1"use strict";(self.webpackChunksumo_docs=self.webpackChunksumo_docs||[]).push([["10559"],{69863(e,s,t){t.r(s),t.d(s,{metadata:()=>n,default:()=>g,frontMatter:()=>h,contentTitle:()=>j,toc:()=>u,assets:()=>x});var n=JSON.parse('{"id":"api/search-job","title":"Search Job APIs","description":"Search Job APIs provide access to resources and log data from third-party scripts and applications, available as a legacy API or through the newer OpenAPI-based Search Job Management API.","source":"@site/docs/api/search-job.md","sourceDirName":"api","slug":"/api/search-job","permalink":"/help/docs/api/search-job","draft":false,"unlisted":false,"editUrl":"https://github.com/SumoLogic/sumologic-documentation/edit/main/docs/api/search-job.md","tags":[],"version":"current","lastUpdatedBy":"Jagadisha V","lastUpdatedAt":1788276127000,"frontMatter":{"id":"search-job","title":"Search Job APIs","sidebar_label":"Search Job","description":"Search Job APIs provide access to resources and log data from third-party scripts and applications, available as a legacy API or through the newer OpenAPI-based Search Job Management API.","toc_max_heading_level":4},"sidebar":"api","previous":{"title":"SCIM User","permalink":"/help/docs/api/scim-user"},"next":{"title":"Service Accounts","permalink":"/help/docs/api/service-accounts"}}'),r=t(74848),i=t(28453),l=t(66497),c=t(41957),a=t(12869),o=t(42258),d=t(68959);let h={id:"search-job",title:"Search Job APIs",sidebar_label:"Search Job",description:"Search Job APIs provide access to resources and log data from third-party scripts and applications, available as a legacy API or through the newer OpenAPI-based Search Job Management API.",toc_max_heading_level:4},j,x={},u=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Required role capabilities",id:"required-role-capabilities",level:2},...o.RM,{value:"Session timeout",id:"session-timeout",level:2},{value:"Search job result limits",id:"search-job-result-limits",level:2},{value:"Rate limit throttling",id:"rate-limit-throttling",level:2},...d.RM,{value:"Process flow",id:"process-flow",level:2},{value:"Errors",id:"errors",level:2},{value:"Search Job Management API",id:"search-job-management-api",level:2},{value:"Documentation",id:"documentation",level:3},...a.RM,{value:"Legacy Search Job API",id:"legacy-search-job-api",level:2},{value:"Endpoints for API access",id:"endpoints-for-api-access",level:3},{value:"GET Methods",id:"get-methods",level:3},{value:"Get the current Search Job status",id:"get-the-current-search-job-status",level:4},...c.RM,{value:"Request parameters",id:"request-parameters",level:5},{value:"Result",id:"result",level:5},{value:"Sample session",id:"sample-session",level:5},...c.RM,{value:"More about results",id:"more-about-results",level:5},{value:"Paging through the messages found by a search job",id:"paging-through-the-messages-found-by-a-search-job",level:4},...c.RM,{value:"Request parameters",id:"request-parameters-1",level:5},{value:"Sample session",id:"sample-session-1",level:5},...c.RM,{value:"More about results",id:"more-about-results-1",level:5},{value:"Page through the records found by a Search Job",id:"page-through-the-records-found-by-a-search-job",level:4},...c.RM,{value:"Request parameters",id:"request-parameters-2",level:5},{value:"Sample session",id:"sample-session-2",level:5},{value:"POST Methods",id:"post-methods",level:3},{value:"Create a search job",id:"create-a-search-job",level:4},...c.RM,{value:"Headers",id:"headers",level:5},{value:"Request parameters",id:"request-parameters-3",level:5},{value:"Status codes",id:"status-codes",level:5},{value:"Response headers",id:"response-headers",level:5},{value:"Result",id:"result-1",level:5},{value:"Sample session",id:"sample-session-3",level:5},...c.RM,{value:"DELETE Methods",id:"delete-methods",level:3},{value:"Delete a search job",id:"delete-a-search-job",level:4},...c.RM,{value:"Request parameters",id:"request-parameters-4",level:5},{value:"Sample session",id:"sample-session-4",level:5},...c.RM,{value:"Bash this Search Job",id:"bash-this-search-job",level:3}];function p(e){let s={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",h4:"h4",h
15:"h5",hr:"hr",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,i.R)(),...e.components},{Details:t}=s;return t||function(e,s){throw Error("Expected "+(s?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)("img",{src:(0,l.Ay)("img/icons/search.png"),alt:"Search icon",width:"55"}),"\n",(0,r.jsx)(s.p,{children:"The Search Job API provides third-party scripts and applications access to your log data through access key/access ID authentication. It's available in two versions:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:(0,r.jsx)(s.a,{href:"#search-job-management-api",children:"Search Job Management API"})}),". Built with OpenAPI specifications. Each request is addressed by the search job's ",(0,r.jsx)(s.code,{children:"jobId"})," alone, so it doesn't require session cookies to keep a search job alive between requests. We recommend this version for new integrations."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:(0,r.jsx)(s.a,{href:"#legacy-search-job-api",children:"Legacy Search Job API"})}),". The earlier version. Requires session cookies to keep a search job alive between requests, and is slower than the OpenAPI-based version."]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsx)(s.p,{children:"The Search Job API is available to Enterprise accounts."}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Account Type"}),(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Account Level"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Cloud Flex Legacy"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Enterprise"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Sumo Logic Credits"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Trial, Enterprise Operations, Enterprise Security, Enterprise Suite"})]})]})]}),"\n",(0,r.jsx)(s.h2,{id:"required-role-capabilities",children:"Required role capabilities"}),"\n",(0,r.jsx)(o.Ay,{}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.a,{href:"/docs/manage/users-roles/roles/role-capabilities/#security",children:"Security"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Manage Access Keys"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(s.admonition,{type:"note",children:(0,r.jsxs)(s.p,{children:["For an access key with a customized scope, make sure ",(0,r.jsx)(s.strong,{children:"Run Log Search"})," is added to the scope."]})}),"\n",(0,r.jsx)(s.h2,{id:"session-timeout",children:"Session timeout"}),"\n",(0,r.jsx)(s.p,{children:"While the search job is running you need to request the job status based on the search job ID. The API keeps the search job alive by either polling for status every 20 to 30 seconds or gathering results. If the search job is not kept alive by API requests, it is canceled. When a search job is canceled for inactivity, you will get a 404 status."}),"\n",(0,r.jsx)(s.p,{children:"There's a query timeout after eight hours, even if the API is polling and making requests. If you are running very few queries, you may be able to go a little longer, but you can expect most of your queries to end after eight hours."}),"\n",(0,r.jsx)(s.p,{children:"You can start requesting results asynchronously while the job is running and page through partial results while the job is in progress."}),"\n",(0,r.jsx)(s.admonition,{type:"note",children:(0,r.jsxs)(s.p,{children:["For the ",(0,r.jsx)(s.a,{href:"#legacy-search-job-api",children:"Legacy Search Job API"}),", a 404 status can also result from a missing session cookie, since that version requires cookies to keep a search job alive."]})}),"\n",(0,r.jsx)(s.h2,{id:"search-job-result-limits",children:"Search job result limits"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Data Tier"}),(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Non-aggregate Search"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Continuous"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Can return up to 100K messages per search."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Frequent"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Can return up to 100K messages per search."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Infrequent"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Can return up to 100K messages per search."})]})]})]}),"\n",(0,r.jsx)(s.admonition,{type:"info",children:(0,r.jsx)(s.p,{children:"Flex Licensing model can return up to 100K messages per search."})}),"\n",(0,r.jsx)(s.p,{children:"If you need more results, you'll need to break up your search into several searches that span smaller blocks of the time range needed."}),"\n",(0,r.jsx)(s.h2,{id:"rate-limit-throttling",children:"Rate limit throttling"}),"\n",(0,r.jsx)(s.p,{children:"In general, API processing has the following limits:"}),"\n","\n",(0,r.jsx)(d.Ay,{}),"\n",(0,r.jsxs)(s.p,{children:["Search Job APIs have additional limits. A limit of 200 active concurrent search jobs applies to your organization. Once you reach the limit of 200 active searches, attempting an additional search will return a status code of ",(0,r.jsx)(s.code,{children:"429 Too Many Requests"}),", indicating that you've exceeded the permitted search job limit."]}),"\n",(0,r.jsx)(s.p,{children:"This limit applies only to Search Job API searches, and does not take into account searches run from the Sumo UI, scheduled searches, or dashboard panel searches that are running at the same time. If the search job is not kept alive by API requests every 20-30 seconds, it is canceled."}),"\n",(0,r.jsxs)(s.p,{children:["You can reduce the number of active search jobs by explicitly deleting a search after you receive the results. Manual deletion of searches helps maintain a low count of active searches and helps keep you from reaching the Search Job API throttling limit. See ",(0,r.jsx)(s.a,{href:"#delete-a-search-job",children:"Deleting a search job"})," for details."]}),"\n",(0,r.jsx)(s.h2,{id:"process-flow",children:"Process flow"}),"\n",(0,r.jsx)(s.p,{children:"The following figure shows the process flow for search jobs."}),"\n",(0,r.jsx)("img",{src:(0,l.Ay)("img/api/search_job_api_process_flow.png"),alt:"search_job_api_process_flow",width:"400"}),"\n",(0,r.jsxs)(s.ol,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:"Request."})," You request a search job, giving the query and time range."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:"Response."})," Sumo Logic responds with a job ID. If there\u2019s a problem with the request, an error code is provided (see the list of error codes following the figure)."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:"Request."})," Use the job ID to request search status. This needs to be done at least every 20-30 seconds so the search session is not canceled due to inactivity."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:"Response."})," Sumo Logic responds with job status. An error code (404) is returned if the request could not be completed. The status includes the current state of the search job (gathering results, done executing, etc.). It also includes the message and record counts based on how many results have already been found while executing the search. For non-aggregation queries, only the number of messages is reported. For aggregation queries, the number of records produced is also reported. The search job status provides access to an implicitly generated histogram of the distribution of found messages over the time range specified for the search job. During and after execution, the API can be used to request available messages and records in a paging fashion."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:"Request."})," You request results. It\u2019s not necessary for the search to be complete for the user to request results; the process works asynchronously. You can repeat the request as often as needed to keep seeing updated results, keeping in mind the rate limits. The Search Job API can return 100K messages per search."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:"Response."})," Sumo Logic delivers JSON-formatted search results as requested. The API can deliver partial results that the user can start paging through, even as new results continue to come in. If there\u2019s a problem with the results, an error code is provided (see the list of error codes following the figure)."]}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"errors",children:"Errors"}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Generic errors that apply to all APIs"})}),"\n",(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsxs)("td",{children:[(0,r.jsx)("strong",{children:"Code"})," "]}),(0,r.jsxs)("td",{children:[(0,r.jsx)("strong",{children:"Error"})," "]}),(0,r.jsxs)("td",{children:[(0,r.jsx)("strong",{children:"Description"})," "]})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"301"}),(0,r.jsx)("td",{children:"moved"}),(0,r.jsx)("td",{children:"The requested resource SHOULD be accessed through returned URI in Location Header."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"401"}),(0,r.jsx)("td",{children:"unauthorized"}),(0,r.jsx)("td",{children:"Credential could not be verified."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"403"}),(0,r.jsx)("td",{children:"forbidden"}),(0,r.jsx)("td",{children:"This operation is not allowed for your account type."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"404"}),(0,r.jsx)("td",{children:"notfound"}),(0,r.jsx)("td",{children:"Requested resource could not be found."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"405"}),(0,r.jsx)("td",{children:"method.unsupported"}),(0,r.jsx)("td",{children:"Unsupported method for URL."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"415"}),(0,r.jsx)("td",{children:"contenttype.invalid"}),(0,r.jsx)("td",{children:"Invalid content type."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"429"}),(0,r.jsx)("td",{children:"rate.limit.exceeded"}),(0,r.jsx)("td",{children:"The API request rate is higher than 4 request per second or your organization has exceeded the 200 active concurrent search job limit."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"500"}),(0,r.jsx)("td",{children:"internal.error"}),(0,r.jsx)("td",{children:"Internal server error."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"503"}),(0,r.jsx)("td",{children:"service.unavailable"}),(0,r.jsx)("td",{children:"Service is currently unavailable."})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsxs)(s.strong,{children:["Errors when creating the search query (#2 in the ",(0,r.jsx)(s.a,{href:"#process-flow",children:"process flow"}),")"]})}),"\n",(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Code"})}),(0,r.jsxs)("td",{children:[(0,r.jsx)("strong",{children:"Error"})," "]}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Description"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:"generic"}),(0,r.jsx)("td",{children:"Generic error."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:"invalid.timestamp.to"}
1),(0,r.jsx)("td",{children:"The 'to' field contains an invalid time."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400 "}),(0,r.jsx)("td",{children:"invalid.timestamp.from"}),(0,r.jsx)("td",{children:"The 'from' field contains an invalid time. "})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:"to.smaller.than.from"}),(0,r.jsx)("td",{children:"The 'from' time cannot be larger than the 'to' time."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:"unknown.timezone"}),(0,r.jsxs)("td",{children:["The 'timezone' value is not a known time zone. See this ",(0,r.jsx)("a",{href:"https://en.wikipedia.org/wiki/List_of_tz_database_time_zones",children:"Wikipedia article"})," for a list of time zone codes."]})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:"empty.timezone"}),(0,r.jsx)("td",{children:"The 'timezone' cannot be blank."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:"no.query"}),(0,r.jsx)("td",{children:"No 'query' parameter was provided."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:"unknown.time.type"}),(0,r.jsx)("td",{children:"Time type is not correct."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:"parse.error"}),(0,r.jsx)("td",{children:"Unable to parse query."})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsxs)(s.strong,{children:["Error when requesting status (#3 in the ",(0,r.jsx)(s.a,{href:"#process-flow",children:"process flow"}),")"]})}),"\n",(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Code"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Error"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Description"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"404"}),(0,r.jsx)("td",{children:'"jobid.invalid" '}
1),(0,r.jsx)("td",{children:'"Job ID is invalid."'})]})]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsxs)(s.strong,{children:["Errors when paging through the result set (#5 in the ",(0,r.jsx)(s.a,{href:"#process-flow",children:"process flow"}),")"]})}),"\n",(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsxs)("td",{children:[(0,r.jsx)("strong",{children:"Code"})," "]}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Error"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Description"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:'"jobid.invalid"'}),(0,r.jsx)("td",{children:'"Job ID is invalid."'})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:'"offset.missing"'}),(0,r.jsx)("td",{children:'"Offset is missing."'})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:'"offset.negative"'}),(0,r.jsx)("td",{children:'"Offset cannot be negative."'})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:'"limit.missing"'}),(0,r.jsx)("td",{children:'"Limit is missing."'})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:'"limit.zero"'}),(0,r.jsx)("td",{children:'"Limit cannot be 0."'})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:'"limit.negative"'}),(0,r.jsx)("td",{children:'"Limit cannot be negative."'})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:'"no.records.not.an.aggregation.query"'}),(0,r.jsx)("td",{children:'"No records; query is not an aggregation"'})]})]}),"\n",(0,r.jsx)(s.h2,{id:"search-job-management-api",children:"Search Job Management API"}),"\n",(0,r.jsxs)(s.p,{children:["The Search Job Management API is built with OpenAPI specifications. Each request is addressed by the search job's ",(0,r.jsx)(s.code,{children:"jobId"})," alone, so it doesn't require session cookies to keep a search job alive between requests."]}),"\n",(0,r.jsxs)(s.admonition,{title:"MSSP multi-org searches",type:"tip",children:[(0,r.jsxs)(s.p,{children:["If you manage child organizations, you can run a search job across one, several, or all of them by setting ",(0,r.jsx)(s.code,{children:"childOrgIds"})," or ",(0,r.jsx)(s.code,{children:"includeAllChildOrgs"})," when you create the search job. This is the API equivalent of the multi-org search available in the Search UI. ",(0,r.jsx)(s.a,{href:"/docs/search/search-across-child-orgs/",children:"Learn more"}),"."]}),(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Parameter"}),(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Type"}),(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.code,{children:"childOrgIds"})}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Array of strings"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"List of child org IDs to run the search on."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.code,{children:"includeAllChildOrgs"})}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Boolean"}),(0,r.jsxs)(s.td,{style:{textAlign:"left"},children:["When ",(0,r.jsx)(s.code,{children:"true"}),", runs the search across all child orgs of the authenticated parent org. Takes precedence over ",(0,r.jsx)(s.code,{children:"childOrgIds"})," if both are set. Default is ",(0,r.jsx)(s.code,{children:"false"}),"."]})]})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"documentation",children:"Documentation"}),"\n",(0,r.jsx)(a.Ay,{}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Region code"}),(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Region name"}),(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"AWS region"}),(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"API endpoint"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"AU"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Asia Pacific (Sydney)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"ap-southeast-2"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.au.