AUDITS ARCHIVE

[Edev]

Hi,

I'm looking to collect all the events from my tenant. I need a script to create a correct request, but I only have the following:

FROM JSON (wrap on) "root" PK "__KEY_root"WITH CONNECTION (
URL "https://$(mytenant)/api/v1/audits/archive?date=2024-06-27"
);

I have read the information in the link you provided, but I couldn't find my answer. 

https://qlik.dev/apis/rest/audits/#%23%2Fentries%2Fv1%2Faudits%2Ftypes-get.

Can you help me?

[marksouzacosta]

Sorry @Edev, your question is not clear.

Have you setup a REST Connection to connect to this Endpoint you sent?

Can you please share your whole Load Scrip?

[Edev]

I have a REST API connection to access the data from my cloud.

I can already retrieve information for users, spaces, and others.

I would like to extract the event log but I do not know which tables I need to query for this. I cannot find complete documentation on this point.
Concretely, I would like to retrieve this information.

[DaveChannon]

The audits endpoint has two modes:

1. The recent history, available on https://your-tenant.us.qlikcloud.com/api/v1/audits, with a number of filters that can be applied to retrieve events by time, service, etc
2. The archived history (90 days or older), available on https://your-tenant.us.qlikcloud.com/api/v1/audits/archive, which you must pass a date parameter to. It will return the entire day's events. It does not support filtering.

You may wish to try hitting the base /audits path, that will show you the information from events in the management console.

[marksouzacosta]

Got it.

You need at least one Rest Connection to get the non-archived Events. 
This is how you can setup your connection - I have highlighted the properties that need to be changed:

Your Load Script will be like this - this reload will take some time if you have lots of Events:

LIB CONNECT TO 'Get Events';

RestConnectorMasterTable:
SQL SELECT 
 "__KEY_root",
 (SELECT 
 "eventTime",
 "eventType",
 "source",
 "userId",
 "__FK_data",
 "__KEY_data"
 FROM "data" PK "__KEY_data" FK "__FK_data")
FROM JSON (wrap on) "root" PK "__KEY_root";

[Events]:
LOAD
 [eventTime] AS Date,
 [source] AS Source,
 [eventType] AS [Event Type],
 [userId] AS [UserId]
RESIDENT RestConnectorMasterTable
WHERE NOT IsNull([__FK_data]);

DROP TABLE RestConnectorMasterTable;

Your next steps may be:

Get the User Names and get Archived Events. Please let us know if you need some help on these.

Regards,

Mark Costa

[Edev]

Thanks <3,

To complete the script 
WITH CONNECTION (
URL "https://yourtenant.eu.qlikcloud.com/api/v1/audits/archive?date=YYYY-MM-DD");

Do you konw how get this information too ?

[marksouzacosta]

This is the Data object or the Event Details. The Event Details object can be very tricky to get because it changes the structure depending on the type and version of the event.

I would, in a first approach, load my Events Details by Event Type. For that we would have to change the REST Connection I sent to you to check the Allow WITH CONNECTION option. So, you could get All Events with the code I sent to you and store in a QVD. Then have another code to get the Event Details per Event Type and Event Id. You will be aggregating all these Event Details in one single QVD per Event Type. For example: EventDetails_Updated.qvd, EventDetails_Validated.qvd, EventDetails_Finished.qvd etc. Doing that you will have the same data structure per Event Type. Make sense?

I have a YouTube video that shows how to do such manipulation using another API. But you can adapt this to your case: https://youtu.be/lFwar30BNkQ?si=v4P36Dl38PoV5oAE