About lauraG85

lauraG85 · ‎08-27-2020

Hi everybody, I've attached an error that occurs recently on the splunk infrastructure based on a SHC of 3 members and an indexer cluster of 2 nodes. Sometimes, when I run a search on a SH I retrieve a result but if I repeat the same search - even after few hours - with the same conditions on the same SH I retrieve a different result! Then, again, after a few hours, the same search gives me back the same result had in the first run. The customer says that there aren't such network problem between the servers, even if the error message appears very clear. Have anyone an idea about this? Thanks in advance

lauraG85 · ‎08-13-2019

thank you to your answer. I've found, actually, in the official TA doc, that I could have some extra fields in the knowledge base,including the solution, modifing the kbpopulatory script. I will try it soon. thanks again 🙂

lauraG85 · ‎08-05-2019

Hi all, my name is Laura and I'm working with Qualys integration with Splunk with my company. I had found some issues and I hope that you can help me. In the Splunk Infrastructure it´s installed and configured the Splunk add-on for Qualys as well as reported in the official documentation. I see in Splunk the Qualys data about VM and WAS correctly, but the problems are: I couldn't find any field related to the single Qualys scan: so, I see a scanned IP address with all its vulnerabilities, but I don't know in which scan its vulnerabilities have been discovered (information that, obviously , I have in Qualys) The Splunk add-on had collected the Qualys Knowledge Base, but I only have the standard information (QID, TITLE, SEVERITY, CVE, etc.) and nothing about the details, such as the "Solution" or the "Exploitability" I’ve installed the Splunk Add-on for Qualys version 1.3.3; maybe the problems could be in the obsolete version? Thank you in advance.

lauraG85 · ‎10-08-2018

Hi guys, I have a distributed environment in which there are a cluster of indexers and 3 heavy forwarders. Each HF has an add-on/TA which is used to get data by API http connection. In this configuration, may I have duplicated events at the indexer? What should I do? May I install the add-on/TA on only one HF? In this case, I'd have problems with high availability... Thank you in advance laura

lauraG85 · ‎08-09-2017

Great! Thank you so much

lauraG85 · ‎08-09-2017

Great! Thank you so much

Posts	6
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎08-09-2017

Online Status	Offline
Date Last Visited	‎08-28-2020 06:52 AM

Reading error while waiting for peer XXX. Search r...

Splunk TA Qualys: many vulnerability informations ...

Will I get duplicate events if I have Multiple Hea...

Reading error while waiting for peer XXX. Search r...

Re: Splunk TA Qualys: many vulnerability informati...

Splunk TA Qualys: many vulnerability informations ...

Will I get duplicate events if I have Multiple Hea...

Re: What are the differences between append, appen...

Re: What are the differences between append, appen...