Updating ta_QualysCloudPlatform credentials in Splunk Cloud

Available Languages

Updated:September 29, 2026
Document ID:SPLK046463

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

User can experience issues and difficulties in updating the credentials (username and password) for the " Qualys Technology Add-on (TA) for Splunk "

In the past this has required engaging Splunk Cloud support to remove a passwords.conf file.

Investigation

The  Qualys Technology Add-on (TA) for Splunk  is an App available on Splunkbase. 

As of January 20, 2023 the most recent version is: 1.10.7

Historically, in versions earlier than 1.8.7 it was necessary to engage Splunk Cloud support to remove the
$SPLUNK_HOME/etc/apps/TA-QualysCloudPlatform/local/passwords.conf  file if the password expired or if the username needed to be updated.

In referring to the User Guide and the  " What's New " section, at the end of the document,  the requirement to manually remove the passwords.conf  file has been addressed.

Page 63 / 79
Reset the username and password from the TA setup page:


Users however, may update their credentials but still fail to see the Qualys event data flowing back to their Splunk Cloud.
 


Resolution

If the Qualys event data is still not flowing back to Splunk Cloud after updating the credentials, then the splunkd session or daemon may need to be restarted, on the IDM (Inputs Data Manager) or Search Head (SH, under the Victoria Experience (VE)).

Utilize the following searches to check the status:

index=_internal  source=/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log host=idm*splunkcloud.com  password
index=_internal host=idm*splunkcloud.com   source=/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log  "< new USER-NAME > "


Under the Victoria Experience, users with the sc_admin role can restart splunkd on the SH, either through the UI or via ACS

Config and Restart

With the Classic Experience, Splunk Cloud support will still need to be engaged to recycle the splunkd on the IDM.

 

 

 

 


ACS Config Restarts
 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles