Get scheduled query results

Base URL: https://{kibana_url}

GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results
GET /s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results

Refer to Spaces for more information.

Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Query parameters

Response

Indicates a successful call.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/osquery/scheduled_results/pack_my_pack_uptime/3/results

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/osquery/scheduled_results/pack_my_pack_uptime/3/results" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": {
    "edges": [
      {
        "_id": "row-001",
        "fields": {
          "host.uptime": [
            "12345"
          ]
        }
      },
      {
        "_id": "row-002",
        "fields": {
          "host.uptime": [
            "67890"
          ]
        }
      }
    ],
    "total": 2
  }
}