Get scheduled query results

Base URL: https://{kibana_url}

GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results

Auth

Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.

Path parameters

scheduleId string required: The schedule ID of the scheduled query.; Example: pack_my_pack_uptime
executionCount integer required: The execution count for this scheduled query run.

Query parameters

kuery string nullable: The kuery to filter the results by.; Example: agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
page integer nullable: The page number to return. The default is 1.
pageSize integer nullable: The number of results to return per page. The default is 20.
sort string · default: createdAt nullable: The field that is used to sort the results.
sortOrder enum: Specifies the sort order.; Values: asc desc
startDate string: The start date filter (ISO 8601) to narrow down results.; Example: 2024-01-01T00:00:00Z

Response

Indicates a successful call.

application/json

data object: The query results data wrapper.

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/osquery/scheduled_results/pack_my_pack_uptime/3/results

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/osquery/scheduled_results/pack_my_pack_uptime/3/results" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": {
    "edges": [
      {
        "_id": "row-001",
        "fields": {
          "host.uptime": [
            "12345"
          ]
        }
      },
      {
        "_id": "row-002",
        "fields": {
          "host.uptime": [
            "67890"
          ]
        }
      }
    ],
    "total": 2
  }
}