- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Qualys Technology Add-on (TA) for Splunk: Why are ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Qualys Technology Add-on (TA) for Splunk: Why are we getting "Error while posting to url=/servicesNS/nobody.../setupentity" during setup?
While trying to setup TA-QualysCloudPlatform, I'm getting the below error. I have the correct proxy and the Qualys server details set up.
Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/qualys/qualys_configure/setupentity
Why it is giving this error and how to resolve this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I only needed to rename the passwords.conf file and restart the service to update the password:
$SPLUNK_HOME$/etc/apps/TA-QualysCloudPlatform/local/passwords.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Similar to justinbarta, this is what worked for me:
0) Make a note of the settings that are currently working from the TA setup page (I copy and pasted it into Word)
1) Delete or move to a temp directory, the config files in: $SPLUNK_HOME$/etc/apps/TA-QualysCloudPlatform/local
(app.conf and qualys.conf)
2) Restart Splunk
3) Enter information in TA setup page again with new credentials
Re-installation of the TA was not needed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There's a new version 1.1.0 of Qualys TA for Splunk available in Splunkbase. I would suggest you upgrade to that. There's a major difference between 1.1.0 and earlier versions regarding how the API credentials are stored. That would help you get rid of this error.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm on 1.1.0 and have this error.
Any suggestions?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you see any error being reported in _internal index (or anywhere else)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As a second thought, have you tried deleting app.conf, qualys.conf from your /local directory, then restarting the Splunk and then trying to set it up again?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked for me. Deleting the conf files, restarting, and resetting up the app Worked !!
I did not need to reinstall.
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FYI this still occurred with 1.1.0 and still occurs with 1.2.3.
Qualys requires a password changed every 60-90 days.
Each time I'm forced to delete the the conf files and re-setup the app.
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
