Skip to main content Skip to complementary content
Qlik Resources
Loading SearchUnify's search If you need assistance with your product, please contact Qlik Support.
Qlik Customer Portal
Loading SearchUnify's search If you need assistance with your product, please contact Qlik Support.
Qlik Customer Portal

Home > System spot check > Monitor system events

Monitor system events

Last updated: 2026-11-03

Cadence: Daily

Subscription model: All

Roles: Tenant Admin (TA), Analytics Admin (AA—Home dashboard only), Data Admin (DA—Home dashboard only)

Last verified: 2026-09

Initial Recurring
Estimated time 10 min 5 min

Benefits:

  • Same-day visibility into security events, failures, and suspicious activity
  • Provides a tenant-wide snapshot of consumption in one screen
  • Captures events older than 90 days, accessible only via the Audits API archive endpoint—daily review keeps the live window short

Goal

Open the Home dashboard in the admin console for a subscription / consumption snapshot, and the Events page for the audit log. The Events page is filterable by event type. Live events from the past 90 days are accessible via the Events page (and the Audits API at /api/v1/audits); after 90 days, events are archived but remain accessible for the lifetime of the tenant via /api/v1/audits/archive.

Tasks

Task TA AA DA AuA
Review the admin console Home dashboard for capacity / consumption alerts ✓ ✓ ✓
Review Events page and filter for failures, security events, suspicious API key activity ✓
For long-horizon SIEM retention, build a daily pull against /api/v1/audits/archive—note that the archive endpoint accepts a single date= parameter (no range), so >90-day retention pipelines must iterate per-day ✓

Read before acting—gotchas

  • Legacy IAM system events are being retired. com.qlik.* events for auth, users, groups, roles, tenants, web integrations, spaces, and OAuth clients will be removed on or after November 30, 2026, replaced by namespaced com.qlik.core.* events. Any eventType filter built against the old event names on /api/v1/audits breaks on that date—re-test filters before then. See the Qlik release notes and deprecation notices.

Automation helpers

  • Adjacent only—Qlik publishes an Automate template that exports audit logs from Qlik Replicate / Qlik Enterprise Manager (a separate on-premises product line) into Splunk. For Qlik Cloud audits there is no first-party template; write your own daily pull against /api/v1/audits/archive and forward to your SIEM.

References

Tags: #daily #system_spot_check #events #audits_api #security

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here