This template was updated on December 4th, 2025 to replace the original installer and API key rotator with a new, unified deployer automation. Please disable or delete any existing installers, and create a new automation, picking the Qlik Cloud monitoring app deployer template from the App installers category.

Installing, upgrading, and managing the Qlik Cloud Monitoring Apps has just gotten a whole lot easier! With a single Qlik Automate template, you can now install and update the apps on a schedule with a set-and-forget installer using an out-of-the-box Qlik Automate template. It can also handle API key rotation required for the data connection, ensuring the data connection is always operational.

Some monitoring apps are designed for specific Qlik Cloud subscription types. Refer to the compatibility matrix within the Qlik Cloud Monitoring Apps repository.

'Qlik Cloud Monitoring Apps deployer' template overview

This automation template is a set-and-forget template for managing the Qlik Cloud Monitoring Applications, including but not limited to the App Analyzer, Entitlement Analyzer, Reload Analyzer, and Access Evaluator applications. Leverage this automation template to quickly and easily install and update these or a subset of these applications with all their dependencies. The applications themselves are community-supported; and, they are provided through Qlik's Open-Source Software (OSS) GitHub and thus are subject to Qlik's open-source guidelines and policies.

For more information, refer to the GitHub repository.

Features

• Can install/upgrade all or select apps.
• Can create or leverage existing spaces.
• Programmatically verified prerequisite settings, roles, and entitlements, notifying the user during the process if changes in configuration are required, and why.
• Installs latest versions of specified applications from Qlik’s OSS GitHub.
• Creates required API key.
• Creates required analytics data connection.
• Creates a daily reload schedule.
• Reload applications post-install.
• Tags apps appropriately to track which are installed and their respective versions.
• Supports both user and capacity-based subscriptions.

Requirements

The user running the automation needs to have:

• API permission; see Permission settings — Features and actions | help.qlik.com.
• The tenant admin role; see Permissions granted by security roles | help.qlik.com.
• The audit admin role (when deploying the Answers Analyzer application); see Permissions granted by security roles | help.qlik.com.

Configuration

Update just the configuration area to define how the automation runs, then test run, and set it on a weekly or monthly schedule as desired.

Configure the run mode of the template using 7 variable blocks

Users should review the following variables:

1. configuredMonitoringApps: contains the list of the monitoring applications which will be installed and maintained. Delete any applications not required before running (default: all apps listed).
2. refreshConnectorCredentials: determines whether the monitoring application REST connection and associated API key will be regenerated every run (default: true).
3. reloadNow: determines whether apps are reloaded immediately following updates (default: true).
4. reloadScheduleHour: determines at which hour of the day the apps reload at for the daily schedule in UTC timezone (default: 06)
5. sharedSpaceName: defines the name of the shared space used to import the apps into prior to publishing. If the space doesn't exist, it'll be created. If the space exists, the user will be added to it with the required permissions (default: Monitoring - staging).
6. managedSpaceName: defines the name of the managed space the apps are published into for consumption/ alerts/ subscription use.If the space doesn't exist, it'll be created. If the space exists, the user will be added to it with the required permissions (default: Monitoring).
7. versionsToKeep: determines how many versions of each staged app is kept in the shared space. If set to 0, apps are deleted after publishing. If a positive integer value other than 0, that many apps will be kept for each monitoring app deployed (default: 0).

App management:

If the monitoring applications have been installed manually (i.e., not through this automation), then they will not be detected as existing. The automation will install new copies side-by-side. Any subsequent executions of the automation will detect the newly installed monitoring applications and check their versions, etc. This is due to the fact that the applications are tagged with "QCMA - {appName}" and "QCMA - {version}" during the installation process through the automation. Manually installed applications will not have these tags and therefore will not be detected.

FAQ

Q: Can I re-run the installer to check if any of the monitoring applications are able to be upgraded to a later version?

A: Yes. The automation will update any managed apps that don't match the repository's manifest version.

Q: What if multiple people install monitoring applications in different spaces?

A: The template scopes the application's installation process to a managed space. It will scope the API key name to `QCMA – {spaceId}` of that managed space. This allows the template to install/update the monitoring applications across spaces and across users. If one user installs an application to “Space A” and then another user installs a different monitoring application to “Space A”, the template will see that a data connection and associated API key (in this case from another user) exists for that space already. It will install the application leveraging those pre-existing assets.

Q: What if a new monitoring application is released? Will the template provide the ability to install that application as well?

A: Yes, but an update of the template from the template picker will be required, since the applications are hard coded into the template. The automation will begin to fail with a notification an update is needed once a new version is available.

Q:I have updated my application, but I noticed that it did not preserve the history. Why is that?

A: Each upgrade may generate a new set of QVDs if the data models for the applications have changed due to bug fixes, updates, new features, etc. The history is preserved in the prior versions of the application’s QVDs, so the data is never deleted and can be loaded into the older version. 

After upgrading Qlik Sense Enterprise on to Windows May 2022 patch 11 or August 2022 patch 6, reload tasks may be listed as failed even if the script log completes successfully.

The engine logs (Engine\System Service_Engine_TIMESTAMP.log):

WARN QLIKSERVER XXXXX-b9df-48dc-a868-XXXX 20230130T151057.522+0100 12.1386.6.0 Command=Doc::DoSave;Result=409;ResultText=Warning: Conflict 0 0 1111411 QLK QLIKUSER XXXXX-47c2-4ea4-94c2-XXXXXX XXXXX-95f5-46e2-8b92-XXXXX ApplicationQLIK Engine Not available Doc::DoSave Doc::DoSave 409 Object write failed. XXXXXX-b9df-48dc-a868-XXXXX

The repository logs (Repository\Trace log called System_Engine_TIMESTAMP.log):

2072 20230129T193052.695+0100 ERROR QLIKSERVER System.Repository.Repository.Core.Repository.Common.TransactionUtility 185 XXXXX-d7f0-4983-8905-XXXX QLK\QLIKSERVICEUSER Error when committing The custom property value already assigned at 

Environment

Qlik Sense Enterprise on Windows May 2022, August 2022

Resolution

Warning: Modifying the Qlik Sense Repository manually is generally not supported by Qlik. Any modifications need to be done with extreme caution. Always back up your Qlik Sense database before committing changes.

This is caused by custom properties being duplicated and injected multiple times. The fix requires these duplicates to be removed.

1. Back up your Qlik Sense site. See Backup and restore Qlik Sense Enterprise on Windows.
2. Connect to the QSR Postgres database. See How to connect to the Qlik Sense Enterprise on Windows or Qlik NPrinting PostgreSQL database .
3. Identify the list of duplicate custom properties. Use the following query:
   

   SELECT "ID", "Definition_ID", "Value", "App_ID" FROM
   ( SELECT "ID", "Definition_ID", "Value", "App_ID",
   ROW_NUMBER() OVER ( PARTITION BY "Value", "Definition_ID", "App_ID"
   ORDER BY "App_ID" DESC, "ID"
   ) rn
   FROM "CustomPropertyValues"
   ) t1 WHERE rn > 1 AND "App_ID" IS NOT null;

   
   
4. If you found any duplicates in the query above, use the below cleanup script:
   

   DELETE FROM "CustomPropertyValues"
   WHERE "ID" IN
   ( SELECT "ID" FROM
      ( SELECT "ID", "Definition_ID", "Value", "App_ID",
               ROW_NUMBER() OVER ( PARTITION BY "Value", "Definition_ID", "App_ID"
                                   ORDER BY "App_ID" DESC, "ID"
                                 ) rn
        FROM "CustomPropertyValues"
      ) t1 WHERE rn > 1 AND "App_ID" IS NOT null);​

   
   
   

Cause 

This is caused by a fix QB-9058, which has been introduced in May 2022 Patch 11 and August patch 6:

Qlik Sense: Possible to apply same custom property value more than once to a single app:

Fixed an issue where it was possible via QMC or API request to apply the same custom property value belonging to the same custom property definition more than once to the same Qlik Sense app/qvf.

So from those patch it is no longer possible to have any application with a duplicate custom property.

Duplicate properties will be shown as errors in the Qlik Sense log:

The custom property value already assigned

The diagnosis script above will also expose duplicate custom properties

Internal Investigation ID(s) 

• QB-21006
• QB-17917
• QB-9058

Capability

While there is a lot of hype around #AI in the world, there is no denying it's power ... for the RIGHT USE CASES.

Imagine the ability to ask Natural Language questions of the data you have in ServiceNow without needing to pre-load the data in Qlik. Pretty cool in any situation. But downright required in situations where there are reasons for the data to not egress out of ServiceNow. 

