Get scheduled query results

Server: https://{kibana_url}

GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results
GET /s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results

Api key auth Basic auth

Refer to Spaces for more information.

Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.

Path Parameters

Query Parameters

Response

Indicates a successful call.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results

curl Shell

curl -X GET "https://{kibana_url}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results"

Response

{
  "data": {
    "edges": [
      {
        "_id": "row-001",
        "fields": {
          "host.uptime": [
            "12345"
          ]
        }
      },
      {
        "_id": "row-002",
        "fields": {
          "host.uptime": [
            "67890"
          ]
        }
      }
    ],
    "total": 2
  }
}

Path Parameters { scheduleId , executionCount , }

Query Parameters { kuery , page , pageSize , sort , sortOrder , startDate , }

Response

Path Parameters

Query Parameters