Skip to main content

Search Events

Search all events in a repository.

Basic Parameters

ParameterDescription
QueryThe query that's used to search for events. For more information about LogScale queries.
Repository NameThe name of the repository.

Advanced Parameters

ParameterDescription
End timeThe end time of the query. Date in either unix time or relative time.
Start timeThe start time of the query. Date in either unix time or relative time.
Timezone OffsetTimezone offset in minutes.

Example Output

[
{
"#type": "string",
"datetime": "string",
"#repo": "string",
"sha256": "string",
"@sourcetype": "string",
"md5": "string",
"#error": "string",
"parentprocess": "string",
"@source": "string",
"@timestamp.nanos": "string",
"@id": "string",
"commandline": "string",
"sha1": "string",
"@ingesttimestamp": "string",
"parentgroup": "string",
"@timestamp": 1713967005914,
"path": "string",
"hostname": "string",
"@error": "string",
"username": "string",
"event": "string",
"execution_type": "string",
"@error_msg[0]": "string",
"@error_msg": "string",
"filename": "string",
"publisher": "string",
"@host": "string",
"@timezone": "string",
"@event_parsed": "string",
"group": "string"
}
]

Automation Library Example

Search Events with Falcon Logscale and Send Results Via Email

Automation LibraryPreview this Automation on desktop