I've looked through some of the documentation for separating search heads from indexers depending on the number of concurrent searches and users. I'm wondering what a rough idea of the architecture and hardware requirements would look like to support: 10-20 GB per day 20 concurrent users 10 concurrent saved searches Thanks. Craig ... View more

If I grant a user read access to an application, is that user able to read events from indexes defined in the indexes.conf file of the app? Or do they need to be a member of a role that has been granted access to those indexes? Thx. Craig ... View more

I'm having a number of issues getting the QualysGuard app up and running. We're running 4.3.1 and 4.3.2. When starting Splunk when the app is installed, it claims there are errors in files contained in several of the PaxHeader directories, usually on line 0. On RHEL/CentOS, what are the python dependencies for the scripts to run? They were exiting abnormally, but it wasn't until I ran them from the command-line that I saw something like: File "download_qualys_kb.py", line 10, in from lxml import etree ImportError: No module named lxml Thx. Craig ... View more

I've tried installing the QualysGuard app in Splunk 4.3.1 and 4.3.2 and I keep getting syntax errors such as the following at startup: Error while parsing '/opt/splunk/etc/apps/QualysGuard/default/data/ui/views/PaxHeader/vuln_kb.xml': syntax error: line 1, column 0 Error while parsing '/opt/splunk/etc/apps/QualysGuard/default/data/ui/views/PaxHeader/overview.xml': syntax error: line 1, column 0 All of the PaxHeader XML files look something like this: 17 uid=223919950 20 ctime=1330543946 20 atime=1330543946 24 SCHILY.dev=234881026 23 SCHILY.ino=18306079 18 SCHILY.nlink=1 What do I need to do to get rid of those errors messages? ... View more