Get scheduled action results

Base URL: https://{kibana_url}

GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}

Auth

Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).

Path parameters

scheduleId string required: The schedule ID of the scheduled query.; Example: pack_my_pack_uptime
executionCount integer required: The execution count for this scheduled query run.

Query parameters

kuery string nullable: The kuery to filter the results by.; Example: agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
page integer nullable: The page number to return. The default is 1.
pageSize integer nullable: The number of results to return per page. The default is 20.
sort string · default: createdAt nullable: The field that is used to sort the results.
sortOrder enum: Specifies the sort order.; Values: asc desc

Response

Indicates a successful call.

application/json

aggregations object
currentPage integer: The current page number (zero-based).
edges object[]: The paginated list of per-agent action results.
inspect object: Debug/inspection data for the search query.
metadata object: Execution metadata resolved from the pack saved object.
pageSize integer: The number of results per page.
total integer: The total number of action results.
totalPages integer: The total number of pages.