ServiceNow provides something called AI Agents, that are very similar to Qlik Answers, in that users are able to simply ask natural language questions about their data. You gotta LIKE that.

Also like Qlik Answers, ServiceNow AI Agents are able to be called via a well documented REST API. Which means you can consume those endpoints from within Qlik. You gotta LOVE that. 

Scenario

That capability provides tremendous value for our joint customers for so many scenarios. The one I will focus on in this article is regarding a Customer Success Manager working in a Qlik.

The Qlik application they utilize has lots and lots of data that they can do analytics with using traditional dashboarding and visualization. Of course they simply open Qlik Answers to ask questions of any data that is already loaded in the application. Assume for this scenario that the CSM is focusing on customer renewals for whatever product they might be selling. 

They come across an account that is due for renewals soon, they can see that Qlik Predict has predicted that the account is likely to churn, and has ranked their health very low. They can see the NPS scores for the account have dropped significantly. Oh boy, they need to turn that frown, upside down. 

Before they call the customer, they would also like to know if they have any outstanding trouble incidents/problems. 

Not hard to imagine this use case. Having access to that information provides vital insights that the CSM needs to know how to effectively communicate with the customer when they call. How they get access also matters. They could always stop their day job, working in Qlik, and go login to ServiceNow, become a master in filtering and find the incidents that are open for this specific customer. But with the handy dandy Qlik Sense extension called ServiceNow Agent Dream shared in this post they don't have to. They simply ask "Do they have any open incidents?" 

Scenario Demonstration

I've created a simple Next - Next - Finish type demonstration that allows you to see this scenario in action. You simply start the tour, and press Next when you are ready to advance through it. 

Walk through the CSM Demonstration

ServiceNow AI Agent Dream Setup

If your goal was simply understand the capability and the scenario so you know "what's possible" then you can stop reading. But if your goal is to actually try and get this dream capability up and running in your environment then please continue. The next link is a very similar demo where you simply press Next to advance through, that walks you through how to create the same ServiceNow AI Agent that I used in my scenario. 

Walk through creating a ServiceNow AI Agent

Now that you at least understand the capability it's time to dive into the 3 attachments for this post:

1. Incident_Intelligence_Agent_Guide.docx - This document will walk you through how to build the ServiceNow AI agent since you will need 1 in your environment to call. Please refer to ServiceNow help on the topic or your BFF Claude/ChatGPT for help should anything in your environment differ from mine. 

2. ServiceNowAgentDream_Setup_Guide.docx - This document will walk you through how to install the ServiceNow Agent Dream extension and then how to configure it. OAuth authentication is required for ServiceNow AI Agents, so I walk you through how to do that as well. 

3. ServiceNowAgentDream.zip - This is the Qlik Sense extension that you need to download and install in your Qlik Sense environment/tenant. 

Qlik Replicate task data synchronization failed to replicate data from SQLMI to an AS400 (iSeries/DB2) target via an ODBC endpoint, with new tasks failing during initialization when generating and executing CREATE TABLE statements for internal control tables (such as attrep_apply_exceptions) on the target.

Example error:

Attributes not valid

Detailed log:

Stream component 'st_0_AS400 - PSFWEB - MC - Target' terminated
Stream component failed at subtask 0, component st_0_AS400 - PSFWEB - MC - Target
Error executing command
Cannot create Exception table
Cannot create Special table
execute create table statement failed, statement CREATE TABLE "attrep_apply_exceptions" ( "TASK_NAME" VARCHAR(128) NOT NULL, "TABLE_OWNER" VARCHAR(128) NOT NULL, "TABLE_NAME" VARCHAR(128) NOT NULL, "ERROR_TIME" TIMESTAMP NOT NULL, "STATEMENT" CLOB(0) NOT NULL, "ERROR" CLOB(0) NOT NULL )
RetCode: SQL_ERROR SqlState: 42000 NativeError: -604 Message: [IBM][System i Access ODBC Driver][DB2 for i5/OS]SQL0604 - Attributes not valid.
Failed (retcode -1) to execute statement: CREATE TABLE "attrep_apply_exceptions" ( "TASK_NAME" VARCHAR(128) NOT NULL, "TABLE_OWNER" VARCHAR(128) NOT NULL, "TABLE_NAME" VARCHAR(128) NOT NULL, "ERROR_TIME" TIMESTAMP NOT NULL, "STATEMENT" CLOB(0) NOT NULL, "ERROR" CLOB(0) NOT NULL )

Resolution

Set Provider Syntax to DB2 in the target endpoint.

