Splunk Enterprise

qualys add-on 500 error


Hi All,

I configured the qualys add-on to receive data from a qualys cloud platform.
He worked  fine but today we didn't receive any event from qualys and on the internal logs we found this message.

TA-QualysCloudPlatform (ioc_events): 2021-04-08 14:04:08 PID=12050 [MainThread] ERROR: Unsuccessful while calling API [500 : Internal Server Error]. Retrying after 300 seconds: 

someone can help me?

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Labels (2)
Tags (3)
0 Karma


Hi @aasabatini,

Do you have more info in log? I had a similar message and I had to modify a time parameter in the POST that performs the script.

Kind regards

0 Karma


Hi @cmorenobuitrago 


I understood if the qualys server receive a lot of requests it can block and start to send 500 server error.

I resolved the issue filtering the requests here on the qualys add on settings



delete and create the inputs again, restart the splunk server and should works.

hope can help


“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...