> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Query By ID

Search SIEM query by ID.

**Note:** If you used the `Advanced Search Query` action, experienced a timeout, and received the search ID, you can use this action to retrieve the results from the search, as long as 90 seconds have not passed since the timeout (after which the search is automatically removed from crowdstrike's database)

<Note>
  External Documentation

  To learn more, visit the [CrowdStrike documentation](https://falcon.us-2.crowdstrike.com/documentation/page/bda96fc1/next-gen-siem-search-apis#d14edaea).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter  | Description                                                                                                                                                                                         |
  | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Repository | The repository to run the query against. For info about repository options, see [Repositories](https://falcon.us-2.crowdstrike.com/documentation/page/bda96fc1/next-gen-siem-search-apis#fbc28030). |
  | Search ID  | The ID of the query job to retrieve results for. Can be obtained using `Advanced Search Query` Action.                                                                                              |
</div>

## Example Output

```json theme={"dark"}
{
	"cancelled": false,
	"done": true,
	"events": [
		{
			"timestamp": "1736264422005",
			"ImageSubsystem": "2",
			"RawProcessId": "60",
			"@sourcetype": "xdr/xdr-base-parsers:falcon-raw-data",
			"@timezone": "Z",
			"Tags": "41, 53, 54, 55, 236",
			"ParentBaseFileName": "host.exe",
			"Entitlements": "15",
			"@id": "XQZxxxxxxxVP9_xxx_xx_xxxxxxx",
			"LocalAddressIP4": "xxx.xx.x.xx",
			"@ingesttimestamp": "1736264423894",
			"aip": "xxx.xxx.xx.x",
			"@timestamp": 1736264422005,
			"LocalIP": "xxx.xx.x.xx",
			"name": "ProcessRollup2V19",
			"UserName": "USER3",
			"#type": "falcon-raw-data",
			"SessionId": "0",
			"SourceThreadId": "233xxxx363",
			"aid": "abc123",
			"ProcessParameterFlags": "24577",
			"ProcessStartTime": "1736264421.987",
			"SHA1HashData": "0000000000000000000000000000000000000000"
		},
		{
			"timestamp": "1736264422006",
			"ImageSubsystem": "3",
			"RawProcessId": "63",
			"@sourcetype": "xdr/xdr-base-parsers:falcon-raw-data",
			"@timezone": "Z",
			"Tags": "41, 53, 54, 55, 236",
			"ParentBaseFileName": "host.exe",
			"Entitlements": "15",
			"@id": "XQZxxxxxxxVP9_xxx_xx_xxxxxxx",
			"LocalAddressIP4": "xxx.xx.x.xx",
			"@ingesttimestamp": "1736264423894",
			"aip": "xxx.xxx.xx.x",
			"@timestamp": 1736264422005,
			"LocalIP": "xxx.xx.x.xx",
			"name": "ProcessRollup2V19",
			"UserName": "USER3",
			"#type": "falcon-raw-data",
			"SessionId": "0",
			"SourceThreadId": "233xxxx363",
			"aid": "abc123",
			"ProcessParameterFlags": "24577",
			"ProcessStartTime": "1736264421.987",
			"SHA1HashData": "0000000000000000000000000000000000000000"
		}
	]
}
```

## Workflow Library Example

[Search Query by Id with Crowdstrike and Send Results Via Email](https://library.blinkops.com/workflows/search-query-by-id-with-crowdstrike-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/search-query-by-id-with-crowdstrike-and-send-results-via-email/canvas" />
</div>