• Go to your Target Endpoint
• Switch to the Advanced tab
• Set the correct Provider Syntax 

  Engage Qlik's Professional Services for more direct assistance for custom ODBC endpoint setups due to provider-specific SQL syntax rules.

Cause

SQL0604 / NativeError -604 means Db2 for IBM i rejected an invalid data-type attribute, typically a column or expression with an unsupported length, precision, scale, timestamp precision, or ALLOCATE value. This is normally an SQL-definition problem, not a network or ODBC connection problem. (on QR V2023.5.0.322)

The task fails because Qlik Replicate generates this invalid Db2 for i definition:

"STATEMENT" CLOB(0) NOT NULL,
"ERROR"     CLOB(0) NOT NULL

On Db2 for IBM i, a CLOB length must be between 1 byte and 2 GB. Therefore, CLOB(0) produces SQL0604 / -604 – Attributes not valid.  Other column definitions are valid.

That indicates the target endpoint is missing or uses the wrong configuration for the Endpoint --> Advanced tab --> Provider syntax setting.
 

Environment

• Qlik Replicate

Creating a Target Logical System fails while executing the TCODE in SAP QTQVC/EXTREP, citing SAP Extractor Source Error /QTQVC/EXTR060.

See Activate the extractors for Replicate for the documented setup steps. 

Resolution

• To verify if you have sufficient IDOCs available, use TCODE WE20 or WE02. Contact your SAP Basis team for details on the IDOC limit for your environment.
• To verify if the Target Logical System is already defined, check the /QTQVC/SRCLOGSYS table.
• To verify if the IDOC was created at all, check the RSBASIDOC table.

Cause

Two likely root causes:

• The SAP environment has run out of allocated IDOCs (Intermediate Docs)
• A Logical Target System with the same name already exists

Environment

• Qlik Replicate

Qlik product downloads are accessible through the Qlik Download page on Qlik Community, which embeds a Qlik Cloud app. However, while the Qlik Community presents the download experience, GitHub stores and serves the installer assets as the backend distribution platform.

As a result, download URLs do not use a qlik.com domain.

This article explains the download flow and practical allowlisting options, specifically for use cases requiring exceptions for download destinations in firewalls, proxies, or endpoint security tools.

Download Sequence

While the visible link is a GitHub URL, the file always downloads from a second, dynamically generated URL on a different host. This two-step redirect is standard GitHub behavior for release downloads, not something specific to Qlik, and you must account for it when you define allowlisting rules.

When you select a download link, the request follows a fixed sequence of steps before Qlik delivers the file:

1. The customer selects a Download Link on the Qlik Download page.
2. The link points to a human-friendly GitHub release download URL, in the form: https://github.com/qlik-download/<repo>/releases/download/<tag>/<filename>
3. The customer's browser sends a request to that GitHub URL.
4. GitHub returns an HTTP redirect, not the file, to a technical delivery URL hosted on release-assets.githubusercontent.com.
5. The redirect URL includes a repository identifier, an asset path, and a signed, time-limited query string that GitHub generates at request time. Because GitHub generates these values dynamically per request, and they expire after a short period, no one can know or predict the final redirect URL in advance.

   As a result, the Qlik Download page can't publish it as a static link, and can only link to the initial GitHub release URL. The redirect must happen at download time.

   The visible link is a GitHub URL, but the file always downloads from a second, dynamically generated URL on a different host. This two-step redirect is standard GitHub behavior for release downloads, not something specific to Qlik, and you must account for it when you define allowlisting rules.
6. Your browser follows the redirect automatically, and the installer file downloads from that final release-assets.githubusercontent.com URL.

Allowlisting Reference

The following table lists, per product, the stable GitHub download URL prefix and the corresponding redirect URL prefix on release-assets.githubusercontent.com. These prefixes are predictable, so you can safely use them as allowlisting rules. GitHub generates the remainder of each URL, the path segment and signed query string, dynamically per request, so you can't predict it.

