/syslog/daily API endpoint only returns data from the past few days

[cblesy]

I'm building automation and I want to use the /syslog/daily endpoint in the BCS Operational Insights API to get historical lists of syslog events. This endpoint, however, only seems to return data for the past few days, no matter what I pass as the date or startDate parameters. When I made a request to the endpoint last week, for instance, I was able to get data of events dating back to 2/6/24. Today, when I run the exact same request, it only returns data dating back to 2/13/24. Is there any was to access historical data via the API, or is this endpoint only designed to access very recent syslog data? Thanks in advance.

[bigevilbeard · Accepted solution]

No expert here, the behavior you're describing with the /syslog/daily endpoint in the BCS Operational Insights API aligns with its current limitations. This endpoint is primarily designed to provide access to syslog data for the past few days, typically around 3-5 days. I might be 100% wrong here, and someone else might correct me later. If you do not get a reply, would suggest to contact the BU at Cisco on this, i could not find reference in the documentation for my previous statement.

Hope this helps.

[cblesy]

That makes sense. I couldn't find anything that specifically stated this either. Thanks for the response.