About cmorenobuitrago

joelsatterley · ‎06-14-2023

Did you get a response/answer to this idea?

aasabatini · ‎05-17-2021

Hi @cmorenobuitrago I understood if the qualys server receive a lot of requests it can block and start to send 500 server error. I resolved the issue filtering the requests here on the qualys add on settings delete and create the inputs again, restart the splunk server and should works. hope can help

cmorenobuitrago · ‎01-20-2021

Late but valid for future queries 🙂 It is possible to forward raw events from the UF by adding the following info to the outputs.conf: sendCookedData = false

scelikok · ‎12-17-2020

@cmorenobuitrago, technically it works but it is better to have similar specs. - You can create an indexer cluster with 2 instances, minimum 3 instances are recommended if RF=2. - Distributed searches will run at the speed of lower-spec hardware. - You will also need another separate instance for Cluster Master. If this reply helps you upvote is appreciated.

Posts	5
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎10-05-2020

Online Status	Offline
Date Last Visited	‎03-14-2022 02:16 PM

Different hardware in the nodes of an index cluste...

How to achieve Splunk smtp authentication via API ...

Re: Splunk smtp authentication via API Key

Re: qualys add-on 500 error

Re: Using Splunk Forwarder to Forward to ArcSight

Re: Different hardware in the nodes of an index cl...

Are you a member of the Splunk Community?