Get scheduled action results

Base URL: https://{kibana_url}

GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}

Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Query parameters

Response

Indicates a successful call.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/osquery/scheduled_results/pack_my_pack_uptime/3

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/osquery/scheduled_results/pack_my_pack_uptime/3" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "aggregations": {
    "failed": 1,
    "pending": 0,
    "successful": 9,
    "totalResponded": 10,
    "totalRowCount": 42
  },
  "currentPage": 0,
  "edges": [
    {
      "_id": "result-001",
      "fields": {
        "agent_id": "16d7caf5-efd2-4212-9b62-73dafc91fa13",
        "rows_count": 5,
        "status": "success"
      }
    }
  ],
  "metadata": {
    "executionCount": 3,
    "packId": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
    "packName": "My Pack",
    "queryName": "uptime",
    "queryText": "select * from uptime;",
    "scheduleId": "pack_my_pack_uptime",
    "timestamp": "2024-07-26T09:00:00.000Z"
  },
  "pageSize": 20,
  "total": 10,
  "totalPages": 1
}