Skip to main content
Bag of words connects to a Qlik Sense Enterprise on Windows (QSEoW) site, discovers its streams and apps through the Qlik Repository Service (QRS), and queries them through the Qlik Engine API (QIX) — the same hypercube engine the Qlik front end uses. Dimensions, measures, and selections behave exactly as they do inside Qlik, including the associative model. This is the on-premises sibling of the Qlik Sense (Qlik Cloud) connector. The two products share the Engine protocol and little else: discovery, authentication, and the grouping concept all differ, so each has its own connector.
The Qlik Sense on-prem connector is part of the Enterprise Edition.

​
How it works

  1. Streams and apps are enumerated over QRS (/qrs/stream/full, /qrs/app/full) using the client certificate. Unpublished apps — those still in a user’s personal work area — are skipped by default.
  2. For each app, Bag of words opens one Engine WebSocket session and reads the data model (GetTablesAndKeys), the published master measures with their Qlik expressions, master dimensions, variables, sheets, and data lineage.
  3. Queries run as QIX hypercubes over a WebSocket to wss://<host>:4747/app/<appId>.
Each table inside an app becomes a schema entry named Stream/App/Table. Fields tagged $key by Qlik become primary keys, and tables sharing a key are linked as relationships. Every app also contributes a Stream/App/Master Items entry — not a physical table, but the app’s published measures (each carrying its full expression, set analysis included), dimensions, and variables, so the agent reuses the business logic the app’s authors agreed on instead of re-deriving it.
Qlik is queried with hypercubes, not SQL. The agent sends dimension field names plus measures written as Qlik expressions (Sum([Net Sales]), Count(distinct [OrderID])), and filters are applied as Qlik selections — they narrow the associative state and propagate across every related table.
The certificate authenticates the machine, not a person, so every request also names the account Qlik should evaluate it as (the X-Qlik-User header). During discovery each app is opened as its owner, which avoids Section Access refusals; at query time the identity comes from the credential — see Authentication modes.

​
Before you start

  • Export the certificates from the QMC: Certificates → Export, machine name of the Bag of words host, format Platform independent PEM-format. The bundle contains client.pem, client_key.pem, and root.pem.
  • Outbound access from Bag of words to the Qlik central node on ports 4242 (QRS) and 4747 (Engine). On a default Windows install these are open locally but blocked by Windows Defender Firewall for remote hosts — add an inbound rule for both.
  • The Server URL should be the hostname the certificates were exported for.
A Qlik client certificate is admin-equivalent — it can act as any user on the site. Treat the PEM files like an admin password: store them only in the connection’s credentials, and re-export from the QMC if they ever leak.

​
Connect in Bag of words

Go to Settings → Data Sources → Add data source → Qlik Sense (on-prem). See Connecting a data source for the general flow. Test Connection calls /qrs/about, lists streams and apps, and reports the Qlik version plus how many of each the credential can see.
TLS on a default install. Qlik signs its service certificates with its own root, issued to the machine’s Windows hostname. If Bag of words reaches the server by that same name, paste root.pem into the Root CA field and keep Verify SSL on. If you connect via a different DNS name (a cloud VM’s public hostname, for example), verification can never pass — turn Verify SSL off and leave Root CA empty. A pasted Root CA takes precedence over the toggle.

​
Authentication modes

​
Client Certificate (system)

The workspace-wide credential. All three PEM fields are multi-line — paste the full file contents including the BEGIN/END lines.

​
Qlik Identity (per user)

When the connection has Require user authentication enabled, each person connects with only their Qlik identity — the certificate stays on the connection and is never handed to users. Their queries then run with their own stream access and Section Access rules, which is Qlik’s row-level security. Per-user credentials require Enterprise — see Authentication.

​
Troubleshooting

Qlik’s service certificate is issued to the machine’s Windows hostname. If you connect by any other name — a cloud VM’s public DNS name is the usual case — hostname verification fails even with the correct root.pem. Turn Verify SSL off and clear the Root CA field (a pasted root takes precedence over the toggle), or connect via a hostname the certificate actually covers.
The services listen on those ports, but Windows Defender Firewall blocks remote connections by default. Add an inbound rule on the Qlik server for TCP 4242 and 4747, and check any network firewall or cloud security group between Bag of words and the server.
Check stream_filter for names or IDs that don’t match a real stream, and remember published_only (the default) hides apps that were never published to a stream.
An entry with an error in its description failed to crawl — usually a permission gap on that app. An entry described as having no data model belongs to an app whose load script has never run; it holds no data and cannot be queried, though its master items are still published if it has any.
That is Qlik’s virtual-proxy host allow list rejecting the hostname — a Qlik-side setting for browser access on 443. It does not affect this connector, which talks to QRS and the Engine directly. To fix the hub itself, add the hostname in QMC → Virtual proxies → Advanced → Host allow list.
Measures are Qlik expressions, and field names are case-sensitive. Names with spaces need square brackets, as in Sum([Net Sales]). Prefer the expressions published in the app’s Master Items entry — they carry the set analysis the app’s authors intended.