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.au.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"CA"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Canada (Central)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"ca-central-1"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.ca.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.ca.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"CH"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Switzerland (Zurich)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"eu-central-2"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.ch.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.ch.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"DE"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"EU (Frankfurt)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"eu-central-1"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.de.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.de.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"ESC"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"AWS European Sovereign Cloud"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"eusc-de-east-1"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.esc.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.esc.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"EU"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"EU (Ireland)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"eu-west-1"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.eu.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.eu.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"FED"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"US East (N. Virginia)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"us-east-1"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.fed.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.fed.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"JP"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Asia Pacific (Tokyo)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"ap-northeast-1"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.jp.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.jp.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"KR"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Asia Pacific (Seoul)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"ap-northeast-2"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.kr.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.kr.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"US1"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"US East (N. Virginia)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"us-east-1"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.sumologic.com/docs/#tag/searchJobManagement"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"US2"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"US West (Oregon)"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"us-west-2"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:(0,r.jsx)(s.a,{href:"https://api.us2.sumologic.com/docs/#tag/searchJobManagement",children:"https://api.us2.sumologic.com/docs/#tag/searchJobManagement"})})]})]})]}),"\n",(0,r.jsx)(s.h2,{id:"legacy-search-job-api",children:"Legacy Search Job API"}),"\n",(0,r.jsxs)(s.p,{children:["The legacy Search Job API requires session cookies to keep a search job alive between requests, and is slower than the ",(0,r.jsx)(s.a,{href:"#search-job-management-api",children:"Search Job Management API"}),"."]}),"\n",(0,r.jsx)(s.p,{children:"You must enable cookies for subsequent requests to the search job. A 404 status (Page Not Found) on a follow-up request may be due to a cookie not accompanying the request."}),"\n",(0,r.jsx)(s.h3,{id:"endpoints-for-api-access",children:"Endpoints for API access"}),"\n",(0,r.jsx)(s.p,{children:"Sumo Logic has deployments that are assigned depending on the geographic location and the date an account is created. For API access, you must manually direct your API client to the correct Sumo Logic API URL."}),"\n",(0,r.jsxs)(s.p,{children:["See ",(0,r.jsx)(s.a,{href:"/docs/api/about-
