POST /v2/search/jobs
Create a new search job.
Servers
- https://api.au.sumologic.com/api/
- https://api.ca.sumologic.com/api/
- https://api.ch.sumologic.com/api/
- https://api.de.sumologic.com/api/
- https://api.eu.sumologic.com/api/
- https://api.fed.sumologic.com/api/
- https://api.jp.sumologic.com/api/
- https://api.kr.sumologic.com/api/
- https://api.in.sumologic.com/api/
- https://api.sumologic.com/api/
- https://api.us2.sumologic.com/api/
Request headers
| Name | Type | Required | Description |
|---|---|---|---|
Content-Type |
String | Yes |
The media type of the request body.
Default value: "application/json" |
Request body fields
| Name | Type | Required | Description |
|---|---|---|---|
to |
String | Yes |
The end date and time of the search. This follows the ISO 8601 date and time format. |
timezone |
String | Yes |
The time zone if from/to is not in milliseconds. See this Wikipedia article for a list of time zone codes. Default value: "UTC" |
query |
String | Yes |
The actual search expression. Ensure your query follows RFC 8259 and is valid JSON format, you may need to escape certain characters to follow the RFC 8259. |
requiresRawMessages |
String | No |
On enabling this field, the log messages applicable to the search are returned. Maximum value is 100,000. This is only applicable for aggregate queries. Default value: "false" |
includeAllChildOrgs |
Boolean | No |
When true, automatically resolves all child orgs of the authenticated parent and fans the search out across all of them. If this is set, it takes precedence over childOrgIds field. Default value is false. Default value: false |
autoParsingMode |
String | No |
Define the parsing mode to scan the JSON format log messages. Possible values are: AutoParse - System automatically figures out the fields to parse based on the search query. Manual - No fields are parsed out automatically. For more information, refer to the Dynamic Parsing. Default value: "Manual" |
intervalTimeType |
String | No |
This parameter defines whether you want to run the search by messageTime, receiptTime or searchableTime. Default value: "messageTime" |
maxRawRecords |
String | No |
Maximum number of raw records to finish the search. |
childOrgIds[] |
Array | No |
List of child organization ids to run the search on. |
from |
String | Yes |
The start date and time of the search. This follows the ISO 8601 date and time format. |
How to start integrating
- Add HTTP Task to your workflow definition.
- Search for the API you want to integrate with and click on the name.
- This loads the API reference documentation and prepares the Http request settings.
- Click Test request to test run your request to the API and see the API's response.