Sign in

v1

latestOpenAPI 3.0.02026-08-064311,0881.3 MB
logSearchesEstimatedUsage

Gets estimated usage details.

Gets the estimated volume of data that would be scanned for a given log search in the Infrequent data tier.

post/v1/logSearches/estimatedUsage

Request body

queryStringstring required

Query to perform.

runByReceiptTimeboolean

This has the value true if the search is to be run by receipt time and false if it is to be run by message time.

intervalTimeTypestring

This parameter defines whether you want to run the search by messageTime, receiptTime, or searchableTime. By default, the search will run by messageTime. If both runByReceiptTime and intervalTimeType parameters are present then the preference will be given to the intervalTimeType.

parsingModestring

Define the parsing mode to scan the JSON format log messages. Possible values are:

  1. AutoParse
  2. Manual In AutoParse mode, the system automatically figures out fields to parse based on the search query. While in the Manual mode, no fields are parsed out automatically. For more information see Dynamic Parsing.
timezonestring required

Time zone to get the estimated usage details. Follow the format in the IANA Time Zone Database.

Example request

{
  "queryString": "error {{sourceCategory}}| count by _sourceCategory",
  "timeRange": {
    "type": "BeginBoundedTimeRange",
    "from": {
      "type": "RelativeTimeRangeBoundary",
      "relativeTime": "-15m"
    }
  },
  "queryParameters": [
    {
      "autoComplete": {
        "type": "SKIP_AUTOCOMPLETE",
        "autoCompleteKey": "Ephemeral-3644138589235809747-1583470806220-parameter",
        "lookupMetaData": {
          "fileName": "users.csv",
          "valueColumn": "user_id",
          "labelColumn": "user_name"
        }
      },
      "name": "sourceCategory",
      "description": "source category for the string",
      "dataType": "STRING",
      "value": "apache"
    }
  ],
  "intervalTimeType": "messageTime",
  "parsingMode": "AutoParse",
  "timezone": "America/Los_Angeles"
}

Response

Log search information along with its estimated usage details.

queryStringstring required

Query to perform.

runByReceiptTimeboolean

This has the value true if the search is to be run by receipt time and false if it is to be run by message time.

intervalTimeTypestring

This parameter defines whether you want to run the search by messageTime, receiptTime, or searchableTime. By default, the search will run by messageTime. If both runByReceiptTime and intervalTimeType parameters are present then the preference will be given to the intervalTimeType.

parsingModestring

Define the parsing mode to scan the JSON format log messages. Possible values are:

  1. AutoParse
  2. Manual In AutoParse mode, the system automatically figures out fields to parse based on the search query. While in the Manual mode, no fields are parsed out automatically. For more information see Dynamic Parsing.
timezonestring required

Time zone to get the estimated usage details. Follow the format in the IANA Time Zone Database.

Example response

{
  "queryString": "error {{sourceCategory}}| count by _sourceCategory",
  "timeRange": {
    "type": "BeginBoundedTimeRange",
    "from": {
      "type": "RelativeTimeRangeBoundary",
      "relativeTime": "-15m"
    }
  },
  "queryParameters": [
    {
      "autoComplete": {
        "type": "SKIP_AUTOCOMPLETE",
        "autoCompleteKey": "Ephemeral-3644138589235809747-1583470806220-parameter",
        "lookupMetaData": {
          "fileName": "users.csv",
          "valueColumn": "user_id",
          "labelColumn": "user_name"
        }
      },
      "name": "sourceCategory",
      "description": "source category for the string",
      "dataType": "STRING",
      "value": "apache"
    }
  ],
  "intervalTimeType": "messageTime",
  "parsingMode": "AutoParse",
  "timezone": "America/Los_Angeles",
  "estimatedUsageDetails": {
    "dataScannedInBytes": 114086541
  }
}