Splunk Search

How to Extract Event Logs from SignalFX via API?

rvillaflores
Loves-to-Learn

Hi,

I'm trying to extract logs via API using /v2/event/find Found here: Retrieve Events V2 | API Reference | Splunk Developer Program
However, the results I'm trying to get does not match with what I had in mind. (The results are similar to the examples in the link)

 

 

[ [-] 
  { [-] 
    id: "AddBYZrEFEF",
    metadata: { [-] 
      ETS_key1: "detector",
      ETS_key2: false,
      ETS_key3: 1001
    },
    properties: { [-] 
      is: "ok",
      sf_notificationWasSent: true,
      was: "anomalous"
    },
    sf_eventCategory: "USER_DEFINED",
    sf_eventType: "string",
    timestamp: 1554672630000,
    tsId: "XzZYApXCDCD"
  }
]

 

 

What I'm trying to get are raw messages from the Logs Observer in Splunk SignalFX (image below)

rvillaflores_0-1676365678569.png

The json object I receive are just similar to the example, and not the messages we are ingesting. I need to extract a set with parameters/filters added. I'm expecting the result to be like this:

 

 

{
    "timestamp": "Feb 14 2023T12:00:00+0800",
    "message": "Error 404: /path/service/action",
    "severity": "ERROR",
    "service": "myApp-service"
}

 

 

 How do I extract it?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...