Qlik-CLI audit "com.qlik.user-session.begin"

[julian_rodriguez]

Hello experts,

I want to download the log events related with the type "com.qlik.user-session.begin". We want to create an app to show when has an user logged in to Qlik SaaS.

I have tried all the Qlik-CLI commands, on the "qlik audit" options, without result.

¿how can I get all the log entries using Qlik-CLI?

Thanks in advance

[han]

You can retrieve the latest with:

qlik audit ls --eventType com.qlik.user-session.begin

If you want to get all the events (say per day), you need to "script" with the flags:

• --eventTime string The time interval formatted in ISO 8601 to search by eventTime.
• --limit string The maximum number of resources to return for a request. The limit must be an integer between 1 and 100 (inclusive).
• --next string The cursor to the next page of resources. Provide either the next or prev cursor, but not both. 

[julian_rodriguez]

Hello Han,

Thanks, you have helped me. However, I can't get the --eventTime format. 

I have tried with qlik audit ls --eventTime 2020-10-15T12:38:25+0000

But Qlik-CLI says:

400 Bad Request
{
"error": "time interval must be ISO 8601 formatted"
}

¿Could you provide me an example with a date, please?

Regards

[han · Accepted solution]

As stated the --eventTime should be a interval

qlik audit ls --eventType com.qlik.user-session.begin  --eventTime 2020-10-01T00:00:00Z/2020-10-01T12:00:00Z

[julian_rodriguez]

Perfect Han, thank you so much. Last question: where can I find all the documentation about Qlik-CLI?, I just found this site: https://qlik.dev/tutorials/get-started-with-qlik-cli

Thanks in advance.

[han]

All documentation is "inline" using --help

qlik audit ls --help
Finds and returns the persisted audit events for the given tenant.

Usage:
  qlik audit ls [flags]

Flags:
      --eventTime string   The time interval formatted in ISO 8601 to search by eventTime.
      --eventType string   The case-sensitive string used to search by eventType.
  -h, --help               help for ls
      --id string          The list of audit unique identifiers.
      --interval int       Duration in seconds to wait between retries, at least 1 (default 1)
      --limit string       The maximum number of resources to return for a request. The limit must be an integer between 1 and 100 (inclusive).
      --next string        The cursor to the next page of resources. Provide either the next or prev cursor, but not both.
      --prev string        The cursor to the previous page of resources. Provide either the next or prev cursor, but not both.
  -q, --quiet              Return only ids from the command
      --raw                Return original response from server without any processing
      --retry int          Number of retries to do before failing, max 10
      --sort string        The property of a resource to sort on (default sort is +eventTime). The supported properties are source, eventType, and eventTime. A property must be prefixed by + or - to indicate ascending or descending sort order respectively.
      --source string      The case-sensitive string used to search by source.
      --userId string      The case-sensitive string used to search by userId.

Global Flags:
  -c, --config string            path/to/config.yml where parameters can be set instead of on the command line
      --context string           Name of the context used when connecting to Qlik Associative Engine
      --headers stringToString   Http headers to use when connecting to Qlik Associative Engine (default [])
      --insecure                 Enabling insecure will make it possible to connect using self signed certificates
      --json                     Returns output in JSON format if possible, disables verbose and traffic output
  -s, --server string            URL to a Qlik Product, a local engine, cluster or sense-enterprise
  -v, --verbose                  Log extra information

[edoardopassa]

Hi guys, can you provide an example of --next use in audit extractions?

Thanks,

EP

[hakana]

I know that there have been some discussions around the next in the responses and if I remember correctly it's only exposed if you do a raw call.

However, you can use the --limit instead and that will make qlik-cli paginate internally and return the combined result.

This will work in most cases but you won't be able to know how many results there will be before you find the last match. Meaning you need to increase the limit until you get fewer results than the limit and think there's also a max limit

And if you are fetching 1000s of "records" maybe you should add a filter to the search to narrow down the number of records returned anyway.

Or is there a use case to extract all records?

[edoardopassa]

Thanks for your reply! We need to extra audit log without limits. I think that the "--next" command could be used to switch to the following page but a can't understand what string qlik-cli expects after --next 😕

[hakana]

If you use qlik audit ls --eventType com.qlik.user-session.begin --raw there will be a links object in the response that has a Href with the next result

It's the next query param you need to provide to the --next

Are there any specific events you are interested in or do you want to extract them all?