Splunk Enterprise

qualys add-on 500 error

aasabatini
Motivator

Hi All,

I configured the qualys add-on to receive data from a qualys cloud platform.
He worked  fine but today we didn't receive any event from qualys and on the internal logs we found this message.

TA-QualysCloudPlatform (ioc_events): 2021-04-08 14:04:08 PID=12050 [MainThread] ERROR: Unsuccessful while calling API [500 : Internal Server Error]. Retrying after 300 seconds: 

someone can help me?

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Labels (2)
Tags (3)
0 Karma

cmorenobuitrago
Explorer

Hi @aasabatini,

Do you have more info in log? I had a similar message and I had to modify a time parameter in the POST that performs the script.

Kind regards

0 Karma

aasabatini
Motivator

Hi @cmorenobuitrago 

 

I understood if the qualys server receive a lot of requests it can block and start to send 500 server error.

I resolved the issue filtering the requests here on the qualys add on settings

aasabatini_0-1621237898066.png

 

delete and create the inputs again, restart the splunk server and should works.

hope can help

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...