Can you confirm the following . I assume you are using /api/2.0/fo/asset/host/vm/detection/ API. Version of Qualys App Is the data input enabled on your Splunk instance ? Are you pulling vulnerabilities data for the first time or doing a delta pull ? if you already have data pulled from earlier API pull, the checkpoint file shall have the date of when the last run happened. Now, to answer your question 'Does it exist a way to force the Qualys App in Splunk to force the downloading of all the datas (not only the new datas) ? ' The checkpoint file is located at /opt/splunk/var/lib/splunk/modinputs/qualys/filename . If you are ok with pulling entire data again, delete that file specific to your input. Restart your splunk instance so that app repolls the data . Tips to check data pull The older app had a script, which was used to debug the data pulling operations. If your SPLUNK_HOME is /opt/splunk, then from SPLUNK_HOME/etc/apps/TA-QualysCloudPlatform run following command - /opt/splunk/bin/splunk cmd python ./bin/run.py -h Check if there are any API errors at /opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log Hope this helps solve your question. If not , request you to provide more information on the questions above. Thanks. ... View more