Installation

Where to install Qualys TA in my deployment?

LM_ACN
Engager

Good morning everyone,

for my customer, i have a Splunk deployment as follow:

1 Search head

3 Indexer in cluster

1 Monitoring Console/License Master/Master node

I need to integrate our Qualys solution with Splunk, but i'm reading the Technology Add-on should be installed on a forwarder. However, we do not have an Heavy forwarder.

Hence, could i install it on an Indexer? Is data replication still available for index qualys?

Thanks in advance,

Luca

Labels (2)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

A few points:

* Never install data collection module on Indexer for data collection.

* Recommendation is that you have to do the data collection on Heavy Forwarder in the case of TA Qualys.

* But if you don't want to install a separate instance, the next place would be to install on Seach Head. 

* If you install on SH you need to make sure that you are forwarding the Search Head logs to indexers - https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/Forwardsearchheaddata

 

Second point:

* The Add-on does not have an index anymore so you have to create a new index "qualys" as you mentioned from the Cluster Master as you do with other indexes.

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

A few points:

* Never install data collection module on Indexer for data collection.

* Recommendation is that you have to do the data collection on Heavy Forwarder in the case of TA Qualys.

* But if you don't want to install a separate instance, the next place would be to install on Seach Head. 

* If you install on SH you need to make sure that you are forwarding the Search Head logs to indexers - https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/Forwardsearchheaddata

 

Second point:

* The Add-on does not have an index anymore so you have to create a new index "qualys" as you mentioned from the Cluster Master as you do with other indexes.

0 Karma

LM_ACN
Engager

Thanks for the solution, Vatsal.

So i need to create two indexes, one on SH and the same on IDXs via Master node, that's right?

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

You need on both:

* Only the indexer will store the data.

* On search is not compulsory, but it is only needed so when you type index=, you will see qualys as suggestions on the Splunk search bar.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...