@anthony reinke , Thanks it works as expected. ... View more

@nickhillscpl where can i locate the installer log from the client machine ... View more

@deepashri_123, Thanks for your response. Splunk process (splunkd.exe) is not running in server I have double checked from the server end as well but still i couldn't able to install the UF. Can you kindly help to check and help on the same. ... View more

Thanks I have modified the same and saved it but still i couldn't see any data. Also @harsmarvania57 commented there wont be any logs for Knowledge_base and the csv only will be getting updated but you have confirmed we can see logs getting indexed for knowledge_base so i am little bit confused. So kindly help to clarify on the same as well. ... View more

@harsmarvania57 , Thanks for your information. I can see that the file is getting updated in the mentioned location in regular basis. So we will be receiving only qualys:hostDetection am i right and no other sourcetypes will be reporting to Splunk. ... View more

@lakshman239 , Currently I have enabled the knowledge_base in Search Head server and the duration which i have selected is mentioned below: Cron Interval : */1 * * * * Start Date: 1999-01-01T00:00:00Z when i checked the internal indexes I am getting the error as below for knowledge_base" TA-QualysCloudPlatform: Date PID=47445 [MainThread] ERROR: TA-QualysCloudPlatform (knowledge_base) - API concurrency limit reached. Must sleep for 300 seconds and try again. Retry count: 1 And i think because of this issue i am not getting logs for knowledge_base so kindly help on the same. ... View more

@lakshman239 I just want to know will i be getting events in Search and Reporting App if i enable knowledge_base in data inputs in Search head or Heavy Forwarder. ... View more

@lakshman239 I have created the same in HF for knowledge_base and provided the cron schedule as 1m and date i left as default and pointed to main index and saved it. So when i navigated to inputs.conf i couldnt able to find the knowledge_base in inputs.conf and only i can able to find host_detection alone? Not sure where the lag is hence because of this we are not getting any logs for knowledge_base. ... View more

I can able to see qualys:hostDetection reporting in Splunk and I have configured the knowledge_base inputs in Heavy Forwarder but i cant able to see any logs related to knowledge base in Splunk. I have checked in the inputs.conf and i can able to see only host_detection inputs over there. Whereas i couldn't able to find knowledge base related inputs. so can you let me know how to get those logs into splunk. ... View more

I can able to see qualys:hostDetection reporting in Splunk and I have configured the knowledge_base inputs in Heavy Forwarder but i cant able to see any logs related to knowledge base in Splunk. I have checked in the inputs.conf and i can able to see only host_detection inputs over there. Whereas i couldn't able to find knowledge base related inputs. so can you let me know how to get those logs into splunk. ... View more

Hi Lakshman, Now i am getting logs from sourcetype host:Detection but not for knowledge base. So kindly let me know how to fix it asap. ... View more

yes already we have the indexer. ... View more

Hi lakshman239, Thanks for your response. This is what i have done till now. So kindly let me know if there is any lags. Recently we have downloaded and installed the (App: Qualys VM App for Splunk Enterprise) & (Add-On: Qualys Technology Add-on for Splunk) in my Search Head server. And also as recommended I have installed only the (Add-On: Qualys Technology Add-on for Splunk) in my Heavy Forwarder server. https://splunkbase.splunk.com/app/3141/ https://splunkbase.splunk.com/app/2964/ Post which I am not getting any logs for Qualys app for TA. The configuration has been done as mentioned below: Heavy Forwarder Configurations: 1.)Post installation of Qualys Technology Add-on for Splunk we have navigated to the settings and provided the URI information, username and password credentials and saved the same. Kindly note we didnt filled any other informations and just saved it. 2.) Similarly we have navigated to Data Inputs-->TA-Qualys Technology Add-On--> And added new. i.e. host_detection I have provided the cron interval as 24h and start date as 2018-01-01T00:00:00Z and the host name as heavyforwarder server name and index as qualys. By default i can see the index as main (Actually qualys index was not listing in the drop down) so i have updated the same at the backend in inputs.conf and I have moved to enabled state and restarted the Heavy forwarder. Search Head Configrations: 1.)Post installation of Qualys Technology Add-on for Splunk we have navigated to the settings and provided the URI information, username and password credentials and saved the same. Kindly note we didnt filled any other informations and just saved it. 2.)Similarly we have navigated to Data Inputs-->TA-Qualys Technology Add-On--> And added new. i.e. knowledge_base I have provided the cron interval as 24h and start date as 2018-01-01T00:00:00Z and the host name as heavyforwarder server name and i didnt changed as per search head server name and choosen the index as qualys and enabled the knowledge_base data inputs. 3.) Also I have installed the App (App: Qualys VM App for Splunk Enterprise) in our Search head server as mentioned above. Now my query is that i can able to see the dahboards in the app seems to be getting updated but when i search the query with index=qualys i couldnt able to fetch any data. So kindly help on the same. ... View more

