All Apps and Add-ons

Can I install Qualys Technology Add-on (TA) for Splunk on Indexer ??

kleber_silva
Engager

Hi Team

I have a Qualys Cloud Plataform and I need install app on Splunk, but my Heavy Forwarder is Windows Server.
Can I install Qualys TA app in Indexer server ?

Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Indexers should not also do data collection, they're supposed to be peas in a pot. By having one indexer be different from the rest you lose easy interchangeability, cluster-ability, and won't get loadbalanced searches on qualys data.

It'll work, but it'll suck.

I'd recommend standing up a Linux VM with a HF.

View solution in original post

0 Karma

nit123
Path Finder

You should install Qualys Technology Add-on (TA) for Splunk on the Forwarder (and enable data inputs that you need) only and no install required on Indexer. Only enable receiving on the indexer. The forwarder will forward data to indexer and the reporting apps installed on Search heads will talk to the indexer for the data on it.

Hope this information helps.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Indexers should not also do data collection, they're supposed to be peas in a pot. By having one indexer be different from the rest you lose easy interchangeability, cluster-ability, and won't get loadbalanced searches on qualys data.

It'll work, but it'll suck.

I'd recommend standing up a Linux VM with a HF.

0 Karma