You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/api/search-job.md
+20-6Lines changed: 20 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -343,6 +343,7 @@ This is the formatted result document:
343
343
344
344
```json
345
345
{
346
+
"warning":"",
346
347
"state":"DONE GATHERING RESULTS",
347
348
"messageCount":90,
348
349
"histogramBuckets":[
@@ -356,7 +357,6 @@ This is the formatted result document:
356
357
"count":1,
357
358
"startTimestamp":1359405480000
358
359
},
359
-
...
360
360
{
361
361
"length":60000,
362
362
"count":1,
@@ -367,7 +367,10 @@ This is the formatted result document:
367
367
],
368
368
"pendingWarnings":[
369
369
],
370
-
"recordCount":1
370
+
"recordCount":1,
371
+
"usageDetails":{
372
+
"dataScannedInBytes":0
373
+
}
371
374
}
372
375
```
373
376
@@ -385,12 +388,16 @@ Notice that the state of the sample search job is DONE GATHERING RESULTS. The fo
385
388
386
389
#### More about results
387
390
391
+
The **warnings** value contains the detailed information about the warning while obtaining the current status of a search job.
392
+
388
393
The **messageCount** and **recordCount** values indicate the number of messages and records found or produced so far. Messages are raw log messages and records are aggregated data.
389
394
390
395
For queries that do not contain an aggregation operator, only messages are returned. If the query contains an aggregation, for example, **count by _sourceCategory**, then the messages are returned along with records resulting from the aggregation (similar to what a SQL database would return).
391
396
392
397
The **pendingErrors** and **pendingWarnings** values contain any pending error or warning strings that have accumulated since the last time the status was requested.
393
398
399
+
The **usageDetails** value contains the amount of data scanned in bytes details.
400
+
394
401
Errors and warnings are not cumulative. If you need to retain the errors and warnings, store them locally.
395
402
396
403
The **histogramBuckets** value returns a list of histogram buckets. A histogram bucket is defined by its timestamp, which is the start timestamp (in milliseconds) of the bucket, and a length, also in milliseconds, that expressed the width of the bucket. The **timestampplus** length is the end timestamp of the bucket, so the count is the number of messages in the bucket.
The result contains two lists, **fields** and **messages**.
597
605
606
+
****warnings** contains the detailed information about the warning while paging through the messages found by a search job.
598
607
***fields** contains a list of all the fields defined for each of the messages returned. For each field, the field name and field type are returned.
599
608
***messages** contains a list of maps, one map per message. Each **map** maps from the fields described in the fields list to the actual value for the message.
600
609
@@ -666,6 +675,7 @@ This is the formatted result document:
666
675
667
676
```json
668
677
{
678
+
"warning": "",
669
679
"fields":[
670
680
{
671
681
"name":"_sourceCategory",
@@ -691,6 +701,8 @@ This is the formatted result document:
691
701
692
702
The returned document is similar to the one returned for the message paging API. The schema of the records returned is described by the list of fields as part of the fields element. The records themselves are a list of maps.
693
703
704
+
The ***warnings** contains the detailed information about the warning while paging through the records found by a Search Job.
705
+
694
706
</details>
695
707
696
708
## POST Methods
@@ -828,10 +840,12 @@ Example error response:
828
840
829
841
```json
830
842
{
831
-
"status" : 400,
832
-
"id" : "IUUQI-DGH5I-TJ045",
833
-
"code" : "searchjob.invalid.timestamp.from",
834
-
"message" : "The 'from' field contains an invalid time."
843
+
"warning": "A 404 status (Page Not Found) on a follow-up request may be due to a cookie not accompanying the request",
0 commit comments