Follow Use the Devo Query API: send a LINQ query, a time range and an output mode to the /search/query endpoint of your region, authenticated with an API token or key and secret. Ask for a JSON mode and you get structured events; select the message field from raw tables to get the original lines back. The official Python SDK (devo-sdk) wraps the same API if you prefer code to curl.
Devo stores large volumes of security and operational data in the cloud, often with long retention. Prime Core has 23,653 detection rules for Devo, mapped to 664 MITRE ATT&CK techniques. Below is how to get data out, sanitize it, and investigate it for free in LogTotal.
Before you start
Credentials. Create an API token, or an API key and secret, in your Devo domain’s credentials settings, with access to the tables you need.
Your region’s endpoint. The Query API host depends on where your domain lives, for example apiv2-us.devo.com or apiv2-eu.devo.com.
Table names. Devo organizes data in tables like box.unix or firewall.fortinet.traffic. Find yours in the Data Search area, and build the query there first.
Export with the Query API
curl -sS -X POST "https://apiv2-eu.devo.com/search/query" \
-H "Authorization: Bearer $DEVO_TOKEN" -H 'Content-Type: application/json' \
-d '{
"query": "from box.unix where hostname = \"web-03\" select eventdate, hostname, message",
"from": 1792368000,
"to": 1792454400,
"mode": {"type": "json/simple"}
}' > devo_web03_1019.json
The from and to values above are epoch seconds for 2026-10-19 00:00 UTC to 2026-10-20 00:00 UTC. If the response is one JSON object per line, upload it as-is. If it’s an array, flatten it with jq -c ‘.[]’. For raw lines, extract message.
Python alternative. pip install devo-sdk, then use the API client from the devo.api package with your token, the same query and dates. It handles the request signing for key-and-secret authentication.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| 401 | Wrong token, or a key/secret signature problem | Check the credentials; try the SDK, which signs requests for you |
| Connection errors | Wrong regional endpoint | Use your domain’s region |
| Empty results | Wrong table name, or milliseconds instead of seconds | Check the table in Data Search; check time units |
| Output is a table you didn’t expect | Mode doesn’t match what you need | Pick a JSON mode |
FAQ
Raw or parsed?
For syslog-style sources, select message and upload the raw lines. For JSON sources, upload the parsed events.
Can I schedule exports?
Yes, the same API works in scheduled jobs. For continuous forwarding, Devo also has data export features.