The Upgrade of Qlik Sense Enterprise for Windows fails on the Qlik Dispatcher Service with:

ERROR: schema "MobilityRegistrarService" already exists
ERROR:  schema "qlik_notifier_service" already exists

Environment

• Qlik Sense Enterprise on Windows 

Resolution

The solution to this issue requires modifications to the database. Prior to applying the solution, take a backup. See Backup and Restore.

To resolve this, we will rename the 'qlik_mobility_registrar_service' (i.e. qlik_mobility_registrar_service_old) as well as the 'qlik_notifier_service' schema prior to performing the installation/upgrade.

This will allow for the creation of the schema. In multi-node environments, it is suggested to rename the schema prior to each rim node installation/upgrade.

To rename the schema, perform the following steps:

1.  Log on to the server running the PostgreSQL server
2. Use pgAdmin to access the database (Installing and Configuring PGAdmin 4 to access the PostgreSQL database used by Qlik Sense or NPrinting)
3. Expand the SenseServices database so that Schemas is displayed and then expand Schemas so that the qlik_mobility_registrar_service schema is displayed
4. Right-click the qlik_mobility_registrar_service and choose Properties
5. Rename the qlik_mobility_registrar_service and click Save (i.e.  qlik_mobility_registrar_service_old)
6. Repeat 4 to 5 for qlik_notifier_service.
7. Run the Qlik Sense server installer on the Rim node

Cause 

The upgrade from November 2019 to February 2020 failed on the dispatcher service with the following error on the installation log:

CAQuietExec:  MobilityRegistrarService configuration started.
CAQuietExec:  WARNING: Skiping the database initialization. No superuser or password 
CAQuietExec:  specified.
CAQuietExec:  Creating schema 'qlik_mobility_registrar_service'.
CAQuietExec:  True
CAQuietExec:  Error executing database command "CREATE SCHEMA 
CAQuietExec:  "qlik_mobility_registrar_service" AUTHORIZATION "qliksenserepository"": ERROR: 
CAQuietExec:   schema "qlik_mobility_registrar_service" already exists
CAQuietExec:  At C:\Program Files\Qlik\Sense\MobilityRegistrarService\install\install-utils\P 
CAQuietExec:  ostgres.ps1:113 char:11
CAQuietExec:  +           throw  "Error executing database command  ...
CAQuietExec:  +           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CAQuietExec:      + CategoryInfo          : OperationStopped: (:) , Exception
CAQuietExec:      + FullyQualifiedErrorId : Error executing database command "CREATE SCHEMA  
CAQuietExec:     "qlik_mobility_registrar_service" AUTHORIZATION "qliksenserepository"": ER  
CAQuietExec:    ROR:  schema "qlik_mobility_registrar_service" already exists
CAQuietExec:   
CAQuietExec:  Error 0x80070001: Command line returned an error.
CAQuietExec:  Error 0x80070001: QuietExec Failed
CAQuietExec:  Error 0x80070001: Failed in ExecCommon method
CustomAction CA_SetupQMR returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

When SMTP is used to send outgoing mail and the legacy DigiCert G1 SSL cert provided by Microsoft to Qlik is still in use, emails sent from Qlik Cloud will fail. 
 

Resolution

The SMTP endpoint must present a chain anchored to a currently trusted DigiCert root (for example: Global Root G2, with the correct intermediate), supported by DigiCert and already used by modern Microsoft/O365 endpoints.
 

Cause

Qlik Cloud does not support the legacy DigiCert Global Root CA (G1), which was dropped from the SMTP bundle due to security concerns (see Review the G1 root removal advisory | docs.digicert.com).

This blocks the use of a locally issued certificate when the endpoint relies on G1.

Internal Investigation ID(s)

SUPPORT-10911

Environment

• Qlik Cloud

The Qlik Sense on Windows Content Monitor is intended for Qlik Administrators. Its purpose is to monitor and analyze your Qlik Sense content, including app usage, resource consumption, and data sources. This helps with governance, optimization, and identifying unused content.

Requirements

• Platform: Qlik Sense Enterprise on Windows
• Version: November 2025 onwards 
• Availability: Bundled with installation from version November 2025 onwards
• If you are running previous versions of Qlik Sense Enterprise on Windows, the Content Monitor is also available on Qlik's Downloads page here: Content Monitor (download page)
  • This must be manually installed, and a weekly reload is recommended.
  • The downloaded version is supported from Qlik Sense version Feb 2020.

Core Documentation

All technical details can be found in the two attached documents. These are your primary resources.