Kindly help to check and help on this. ... View more

@lakshman239 I have installed the (App: Qualys VM App for Splunk Enterprise) & (Add-On: Qualys Technology Add-on for Splunk) in my Search Head server. And also I have installed the (Add-On: Qualys Technology Add-on for Splunk) in my Heavy Forwarder server. I have few queries how to setup the app? 1.) When I launch the setup of Add-On in Heavy Frowarder it asks for QUALYS URI , User name and password. So should i need to key in the URI, Username and password only in Heavy Forwarder or also I need to key in the username and password for Search Head as well? 2.)We just need VM Detection and no WAS findings. So as per the answer provided i have created the host_detection in Heavy Forwarder -->Data Inputs-->TA-Qualys-Add-On and added New. I have provided the cron as 24h and Start Date as 2018-01-01T00:00:00Z . And i just left it as (main) the default index and saved it. In the host column I have just left the Heavy forwarder server name as it is. Then I went to the backend and changed the index name as qualys. These steps i have done in Heavy Forwarder. From disabled state I have moved to enabled state. I have also restarted the Heavy Forwarder service as well. 3.)Similarly I have created knowledge_base in Search Head -->Data Inputs-->TA-Qualys-Add-On and added New. I have provided the cron as 24h and Start Date as 2018-01-01T00:00:00Z . And i just changed the host name as Heavy forwarder server name and kept the index name as Qualys. From disabled state I have moved to enabled state. 4.) So should i need to add both host_detection & knowledge_base in Heavy Forwarder as well as in Search head or should i leave it as it is. 5.) Also is it mandate to provide the squid proxy information in both search head and heavy forwarder during setup? Or else will it work as it is. Since when i search the data with index=qualys and hostname as heavyforwarder server i am not getting any information. ... View more

@lakshman239 I have installed the (App: Qualys VM App for Splunk Enterprise) & (Add-On: Qualys Technology Add-on for Splunk) in my Search Head server. And also I have installed the (Add-On: Qualys Technology Add-on for Splunk) in my Heavy Forwarder server. I have few queries how to setup the app? 1.) When I launch the setup of Add-On in Heavy Frowarder it asks for QUALYS URI , User name and password. So should i need to key in the URI, Username and password only in Heavy Forwarder or also I need to key in the username and password for Search Head as well? 2.)We just need VM Detection and no WAS findings. So as per the answer provided i have created the host_detection in Heavy Forwarder -->Data Inputs-->TA-Qualys-Add-On and added New. I have provided the cron as 24h and Start Date as 2018-01-01T00:00:00Z . And i just left it as (main) the default index and saved it. In the host column I have just left the Heavy forwarder server name as it is. Then I went to the backend and changed the index name as qualys. These steps i have done in Heavy Forwarder. From disabled state I have moved to enabled state. I have also restarted the Heavy Forwarder service as well. 3.)Similarly I have created knowledge_base in Search Head -->Data Inputs-->TA-Qualys-Add-On and added New. I have provided the cron as 24h and Start Date as 2018-01-01T00:00:00Z . And i just changed the host name as Heavy forwarder server name and kept the index name as Qualys. From disabled state I have moved to enabled state. 4.) So should i need to add both host_detection & knowledge_base in Heavy Forwarder as well as in Search head or should i leave it as it is. 5.) Also is it mandate to provide the squid proxy information in both search head and heavy forwarder during setup? Or else will it work as it is. Since when i search the data with index=qualys and hostname as heavyforwarder server i am not getting any information. ... View more