1apis/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security",children:"Sumo Logic Endpoints"})," for the list of the URLs."]}),"\n",(0,r.jsxs)(s.p,{children:["An ",(0,r.jsx)(s.code,{children:"HTTP 301 Moved error"})," suggests that the wrong endpoint was specified."]}),"\n",(0,r.jsx)(s.h3,{id:"get-methods",children:"GET Methods"}),"\n",(0,r.jsx)(s.h4,{id:"get-the-current-search-job-status",children:"Get the current Search Job status"}),"\n",(0,r.jsxs)(t,{children:[(0,r.jsxs)("summary",{children:[(0,r.jsx)("span",{className:"api get",children:"GET"}),(0,r.jsx)("code",{children:"/v1/search/jobs/{SEARCH_JOB_ID}"})]}),(0,r.jsx)("p",{}),(0,r.jsx)(s.p,{children:"Use the search job ID to obtain the current status of a search job (step 4 in the process flow)."}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"Which API endpoint should I use?"}),(0,r.jsx)(c.Ay,{})]}),(0,r.jsx)(s.h5,{id:"request-parameters",children:"Request parameters"}),(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Parameter"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Type"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Required"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Description"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"searchJobId"}),(0,r.jsx)("td",{children:"String"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsx)("td",{children:"The ID of the search job."})]})]}),(0,r.jsx)(s.h5,{id:"result",children:"Result"}),(0,r.jsx)(s.p,{children:"The result is a JSON document containing the search job state, the number of messages found so far, the number of records produced so far, any pending warnings and errors, and any histogram buckets so far."}),(0,r.jsx)(s.h5,{id:"sample-session",children:"Sample session"}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-bash",children:"curl -v --trace-ascii - -b cookies.txt -c cookies.txt -H 'Accept: application/json'\n--user <ACCESSID>:<ACCESSKEY> https://api.sumologic.com/api/v1/search/jobs/37589506F194FC80\n"})}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"Which API endpoint should I use?"}),(0,r.jsx)(c.Ay,{})]}),(0,r.jsx)(s.p,{children:"This is the formatted result document:"}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-json",children:'{\n "warning":"",\n "state":"DONE GATHERING RESULTS",\n "messageCount":90,\n "histogramBuckets":[\n {\n "length":60000,\n "count":1,\n "startTimestamp":1359404820000\n },\n {\n "length":60000,\n "count":1,\n "startTimestamp":1359405480000\n },\n {\n "length":60000,\n "count":1,\n "startTimestamp":1359404340000\n }\n ],\n "pendingErrors":[\n ],\n "pendingWarnings":[\n ],\n "recordCount":1,\n "usageDetails":{\n "dataScannedInBytes":0\n }\n}\n'})}),(0,r.jsx)(s.p,{children:"Notice that the state of the sample search job is DONE GATHERING RESULTS. The following table includes possible states."}),(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"State"}),(0,r.jsx)(s.th,{style:{textAlign:"left"},children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"NOT STARTED"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Search job has not been started yet."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"GATHERING RESULTS"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Search job is still gathering more results, however results might already be available."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"GATHERING RESULTS FROM SUBQUERIES"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Search job is gathering results from the subqueries, before executing the main query."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"FORCE PAUSED"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Query that is paused by the system. It is true only for non-aggregate queries that are paused at the limit of 100k. This limit is dynamic and may vary from customer to customer."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"DONE GATHERING RESULTS"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Search job is done gathering results; the entire specified time range has been covered."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"DONE GATHERING HISTOGRAM"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"Search job is done gathering results needed to build a histogram; the entire specified time range needed to build the histogram has been covered."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"CANCELLED"}),(0,r.jsx)(s.td,{style:{textAlign:"left"},children:"The search job has been canceled. Note the spelling has two L letters."})]})]})]}),(0,r.jsx)(s.h5,{id:"more-about-results",children:"More about results"}),(0,r.jsxs)(s.p,{children:["The ",(0,r.jsx)(s.strong,{children:"warnings"})," value contains the detailed information about the warning while obtaining the current status of a search job."]}),(0,r.jsxs)(s.p,{children:["The ",(0,r.jsx)(s.strong,{children:"messageCount"})," and ",(0,r.jsx)(s.strong,{children:"recordCount"}
1)," values indicate the number of messages and records found or produced so far. Messages are raw log messages and records are aggregated data."]}),(0,r.jsxs)(s.p,{children:["For queries that do not contain an aggregation operator, only messages are returned. If the query contains an aggregation, for example, ",(0,r.jsx)(s.strong,{children:"count by _sourceCategory"}),", then the messages are returned along with records resulting from the aggregation (similar to what a SQL database would return)."]}),(0,r.jsxs)(s.p,{children:["The ",(0,r.jsx)(s.strong,{children:"pendingErrors"})," and ",(0,r.jsx)(s.strong,{children:"pendingWarnings"})," values contain any pending error or warning strings that have accumulated since the last time the status was requested."]}),(0,r.jsxs)(s.p,{children:["The ",(0,r.jsx)(s.strong,{children:"usageDetails"})," value contains the amount of data scanned in bytes details."]