Qlik Sense Content Monitor User Guide

• • What it covers: A detailed, sheet-by-sheet explanation of the entire app. It describes what every KPI, chart, and table means for sections like "Weekly Summary," "Snapshot," "Applications," "Sessions," "Task Executions," "File Inventory," and "Infrastructure."

  • Use Case: 

    • Guiding a customer on how to read and interpret the data.

    • Answering customer questions like, "What does the 'Session Concurrency' sheet show?" or "How do I read the 'File Inventory' sheet?"

  • See the attached Qlik Sense Content Monitor User Guide

Configuration Guide

• • What it covers: This is the primary guide for setup and reload issues. It contains:

    • Detailed definitions for all script parameters (e.g., vCentralNodeHostName, vVirtualProxyPrefix, vServerLogFolder).

    • Performance tuning options (e.g., vFileScanMaxDuration, vAppRetrievalLoop, exclusion lists).

    • A "Trial Mode" section is used for troubleshooting initial reload failures.

    • A "Troubleshooting" section.

  • Use Case:

    • New installations.

    • Troubleshootings.

    • Tuning performance for long reloads.

  • See the attached Qlik Sense Content Monitor Configuration Guide

Environment

• Qlik Sense Enterprise on Windows

Loading data from the source (PostgreSQL/Raw) to the Teradata target via JDBC using the tDBOutput component in Talend Studio may lead to the following write error:

[ERROR] tDBOutput - [Teradata Database] [TeraJDBC 20.00.00.58] [Error 6706] [SQLState HY000] The string contains an untranslatable character.

Environment

• Talend Studio

Resolution

• DDL Update: Update the non-Unicode table column definitions on the Teradata target to unified Unicode-based types (e.g., NVARCHAR / CHARACTER SET UNICODE).
• JDBC Configuration: Apply CHARSET=UTF8 to the JDBC connection string to align session parameters with incoming data streams.

After applying the changes, verify the write operations. Data loading will resume successfully without untranslatable character errors.

Cause

The issue was identified as a character-set conversion failure. Analysis of the Teradata table DDL revealed that certain target columns were configured with non-Unicode definitions (e.g., standard VARCHAR without Unicode encoding), preventing Teradata from storing multi-byte character strings passed from Talend during insertion.

Environment

• Talend Studio

Some versions of Qlik Sense Desktop show a significant delay when opening the hub after authenticating through Qlik Cloud.

Affected versions

• Qlik Sense Desktop November 2025 SR 1
• Qlik Sense Desktop May 2026 IR

Resolution

A fix to QCB-35278 is expected in August 2026. 

Information provided on this defect is given as is at the time of documenting. For up-to-date information, please review the most recent Release Notes for updates on ID QCB-35278.

Cause

Defect QCB-35278 is caused by the Qlik Cloud backend introducing a delay during the login process.

Internal Investigation ID(s)

QCB-35278, SUPPORT-10476

Do Qlik Products support the use of Standalone Managed Service Accounts (GMSA)?

At this time, QlikView, Qlik Sense Enterprise on Windows, and Qlik NPrinting do not support the use of managed service accounts.

For general service account requirements, see:

QlikView Service Account Requirements 
Qlik Sense Enterprise on Windows Service Account Requirements 
Qlik NPrinting user account requirements 

Environment

Qlik Sense Enterprise on Windows 
Qlik NPrinting 
QlikView 

When using Cidaas as an OIDC Identity Provider in Qlik Cloud, the first login works successfully. After logging out and attempting to log in again in the same browser session, authentication fails with the following error:

STATE-1 – State verification failed
State parameter not valid, try accessing the tenant url directly

The issue does not occur if the browser is completely closed and reopened before the second login attempt.

Resolution

To resolve the post-logout STATE-1 error with Cidaas, improve logout session cleanup by configuring proper Post-Logout Redirect and End Session handling on both sides.

1. In the Qlik Cloud Administration center, go to  Identity Providers and edit your Cidaas OIDC configuration.
2. Set the Post logout redirect URI to your tenant root URL (e.g. https://your-tenant.de.qlikcloud.com/).
3. Configure the End session endpoint with the value provided by Cidaas (typically something like https://your-cidaas-domain/oauth2/endsession).
4. In your Cidaas tenant configuration:
   • Add the Qlik tenant URL(s) to the allowed Post-logout redirect URIs.
   • Ensure the client/application supports OIDC RP-Initiated Logout.
5. Save changes and test the full flow: Login > Logout (via Qlik UI) > reopen the tenant URL in the same browser.
6. As a temporary workaround, advise users to fully close the browser after logging out or use Incognito mode.

