Splunk Enterprise

qualys add-on 500 error

aasabatini
Motivator

Hi All,

I configured the qualys add-on to receive data from a qualys cloud platform.
He worked  fine but today we didn't receive any event from qualys and on the internal logs we found this message.

TA-QualysCloudPlatform (ioc_events): 2021-04-08 14:04:08 PID=12050 [MainThread] ERROR: Unsuccessful while calling API [500 : Internal Server Error]. Retrying after 300 seconds: 

someone can help me?

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Labels (2)
Tags (3)
0 Karma

cmorenobuitrago
Explorer

Hi @aasabatini,

Do you have more info in log? I had a similar message and I had to modify a time parameter in the POST that performs the script.

Kind regards

0 Karma

aasabatini
Motivator

Hi @cmorenobuitrago 

 

I understood if the qualys server receive a lot of requests it can block and start to send 500 server error.

I resolved the issue filtering the requests here on the qualys add on settings

aasabatini_0-1621237898066.png

 

delete and create the inputs again, restart the splunk server and should works.

hope can help

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...