Get a search’s status by an account and search ID.

Parameters

ParameterDescription
Account IDThe user account ID.
Search IDThe search ID.

Example Output

{
	"total_found": 1,
	"status_details": "<string>",
	"search_uuid": "<string>",
	"search_status": "<string>",
	"search_start": 810788262,
	"search_progress": {
		"input_scanned_records": 2191012,
		"input_scanned_bytes": 4367087450,
		"estimated_output_records": 9
	},
	"search_end": 1020679166,
	"retry_allowed": true,
	"external_details": "<string>",
	"details": {
		"update_ts": 3025548245,
		"submit_ts": 2907208569,
		"stats": {
			"max_per_chain": 30,
			"messages_unparsed": 1,
			"input_partial_scan_packet_attempts": 2,
			"messages_dropped": 2,
			"chains": 7443,
			"pkts_per_chain": 131,
			"input_scanned_records": 129770811,
			"filtered_compressed_bytes": 2206,
			"lambda_input_scanned_bytes": 72916582,
			"messages_prefilter_time": 96360,
			"min_per_chain": 2,
			"sort_recurse_time": 3754,
			"alrecord_packet_read_errors": 2,
			"fetchers_executed": 6,
			"output_records": 10,
			"sort_loopback_records": 63,
			"ecs_filters_executed": 1,
			"filtered_batches": 0,
			"messages_filter_time": 3333,
			"messages_parse_time": 1298,
			"ecs_input_scanned_bytes": 0,
			"input_scanned_bytes": 6657998937,
			"avg_per_chain": 60,
			"libalalgo_kv_parse_call_count": 0,
			"sorts_executed": 181,
			"filtered_records": 8,
			"messages_parse_error": 1,
			"filtered_bytes": 1842,
			"libalalgo_json_parse_call_count": 1,
			"filters_executed": 87,
			"messages_parsed": 277,
			"intervals_exist": 122,
			"input_scanned_packets": 18949,
			"messages_read_time": 1658904,
			"pkts_for_chaining": 517913,
			"recurse_sorts": 24,
			"intervals_requested": 175,
			"ecs_filter_process_time": 0,
			"filter_process_time": 1288809,
			"filter_init_time": 197917,
			"filters_scheduled": 8404
		},
		"search_type": "<string>",
		"requested_type": "<string>",
		"request": "<string>",
		"data_type": "<string>"
	},
	"data_type": "<string>",
	"account_id": "<string>"
}

Workflow Library Example

Get Search Status with Alert Logic and Send Results Via Email

Preview this Workflow on desktop