Get Search Results - BlinkOps Documentation

Get a search’s results by an account and search ID.

Basic Parameters

Parameter	Description
Account ID	The user account ID.
Search ID	The search ID.

Advanced Parameters

Parameter	Description
Details	Return extra details about the search. Default value is False.
Limit	Limit the number of elements on the response, default value is 100.
Next Token	The `next_token` from a previous request to continue paging results.
Offset	Offset within a results page.
Selected Rows	list of result rows numbers, separated by comma (e.g. “2,5,29,31,45,99,100”). The length of the list is limited by the general requirements for the size of the GET request (2048 bytes, including URL). List should be encoded. If the requested row does not belong to the already found rows then it’ll not be returned.

Example Output

{
	"total_found": 11,
	"status_details": "<string>",
	"search_uuid": "<string>",
	"search_status": "<string>",
	"search_start": 1923341657,
	"search_end": 1798093897,
	"results": {
		"records": [
			{
				"id": {
					"msgid": "<string>",
					"datatype": "<string>",
					"aid": 2,
					"account": 196709416
				},
				"fields": {
					"Windows Event ID": "<string>",
					"User Name": [
						"<string>",
						"<string>"
					],
					"Timestamp UTC+8": "<string>",
					"Src Host Name": "<string>",
					"Src Host": null,
					"Reason": null,
					"Message Type": "<string>",
					"Message": "<string>",
					"Logon Substatus": null,
					"Logon Status": null
				}
			},
			{
				"id": {
					"msgid": "<string>",
					"datatype": "<string>",
					"aid": 1,
					"account": 115008758
				},
				"fields": {
					"Windows Event ID": "<string>",
					"User Name": [
						"<string>",
						"<string>"
					],
					"Timestamp UTC+8": "<string>",
					"Src Host Name": null,
					"Src Host": null,
					"Reason": null,
					"Message Type": "<string>",
					"Message": "<string>",
					"Logon Substatus": null,
					"Logon Status": null
				}
			}
		],
		"metadata": {
			"Windows Event ID": "<string>",
			"User Name": "<string>",
			"Timestamp UTC+8": null,
			"Src Host Name": "<string>",
			"Src Host": "<string>",
			"Reason": "<string>",
			"Message Type": "<string>",
			"Message": "<string>",
			"Logon Substatus": "<string>",
			"Logon Status": "<string>"
		},
		"columns": [
			"<string>",
			"<string>"
		]
	},
	"remaining": 2,
	"offset": 2,
	"external_details": "<string>",
	"data_type": "<string>",
	"account_id": "<string>"
}