search

justinbatcf / splunk-logshare

5 stars 6 forks source link

bad query: error parsing end time: must be unix timestamp or rfc3339 string #3

Open Colgaton opened 6 years ago

Colgaton commented 6 years ago

Hi, this plugin was working for me but since a week ago I only get the following:

{ [-] error_message: bad query: error parsing end time: must be unix timestamp or rfc3339 string

 http_error_code:    400

}

Any idea why is this happening?

guentherishere commented 6 years ago

CloudFlare has updated their API. The ELS endpoint (/logs/requests) has been deprecated in favor of the newer ELS endpoint (/logs/received). In order for this tool to work, this will have to be updated to support this new endpoint, as well as support the differences around how the data is pulled with the new endpoint.

https://support.cloudflare.com/hc/en-us/articles/216672448-Enterprise-Log-Share-Logpull-REST-API