Sign in

v1

latestOpenAPI 3.0.02026-08-064311,0881.3 MB
logSearchesEstimatedUsage

Gets estimated usage details per view.

Gets the estimated volume of data, per view, that would be scanned for running a given log search for a given timerange.

post/v1/logSearches/estimatedUsageByView

Request body

queryStringstring required

Log search Query to compute the estimated volume of data scanned.

intervalTimeTypestring

This parameter defines whether you want to run the search by messageTime, receiptTime, or searchableTime. By default, the search will run by messageTime. If both runByReceiptTime and intervalTimeType parameters are present then the preference will be given to the intervalTimeType.

runByReceiptTimeboolean

This has the value true if the search is to be run by receipt time and false if it is to be run by message time.

timezonestring required

Time zone to get the estimated usage details. Follow the format in the IANA Time Zone Database.

Example request

{
  "queryString": "error {{sourceCategory}}| count by _sourceCategory",
  "timeRange": {
    "type": "BeginBoundedTimeRange",
    "from": {
      "type": "RelativeTimeRangeBoundary",
      "relativeTime": "-15m"
    }
  },
  "queryParameters": [
    {
      "autoComplete": {
        "type": "SKIP_AUTOCOMPLETE",
        "autoCompleteKey": "Ephemeral-3644138589235809747-1583470806220-parameter",
        "lookupMetaData": {
          "fileName": "users.csv",
          "valueColumn": "user_id",
          "labelColumn": "user_name"
        }
      },
      "name": "sourceCategory",
      "description": "source category for the string",
      "dataType": "STRING",
      "value": "apache"
    }
  ],
  "intervalTimeType": "messageTime",
  "timezone": "America/Los_Angeles",
  "emulateSearchContext": {
    "roleIds": [
      "000000000000000C"
    ],
    "userId": "000000000000019F"
  }
}

Response

Log search information along with its view wise estimated usage details.

queryStringstring required

Log search Query to compute the estimated volume of data scanned.

intervalTimeTypestring

This parameter defines whether you want to run the search by messageTime, receiptTime, or searchableTime. By default, the search will run by messageTime. If both runByReceiptTime and intervalTimeType parameters are present then the preference will be given to the intervalTimeType.

runByReceiptTimeboolean

This has the value true if the search is to be run by receipt time and false if it is to be run by message time.

timezonestring required

Time zone to get the estimated usage details. Follow the format in the IANA Time Zone Database.

Example response

{
  "queryString": "error {{sourceCategory}}| count by _sourceCategory",
  "timeRange": {
    "type": "BeginBoundedTimeRange",
    "from": {
      "type": "RelativeTimeRangeBoundary",
      "relativeTime": "-15m"
    }
  },
  "queryParameters": [
    {
      "autoComplete": {
        "type": "SKIP_AUTOCOMPLETE",
        "autoCompleteKey": "Ephemeral-3644138589235809747-1583470806220-parameter",
        "lookupMetaData": {
          "fileName": "users.csv",
          "valueColumn": "user_id",
          "labelColumn": "user_name"
        }
      },
      "name": "sourceCategory",
      "description": "source category for the string",
      "dataType": "STRING",
      "value": "apache"
    }
  ],
  "intervalTimeType": "messageTime",
  "timezone": "America/Los_Angeles",
  "emulateSearchContext": {
    "roleIds": [
      "000000000000000C"
    ],
    "userId": "000000000000019F"
  },
  "estimatedUsageDetails": [
    {
      "usageDetails": [
        {
          "meteringType": "Continuous",
          "dataScannedInBytes": 114086541,
          "tier": "Continuous"
        }
      ]
    }
  ]
}