topic Re: Qlik-CLI audit "com.qlik.user-session.begin" in Integration, Extension & APIs

Qlik-CLI audit "com.qlik.user-session.begin"

julian_rodriguez — Sat, 16 Nov 2024 01:17:45 GMT

Hello experts,

I want to download the log events related with the type "com.qlik.user-session.begin". We want to create an app to show when has an user logged in to Qlik SaaS.

I have tried all the Qlik-CLI commands, on the "qlik audit" options, without result.

¿how can I get all the log entries using Qlik-CLI?

Thanks in advance

Re: Qlik-CLI audit "com.qlik.user-session.begin"

han — Thu, 15 Oct 2020 06:03:36 GMT

You can retrieve the latest with:

qlik audit ls --eventType com.qlik.user-session.begin

If you want to get all the events (say per day), you need to "script" with the flags:

--eventTime string The time interval formatted in ISO 8601 to search by eventTime.
--limit string The maximum number of resources to return for a request. The limit must be an integer between 1 and 100 (inclusive).
--next string The cursor to the next page of resources. Provide either the next or prev cursor, but not both.

Re: Qlik-CLI audit "com.qlik.user-session.begin"

julian_rodriguez — Thu, 15 Oct 2020 12:42:17 GMT

Hello Han,

Thanks, you have helped me. However, I can't get the --eventTime format.

I have tried with qlik audit ls --eventTime 2020-10-15T12:38:25+0000

But Qlik-CLI says:

400 Bad Request
{
"error": "time interval must be ISO 8601 formatted"
}

¿Could you provide me an example with a date, please?

Regards

Re: Qlik-CLI audit "com.qlik.user-session.begin"

han — Thu, 15 Oct 2020 12:53:18 GMT

As stated the --eventTime should be a interval

qlik audit ls --eventType com.qlik.user-session.begin --eventTime 2020-10-01T00:00:00Z/2020-10-01T12:00:00Z

Re: Qlik-CLI audit "com.qlik.user-session.begin"

julian_rodriguez — Thu, 15 Oct 2020 12:59:07 GMT

Perfect Han, thank you so much. Last question: where can I find all the documentation about Qlik-CLI?, I just found this site: https://qlik.dev/tutorials/get-started-with-qlik-cli

Thanks in advance.

Re: Qlik-CLI audit "com.qlik.user-session.begin"

han — Thu, 15 Oct 2020 13:04:09 GMT

All documentation is "inline" using --help

qlik audit ls --help Finds and returns the persisted audit events for the given tenant. Usage: qlik audit ls [flags] Flags: --eventTime string The time interval formatted in ISO 8601 to search by eventTime. --eventType string The case-sensitive string used to search by eventType. -h, --help help for ls --id string The list of audit unique identifiers. --interval int Duration in seconds to wait between retries, at least 1 (default 1) --limit string The maximum number of resources to return for a request. The limit must be an integer between 1 and 100 (inclusive). --next string The cursor to the next page of resources. Provide either the next or prev cursor, but not both. --prev string The cursor to the previous page of resources. Provide either the next or prev cursor, but not both. -q, --quiet Return only ids from the command --raw Return original response from server without any processing --retry int Number of retries to do before failing, max 10 --sort string The property of a resource to sort on (default sort is +eventTime). The supported properties are source, eventType, and eventTime. A property must be prefixed by + or - to indicate ascending or descending sort order respectively. --source string The case-sensitive string used to search by source. --userId string The case-sensitive string used to search by userId. Global Flags: -c, --config string path/to/config.yml where parameters can be set instead of on the command line --context string Name of the context used when connecting to Qlik Associative Engine --headers stringToString Http headers to use when connecting to Qlik Associative Engine (default []) --insecure Enabling insecure will make it possible to connect using self signed certificates --json Returns output in JSON format if possible, disables verbose and traffic output -s, --server string URL to a Qlik Product, a local engine, cluster or sense-enterprise -v, --verbose Log extra information

Re: Qlik-CLI audit "com.qlik.user-session.begin"

edoardopassa — Tue, 29 Nov 2022 21:26:25 GMT

Hi guys, can you provide an example of --next use in audit extractions?

Thanks,

Re: Qlik-CLI audit "com.qlik.user-session.begin"

hakana — Wed, 30 Nov 2022 10:58:45 GMT

I know that there have been some discussions around the next in the responses and if I remember correctly it's only exposed if you do a raw call.

However, you can use the --limit instead and that will make qlik-cli paginate internally and return the combined result.

This will work in most cases but you won't be able to know how many results there will be before you find the last match. Meaning you need to increase the limit until you get fewer results than the limit and think there's also a max limit

And if you are fetching 1000s of "records" maybe you should add a filter to the search to narrow down the number of records returned anyway.

Or is there a use case to extract all records?

Re: Qlik-CLI audit "com.qlik.user-session.begin"

edoardopassa — Wed, 30 Nov 2022 11:34:36 GMT

Thanks for your reply! We need to extra audit log without limits. I think that the "--next" command could be used to switch to the following page but a can't understand what string qlik-cli expects after --next 😕

Re: Qlik-CLI audit "com.qlik.user-session.begin"

hakana — Wed, 30 Nov 2022 11:50:12 GMT

If you use qlik audit ls --eventType com.qlik.user-session.begin --raw there will be a links object in the response that has a Href with the next result

It's the next query param you need to provide to the --next

Are there any specific events you are interested in or do you want to extract them all?

Re: Qlik-CLI audit "com.qlik.user-session.begin"

edoardopassa — Wed, 30 Nov 2022 11:56:51 GMT

Yep, we're trying to extra all users events (for examle: com.qlik.user-session.begin)

Can you share an example of --next queries?

Thanks

Re: Qlik-CLI audit "com.qlik.user-session.begin"

edoardopassa — Wed, 30 Nov 2022 14:08:02 GMT

We're trying to extract all audit log to integrate them into Splunk (we can't use Qlik Automation connector :/).

Can you share an example of the --next parameter? in Next (in Href) we have:

https://xxxxxxxxxxxxxxxxx.eu.qlikcloud.com/api/v1/audits?eventType=com.qlik.user-session.begin&limit=10&next=KQAAAAlldmVudFRpbWUAAyyoyIQBAAAHX2lkAGOHVg8W7ojos5mPJQA

Thanks!

Re: Qlik-CLI audit "com.qlik.user-session.begin"

edoardopassa — Wed, 30 Nov 2022 21:20:39 GMT

Resolved