nmarangella
New Member

Will the Qualys VM App for Splunk Enterprise run on a search head cluster?

I don't see anything in the documentation about it. I know some of the third party apps we've used haven't supported running on a search head cluster and we've had to install them on a standalone.

0 Karma
1 Solution

jleggett
Explorer

Yes, install the TA on all the search heads in the cluster and enable knowledgebase on them. On your indexer or heavy forwarder install the TA and enable hostdetection and/or was_detection on it. The knowledgebase is a lookup table and needs to be on every search head you search from. Then you can install the Qualys VM App for SPLunk where you need it.

View solution in original post

jleggett
Explorer

Yes, install the TA on all the search heads in the cluster and enable knowledgebase on them. On your indexer or heavy forwarder install the TA and enable hostdetection and/or was_detection on it. The knowledgebase is a lookup table and needs to be on every search head you search from. Then you can install the Qualys VM App for SPLunk where you need it.

View solution in original post

nmarangella
New Member

So the VM App should also be installed on every SH in the cluster?

0 Karma

nit123
Path Finder

Yes. VM App should be installed on each of the search heads to be able to fetch reports on data indexed on the indexer.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!