All Apps and Add-ons
Highlighted

Will the Qualys VM App for Splunk Enterprise run on a search head cluster?

New Member

Will the Qualys VM App for Splunk Enterprise run on a search head cluster?

I don't see anything in the documentation about it. I know some of the third party apps we've used haven't supported running on a search head cluster and we've had to install them on a standalone.

0 Karma
Highlighted

Re: Will the Qualys VM App for Splunk Enterprise run on a search head cluster?

Explorer

Yes, install the TA on all the search heads in the cluster and enable knowledgebase on them. On your indexer or heavy forwarder install the TA and enable hostdetection and/or was_detection on it. The knowledgebase is a lookup table and needs to be on every search head you search from. Then you can install the Qualys VM App for SPLunk where you need it.

View solution in original post

Highlighted

Re: Will the Qualys VM App for Splunk Enterprise run on a search head cluster?

New Member

So the VM App should also be installed on every SH in the cluster?

0 Karma
Highlighted

Re: Will the Qualys VM App for Splunk Enterprise run on a search head cluster?

Path Finder

Yes. VM App should be installed on each of the search heads to be able to fetch reports on data indexed on the indexer.

0 Karma