Get scheduled action results

Server: https://{kibana_url}

GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}

Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).

Path Parameters

Query Parameters

Response

Indicates a successful call.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}

curl Shell

curl -X GET "https://{kibana_url}/api/osquery/scheduled_results/{scheduleId}/{executionCount}"

Response

{
  "aggregations": {
    "failed": 1,
    "pending": 0,
    "successful": 9,
    "totalResponded": 10,
    "totalRowCount": 42
  },
  "currentPage": 0,
  "edges": [
    {
      "_id": "result-001",
      "fields": {
        "agent_id": "16d7caf5-efd2-4212-9b62-73dafc91fa13",
        "rows_count": 5,
        "status": "success"
      }
    }
  ],
  "metadata": {
    "executionCount": 3,
    "packId": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
    "packName": "My Pack",
    "queryName": "uptime",
    "queryText": "select * from uptime;",
    "scheduleId": "pack_my_pack_uptime",
    "timestamp": "2024-07-26T09:00:00.000Z"
  },
  "pageSize": 20,
  "total": 10,
  "totalPages": 1
}

Path Parameters { scheduleId , executionCount , }

Query Parameters { kuery , page , pageSize , sort , sortOrder , }

Response

Path Parameters

Query Parameters