Where to install Qualys TA in my deployment?

[LM_ACN]

Good morning everyone,

for my customer, i have a Splunk deployment as follow:

1 Search head

3 Indexer in cluster

1 Monitoring Console/License Master/Master node

I need to integrate our Qualys solution with Splunk, but i'm reading the Technology Add-on should be installed on a forwarder. However, we do not have an Heavy forwarder.

Hence, could i install it on an Indexer? Is data replication still available for index qualys?

Thanks in advance,

Luca

[VatsalJagani · Accepted solution]

A few points:

* Never install data collection module on Indexer for data collection.

* Recommendation is that you have to do the data collection on Heavy Forwarder in the case of TA Qualys.

* But if you don't want to install a separate instance, the next place would be to install on Seach Head. 

* If you install on SH you need to make sure that you are forwarding the Search Head logs to indexers - https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/Forwardsearchheaddata

Second point:

* The Add-on does not have an index anymore so you have to create a new index "qualys" as you mentioned from the Cluster Master as you do with other indexes.

[LM_ACN]

Thanks for the solution, Vatsal.

So i need to create two indexes, one on SH and the same on IDXs via Master node, that's right?

[VatsalJagani]

You need on both:

* Only the indexer will store the data.

* On search is not compulsory, but it is only needed so when you type index=, you will see qualys as suggestions on the Splunk search bar.