To get the RESULTS field indexed in host detection input, do the followings:
- On TA Setup page, in VM Detection extra parameters, set
show_results=1
- Open
<TA DIR>bin/qualysModule/splunkpopulator/detectionpopulator.py
and find classHostDetectionPopulator
. - In this class, find
_process_root_element(self, elem)
method. - In that method, we have a list named
HostDetectionPopulator.detection_fields_to_log
. Its a list of fields to parse from detection tag. - In that list, add
"RESULTS"
at the end. As a best practice, add a comment describing why you edited this list. This will tell code to parse that XML tag as well and output it while printing the event data.