searchJobManagement

Create a search job.

Changed on

Create a new search job.

post/v2/search/jobs

Request

  • Base URL
    https://api.au.sumologic.com/api
  • URL
    https://api.au.sumologic.com/api/v2/search/jobs
  • Auth
    HTTP basic

Request body

querystring required

The actual search expression. Ensure your query follows RFC 8259 and is valid JSON format, you may need to escape certain characters to follow the RFC 8259.

fromstring required

The start date and time of the search. This follows the ISO 8601 date and time format.

tostring required

The end date and time of the search. This follows the ISO 8601 date and time format.

timezonestring required

The time zone if from/to is not in milliseconds. See this Wikipedia article for a list of time zone codes.

autoParsingModestring

Define the parsing mode to scan the JSON format log messages. Possible values are:

AutoParse - System automatically figures out the fields to parse based on the search query.

Manual - No fields are parsed out automatically. For more information, refer to the Dynamic Parsing.

requiresRawMessagesstring

On enabling this field, the log messages applicable to the search are returned. Maximum value is 100,000. This is only applicable for aggregate queries.

maxRawRecordsstring

Maximum number of raw records to finish the search.

intervalTimeTypestring

This parameter defines whether you want to run the search by messageTime, receiptTime or searchableTime.

childOrgIdsstring[]

List of child organization ids to run the search on.

includeAllChildOrgsboolean

When true, automatically resolves all child orgs of the authenticated parent and fans the search out across all of them. If this is set, it takes precedence over childOrgIds field. Default value is false.

Example request

{
  "query": "_sourceCategory=service",
  "from": "2017-07-26T00:00:00",
  "to": "2017-07-26T00:00:00",
  "autoParsingMode": "Manual",
  "intervalTimeType": "messageTime",
  "childOrgIds": [
    "0000000000000001",
    "0000000000000002"
  ]
}

Response

The search job has been created.

warningstring

Warnings value contains the detailed information about the warning while creating the search job.

idstring

The search job identifier.

isAggregationboolean

Whether the query has aggregation operators.

isSummaryboolean

Whether the query is a summary query.

isSortableboolean

Whether the results are sortable.

runnableQuerystring

The final query string after parameterized variables are substituted, macros are expanded.

userReferencedFieldsSortableboolean

Whether the user's explicitly referenced fields can be re-sorted by clicking column headers.

operatorsstring[]

List of special operators present in the query.

tiersInQuerystring[]

Analytics tiers referenced in the query.

Changes