---
type: api
title: Get unified query history
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/operation/operation-osquerygetunifiedhistory
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/operation/operation-osquerygetunifiedhistory
products:
  - Kibana
---

# Get unified query history

Availability: Generally available since 9.4

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/osquery/history`
- `GET` `/s/{space_id}/api/osquery/history`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Query string parameters

- `pageSize` (integer · min: 1 · max: 100 · default: 20) — optional
  The number of results to return per page.
- `nextPage` (string) — optional
  A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
- `kuery` (string) — optional
  A search string to filter history entries by pack name, query text, or query ID.
- `userIds` (string) — optional
  Comma-separated list of user IDs to filter live query history.
  Example: `elastic,admin`
- `sourceFilters` (string) — optional
  Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
  Example: `live,scheduled`
- `startDate` (string) — optional
  The start of the time range filter (ISO 8601).
  Example: `2024-01-01T00:00:00Z`
- `endDate` (string) — optional
  The end of the time range filter (ISO 8601).
  Example: `2024-12-31T23:59:59Z`

## Response

Indicates a successful call.

`application/json`

- `data` (union oneOf[])
  The list of unified history rows for the current page.
  - **sourceType: live**
    - `sourceType` (enum)
      Identifies this as a live query history row.
      Values: `live`
    - `agentCount` (integer)
      For live queries, the number of agents targeted by the query. For scheduled rows, the number of distinct agents that responded.
    - `errorCount` (integer) — nullable
      The number of agent responses with errors.
    - `id` (string)
      Unique identifier for the history row.
    - `packId` (string)
      The ID of the pack containing the query.
    - `packName` (string)
      The name of the pack containing the query.
    - `queryName` (string)
      The name of the query, if available.
    - `queryText` (string)
      The SQL query that was executed.
    - `spaceId` (string)
      The Kibana space ID where the query was executed.
    - `successCount` (integer) — nullable
      The number of successful agent responses.
    - `timestamp` (string)
      The timestamp of the query execution.
    - `totalRows` (integer) — nullable
      The total number of result rows returned across all agents.
    - `actionId` (string)
      The Fleet action ID for the live query.
    - `agentAll` (boolean)
      Whether the query targeted all agents.
    - `agentIds` (string[])
      List of targeted agent IDs.
    - `agentPlatforms` (string[])
      List of targeted agent platforms.
    - `agentPolicyIds` (string[])
      List of targeted agent policy IDs.
    - `ecsMapping` (object)
      ECS mapping configuration used for the query.
    - `queriesTotal` (integer)
      The total number of sub-queries in the live action.
    - `queriesWithResults` (integer)
      The number of sub-queries that returned results.
    - `savedQueryId` (string)
      The saved query ID, if the live query was based on a saved query.
    - `source` (enum)
      Whether this was a manually run live query or triggered by a rule.
      Values: `Live`, `Rule`
    - `timeout` (integer)
      The query timeout in seconds.
    - `userId` (string)
      The ID of the user who ran the query.
    - `userProfileUid` (string)
      The user profile UID of the user who ran the query.
  - **sourceType: scheduled**
    - `sourceType` (enum)
      Identifies this as a scheduled query history row.
      Values: `scheduled`
    - `agentCount` (integer)
      For live queries, the number of agents targeted by the query. For scheduled rows, the number of distinct agents that responded.
    - `errorCount` (integer) — nullable
      The number of agent responses with errors.
    - `id` (string)
      Unique identifier for the history row.
    - `packId` (string)
      The ID of the pack containing the query.
    - `packName` (string)
      The name of the pack containing the query.
    - `queryName` (string)
      The name of the query, if available.
    - `queryText` (string)
      The SQL query that was executed.
    - `spaceId` (string)
      The Kibana space ID where the query was executed.
    - `successCount` (integer) — nullable
      The number of successful agent responses.
    - `timestamp` (string)
      The timestamp of the query execution.
    - `totalRows` (integer) — nullable
      The total number of result rows returned across all agents.
    - `executionCount` (integer)
      The execution count for this scheduled query run.
    - `plannedTime` (string)
      The planned execution time for the scheduled query.
    - `scheduleId` (string)
      The schedule ID for the scheduled query.
    - `source` (enum)
      Indicates this is a scheduled query execution.
      Values: `Scheduled`
- `hasMore` (boolean)
  Whether there are more results beyond the current page.
- `nextPage` (string)
  A base64-encoded cursor to fetch the next page. Absent when there are no more results.
## Code examples

#### Console

```console
GET kbn:/api/osquery/history
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/osquery/history" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### Example unified history response

```json
{
  "data": [
    {
      "actionId": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
      "agentCount": 5,
      "errorCount": 0,
      "id": "3c42c847-eb30-4452-80e0-728584042334",
      "queryName": "uptime_query",
      "queryText": "select * from uptime;",
      "source": "Live",
      "sourceType": "live",
      "successCount": 5,
      "timestamp": "2024-07-26T09:59:32.220Z",
      "totalRows": 42,
      "userId": "elastic"
    },
    {
      "agentCount": 10,
      "errorCount": 1,
      "executionCount": 3,
      "id": "pack_my_pack_uptime_3",
      "packId": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
      "packName": "My Pack",
      "plannedTime": "2024-07-26T09:00:00.000Z",
      "queryName": "uptime",
      "queryText": "select * from uptime;",
      "scheduleId": "pack_my_pack_uptime",
      "source": "Scheduled",
      "sourceType": "scheduled",
      "successCount": 9,
      "timestamp": "2024-07-26T09:00:00.000Z",
      "totalRows": 100
    }
  ],
  "hasMore": true,
  "nextPage": "eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3..."
}
```