CLI quick start

Prerequisites

Verify you have the following information ready:

  • Your 12-digit Observe customer ID for your Observe instance. In this example, we will use 123456789012.
  • Observe instance URL, which is the hostname of your Observe instance. In this example, we will use observeinc.com.
  • The email address and password used to log into your Observe instance. In this example, we will use [email protected] as the email, and XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX as the password.

Login

Once you gather your prerequisites, run the following command:

observe --customerid 123456789012 --site observeinc.com login [[email protected]](mailto:[email protected]) --read-passwordPassword for 123456789012.observeinc.com: "[[email protected]](mailto:[email protected])":
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
login: saved authtoken to section "default" in config file "/home/myname/.config/observe.yaml"

Then, test your access using the following command:

observe query -q 'pick_col timestamp, log | limit 10' -i 'Default.kubernetes/Container Logs'
| timestamp | log |
-----------------------------------------------------------------------------------
| 1679497866772157872 | E0420 16:20:00.123456 1 package/file.go:123] Hello World! |

You must visit the Observe website using the link provided when logged in as the appropriate user, and authorize the login request in the Web app. If you don’t want to use this flow, and you have a direct email address and password) login, you can skip the --sso flag and enter the password directly. If you use SSO for Observe with an SSO provider that doesn’t provide your email address as a user property, you can use the User ID instead of the email address. Your User ID for your user can be found in the Observe Web instance in the Settings > Account Settings tab, at the bottom of the page.

The login command saves the generated Authentication Token in a local profile to reuse when you execute other commands. If you don’t want to save your Authentication Token in the profile, you can specify --authtoken on the command line, and not use the command --save when logging into the instance.

If you use an SSO SAML integration such as Okta, Azure AD, Google, or PingOne, see login command for how to generate credentials.

The name of the dataset input for your query may vary based on the installed or built datasets in your workspace, as well as the name of your workspace. Explore the Datasets page on your Observe instance to find more datasets. You can also use a dataset ID directly, such as 41007104, to specify the dataset to read. To specify more than one dataset to use for joins and unions, see query command.