Always test logout flows thoroughly with custom IdPs like Cidaas. Use exact URLs (no trailing slash mismatches) for Redirect URI and Post-logout redirect URI.

Cause

This issue is specific to the interaction between Qlik Cloud’s strict OIDC state validation and Cidaas logout behavior. Qlik Cloud uses a short-lived browser cookie (eas.rfp.<random>) tied to the OAuth2/OIDC "state" parameter for CSRF protection.

During the first login, everything works. However, when the user logs out of Qlik, the session cookies (including eas.rfp) are not fully cleared or invalidated on the browser side. On the subsequent login attempt in the same browser:

• Cidaas redirects back with a new state parameter.
• Qlik’s edge-auth service still sees stale session context from the previous login.
• This causes a mismatch ("State not valid" + often "Session not found" or "tenantId does not match").

Fully closing the browser clears the residual cookies, which is why a fresh browser session works. This is a common pattern when Post-logout redirect and End Session endpoints are not properly configured for clean session termination.

Related Content

• Qlik Sense SaaS: Authentication fails when using cidaas as an Identity Provider (Groups issue)

Environment:

• Qlik Cloud
• Cidaas as custom OIDC Identity Provider

The information in this article is provided as-is and will be used at your discretion. Depending on the tool(s) used, customization(s), and/or other factors, ongoing support on the solution below may not be provided by Qlik Support.

The same expression with aggregation functions and an Inter-record function can yield different results depending on the situation, especially when data is loaded from different QVDs.

Affected Inter-record functions can be Above(), Below(), Bottom(), Top(), NoOfRows().

The results shown in the app when it is loaded on-premises may differ from those when the app is loaded on Qlik Cloud.

An example of an expression that can be affected by the problem is:

Aggr(RangeSum(Above(Sum(CHK_ORDER_ID), 0, RowNo())), CUSTOMER_ID), '')

Resolution

To avoid this problem, add a structured sort parameter directly inside the Aggregation function, forcing a consistent evaluation order regardless of how the underlying data arrived.

For example, the formula above should be:

Aggr(RangeSum(Above(Sum(CHK_ORDER_ID), 0, RowNo())), (CUSTOMER_ID, (Numeric, Ascending)))

Because Above() is used, sorting on other columns in the same straight table is disabled by design in Qlik Cloud. The same is valid for other functions, like Below().

The Aggr() sort parameter controls the order used for the running total calculation itself, but you will need to keep that sort definition aligned with the order you actually want the counter to reflect. If CUSTOMER_ID is a date or text field rather than numeric, replace (Numeric, Ascending) with (Text, Ascending) or (Date, Ascending) accordingly.

Cause

Inter-record functions depend entirely on the physical row order of the data as the engine sees it, and that order can change for different reasons, producing inconsistent results. For example, on-premises and Qlik Cloud can handle the internal sort of concatenated data differently, which explains why the counter is not the same in the two environments.

A reference to the problem can be found in the Community post Solved: Above Function in qlik sense.

Environment

• Qlik Cloud Analytics
• Qlik Sense Enterprise on Windows

Qlik Data Gateway is shown as disconnected. Reviewing the Qlik Data Gateway logs shows:

System.Net.WebSockets.WebSocketException (0x80004005): The server returned status code '401' when status code '101' was expected.

Resolution

The error indicates Qlik Data Gateway may not be installed on a dedicated machine, that the time shared between hosts may be incorrect, or that the setup was not completed correctly.

Do not install Qlik Data Gateway on the actual server or on a server that hosts Qlik Sense Enterprise on Windows or, for example, Qlik Data Transfer.

Local Time on one host

Verify that both hosts use the same time zone and their times are aligned.

If the Windows server time is unaligned (due to, for example, an internal battery issues), the Direct Access Gateway will disconnect.

