I assume that you are using TA 1.2.2+
To get the RESULTS field indexed in host detection input, do the followings:
On TA Setup page, in VM Detection extra parameters, set show_results=0
Open bin/qualysModule/splunkpopulator/detectionpopulator.py and find class HostDetectionPopulator.
In this class, find _process_root_element(self, elem) method.
In that method, we have a list named HostDetectionPopulator.detection_fields_to_log. Its a list of fields to parse from detection tag. If you don't find it, you can copy one from the top of the same class.
In that list, add "RESULTS" at the end. As a best practice, add a comment describing why you edited this list. This will tell code to parse that XML tag as well and output it while printing the event data.
Save the file and restart your Splunk.
Let me draw your attention to the fact that, RESULTS in host detection API output could be multi-line text. As KV_MODE is set to auto for hostDetection input in props.conf, we are not sure how Splunk will treat the events when RESULTS field is multi-line text. It may or may not consider the multi-line text to be the part of same single event. The newline character might confuse Splunk's event detection.
... View more