Incorrect setup

In rare cases, Qlik Data Gateway may not have been set up correctly. In this case, follow the below instructions on how to perform a clean re-install:

1. Uninstall Qlik Data Gateway.
   
   
2. Restart your server.
   
   
3. Reinstall Qlik Data Gateway but do not start the Qlik Data Gateway service and do not change the service account.
   
   
4. Run this below command in an elevated command prompt and from C:\Program Files\Qlik\ConnectorAgent\ConnectorAgent
   
   connectoragent qcs set_config --tenant_url XXXX.YYYY.qlikcloud.com
   
   Where XXXX= is your Tenant Name and YYYY= is your Tenant Region.
   
   
5. Run:
   
   connectoragent qcs generate_keys
   
   
6. Run:
   
   connectoragent qcs get_registration
   
   
7. Copy the key and go to your Tenant's Management Console and data-gateway URL (example: https://YOURTENANTNAME.YOURREGION.qlikcloud.com/console/data-gateway/)
   
   
8. And create your deployment as described in Installing Qlik Data Gateway - Direct Access
   
   
9. After all the above is finished, start the Qlik Data Gateway service.

Related Content 

System requirements | Qlik Cloud Help 

Environment

Qlik Data Gateway  

The Qlik Reporting Add-in may display the following error when connecting to a Qlik Cloud tenant from Microsoft Word, Excel, or PowerPoint:

The security settings in your browser prevent us from creating a dialog box. Try a different browser, or configure your browser so that [Qlik Cloud Tenant] and the domain shown in your address bar are in the same security zone.

The problem is specifically seen with Microsoft Edge.

Resolution

To resolve this issue:

• Switch to a different browser, such as Firefox
• Or configure Microsoft Edge to allow the pop-up:
  1. In Microsoft Edge, open Settings
  2. Type Pop-ups and redirects in the settings search bar
  3. Deselect Blocked as the Default behavior or add the Qlik Cloud tenant URL in the Allowed to send pop-ups and use redirects section. 
     
     Speak to your IT administrator for assistance if necessary.
     
     

Cause

The Microsoft add-in is a pop-up utility that requires permission from the MS Edge browser to open. 

Environment

• Qlik Cloud Reporting Add-in

The following error may trigger when executing a job in Qlik Talend Studio through a target execution:

Execution failed :org.talend.remote.jobserver.commons.utils.io.JobLimitException: Unzipped file name exceeds the maximum length: '240' (configured in org.talend.remote.jobserver.commons.config.JobServerConfiguration.MAX_UNZIPPED_FILE_NAME_LENGTH) [Unzipped file name exceeds the maximum length: '240' (configured in org.talend.remote.jobserver.commons.config.JobServerConfiguration.MAX_UNZIPPED_FILE_NAME_LENGTH)]

Resolution

To resolve, set the MAX_UNZIPPED_FILE_NAME_LENGTH=1024 parameter in both the Remote Engine org.talend.remote.jobserver.server.cfg and Talend Studio.ini file:

• Remote Engine/etc/org.talend.remote.jobserver.server.cfg:
  

   org.talend.remote.jobserver.commons.config.JobServerConfiguration.MAX_UNZIPPED_FILE_NAME_LENGTH=1024

• Studio.ini:
  

  Dorg.talend.remote.jobserver.commons.config.JobServerConfiguration.MAX_UNZIPPED_FILE_NAME_LENGTH=1024

Environment

• Talend Studio

A reload task in QlikView fails with the following error in the task log:

Error The sourcedocument failed to save.. Exception=System.Runtime.InteropServices.COMException (0x80004005): Error HRESULT E_FAIL has been returned from a call to a COM component. || at QlikView.Doc.SaveAs(String _FileName, Int16 _Format) || at QVBWrapper.Document.Save(ILogBucket i_LogBucket, String i_SaveAsFileName)

This may be caused by an active virus scan locking the relevant files, or an invalid alert configured on the task.

• QlikView

Virus Scan

Ensure that QlikView file locations (.qvw, qvd, etc..) are excluded from active virus scans. See QlikView Folder And Files To Exclude From Anti-Virus Scanning .

Invalid Alerts

Remove or edit the alerts configured on the document.

Alerts can be configured in the Distribution task. To verify:

• Open the QlikView Management Console
• Go to Documents > Source Documents
• Locate the failing document/task.
• Open the document/task
• Navigate to the Distribute tab
• Go to the Notify tab.
• Uncheck Send notification e-mail to recipients 
• Make sure, there is enough disk space to save the QVW

For additional troubleshooting steps and root causes, see QlikView: Checklist For Reload/Publisher Task Failure.