}),(0,r.jsx)(s.p,{children:"Errors and warnings are not cumulative. If you need to retain the errors and warnings, store them locally."}),(0,r.jsxs)(s.p,{children:["The ",(0,r.jsx)(s.strong,{children:"histogramBuckets"})," value returns a list of histogram buckets. A histogram bucket is defined by its timestamp, which is the start timestamp (in milliseconds) of the bucket, and a length, also in milliseconds, that expressed the width of the bucket. The ",(0,r.jsx)(s.strong,{children:"timestampplus"})," length is the end timestamp of the bucket, so the count is the number of messages in the bucket."]}),(0,r.jsx)(s.p,{children:"The histogram buckets correspond to the histogram display in the Sumo Logic interactive analytics API. The histogram buckets are not cumulative. Because the status API will return only the new buckets discovered since the last status call, the buckets need to be remembered by the client, if they are to be used. A search job in the Sumo Logic backend will always execute a query by finding and processing matching messages starting at the end of the specified time range, and moving to the beginning. During this process, histogram buckets are discovered and returned."}),(0,r.jsx)(s.p,{children:"Fields are not returned in the specified order and are all lowercase."})]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsx)(s.h4,{id:"paging-through-the-messages-found-by-a-search-job",children:"Paging through the messages found by a search job"}),"\n",(0,r.jsxs)(t,{children:[(0,r.jsxs)("summary",{children:[(0,r.jsx)("span",{className:"api get",children:"GET"}),(0,r.jsx)("code",{children:"/v1/search/jobs/{SEARCH_JOB_ID}/messages?offset={OFFSET}&limit={LIMIT}"})]}),(0,r.jsx)("p",{}),(0,r.jsxs)(s.p,{children:["The search job status informs the user about the number of found messages. The messages can be requested using a paging API call (step 6 in the process flow). Messages are always ordered by the latest ",(0,r.jsx)(s.code,{children:"_messageTime"})," value."]}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"Which API endpoint should I use?"}),(0,r.jsx)(c.Ay,{})]}),(0,r.jsx)(s.h5,{id:"request-parameters-1",children:"Request parameters"}),(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Parameter"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Type"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Required"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Description"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"searchJobId"}),(0,r.jsx)("td",{children:"String"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsx)("td",{children:"The ID of the search job."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"offset "}),(0,r.jsx)("td",{children:"Int"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsx)("td",{children:"Return message starting at this offset."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"limit"}),(0,r.jsx)("td",{children:"Int"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsx)("td",{children:"The number of messages starting at offset to return. The maximum value for limit is 10,000 messages or 100 MB in total message size, which means the query may return less than 10,000 messages if you exceed the size limit. "})]})]}),(0,r.jsx)(s.h5,{id:"sample-session-1",children:"Sample session"}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-bash",children:"curl -b cookies.txt -c cookies.txt -H 'Accept: application/json'\n--user <ACCESSID>:<ACCESSKEY> 'https://api.sumologic.com/api/v1/search/jobs/37589506F194FC80/messages?offset=0&limit=10'\n"})}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"Which API endpoint should I use?"}),(0,r.jsx)(c.Ay,{})]}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"This is the formatted result document (click to expand)"}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-json",children:'{\n "warning": "",\n "fields":[\n {\n "name":"_messageid",\n "fieldType":"long",\n "keyField":false\n },\n {\n "name":"_sourceid",\n "fieldType":"long",\n "keyField":false\n },\n {\n "name":"_sourceName",\n "fieldType":"string",\n "keyField":false\n },\n {\n "name":"_sourceHost",\n "fieldType":"string",\n "keyField":false\n },\n {\n "name":"_sourceCategory",\n "fieldType":"string",\n "keyField":false\n },\n {\n "name":"_format",\n "fieldType":"string",\n "keyField":false\n },\n {\n "name":"_size",\n "fieldType":"long",\n "keyField":false\n },\n {\n "name":"_messagetime",\n "fieldType":"long",\n "keyField":false\n },\n {\n "name":"_receipttime",\n "fieldType":"long",\n "keyField":false\n },\n {\n "name":"_messagecount",\n "fieldType":"int",\n "keyField":false\n },\n {\n "name":"_raw",\n "fieldType":"string",\n "keyField":false\n },\n {\n "name":"_source",\n "fieldType":"string",\n "keyField":false\n },\n {\n "name":"_collectorId",\n "fieldType":"long",\n "keyField":false\n },\n {\n "name":"_collector",\n "fieldType":"string",\n "keyField":false\n },\n {\n "name":"_blockid",\n "fieldType":"long",\n "keyField":false\n }\n ],\n "messages":[\n {\n "map":{\n "_receipttime":"1359407350899",\n "_source":"service",\n "_collector":"local",\n "_format":"plain:atp:o:0:l:29:p:yyyy-MM-dd HH:mm:ss,SSS ZZZZ",\n "_blockid":"-9223372036854775669",\n "_messageid":"-9223372036854773763",\n "_messagetime":"1359407350333",\n "_collectorId":"1579",\n "_sourceName":"/Users/christian/Development/sumo/ops/assemblies/latest/service-20.1-SNAPSHOT/logs/service.log",\n "_sourceHost":"Chiapet.local",\n "_raw":"2013-01-28 13:09:10,333 -0800 INFO [module=SERVICE] [logger=util.scala.zk.discovery.AWSServiceRegistry] [thread=pool-1-thread-1] FINISHED findRunningInstances(ListBuffer((Service: name: elasticache-1, defaultProps: Map()), (Service: name: userAndOrgCache, defaultProps: Map()), (Service: name: rds_cloudcollector, defaultProps: Map()))) returning Map((Service: name: elasticache-1, defaultProps: Map()) -> [], (Service: name: userAndOrgCache, defaultProps: Map()) -> [], (Service: name: rds_cloudcollector, defaultProps: Map()) -> []) after 1515 ms",\n "_size":"549",\n "_sourceCategory":"service",\n "_sourceid":"1640",\n "_messagecount":"2044"\n }\n },\n ...\n {\n "map":{\n "_receipttime":"1359407051885",\n "_source":"service",\n "_collector":"local",\n "_format":"plain:atp:o:0:l:29:p:yyyy-MM-dd HH:mm:ss,SSS ZZZZ",\n "_blockid":"-9223372036854775674",\n "_messageid":"-9223372036854773772",\n "_messagetime":"1359407049529",\n "_collectorId":"1579",\n "_sourceName":"/Users/christian/Development/sumo/ops/assemblies/latest/service-20.1-SNAPSHOT/logs/service.log",\n "_sourceHost":"Chiapet.local",\n "_raw":"2013-01-28 13:04:09,529 -0800 INFO [module=SERVICE] [logger=com.netflix.config.sources.DynamoDbConfigurationSource] [thread=pollingConfigurationSource] Successfully polled Dynamo for a new configuration based on table:raychaser-chiapetProperties",\n "_size":"246",\n "_sourceCategory":"service",\n "_sourceid":"1640",\n "_messagecount":"2035"\n }\n }\n ]\n}\n'})})]}),(0,r.jsx)(s.h5,{id:"more-about-results-1",children:"More about results"}),(0,r.jsxs)(s.p,{children:["The result contains two lists, ",(0,r.jsx)(s.strong,{children:"fields"})," and ",(0,r.jsx)(s.strong,{children:"messages"}),"."]}),(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["*",(0,r.jsx)(s.strong,{children:"warnings"})," contains the detailed information about the warning while paging through the messages found by a search job."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:"fields"})," contains a list of all the fields defined for each of the messages returned. For each field, the field name and field type are returned."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.strong,{children:"messages"})," contains a list of maps, one map per message. Each ",(0,r.jsx)(s.strong,{children:"map"}
1)," maps from the fields described in the fields list to the actual value for the message."]}),"\n"]}),(0,r.jsxs)(s.p,{children:["For example, the field ",(0,r.jsx)(s.code,{children:"_raw"})," contains the raw collected log message."]}),(0,r.jsxs)(s.p,{children:[(0,r.jsx)(s.code,{children:"_messageTime"})," is the number of milliseconds since the epoch of the timestamp extracted from the message itself."]}),(0,r.jsxs)(s.p,{children:[(0,r.jsx)(s.code,{children:"_receipttime"})," is the number of milliseconds since the epoch of the timestamp of arrival of the message in the Sumo Logic system."]}),(0,r.jsxs)(s.p,{children:["The metadata fields ",(0,r.jsx)(s.code,{children:"_sourceHost"}),", ",(0,r.jsx)(s.code,{children:"_sourceName"}),", and ",(0,r.jsx)(s.code,{children:"_sourceCategory"}),", which are also featured in Sumo Logic, are available here."]})]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsx)(s.h4,{id:"page-through-the-records-found-by-a-search-job",children:"Page through the records found by a Search Job"}),"\n",(0,r.jsxs)(t,{children:[(0,r.jsxs)("summary",{children:[(0,r.jsx)("span",{className:"api get",children:"GET"}),(0,r.jsx)("code",{children:"/v1/search/jobs/{SEARCH_JOB_ID}/records?offset={OFFSET}&limit={LIMIT}"})]}),(0,r.jsx)("p",{}),(0,r.jsx)(s.p,{children:"The search job status informs the user as to the number of produced records, if the query performs an aggregation. Those records can be requested using a paging API call (step 6 in the process flow), just as the message can be requested."}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"Which API endpoint should I use?"}),(0,r.jsx)(c.Ay,{})]}),(0,r.jsx)(s.h5,{id:"request-parameters-2",children:"Request parameters"}),(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Parameter"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Type"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Required"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Description"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"searchJobId"}),(0,r.jsx)("td",{children:"String"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsx)("td",{children:"The ID of the search job."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"offset"}),(0,r.jsx)("td",{children:"Int"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsx)("td",{children:"Return records starting at this offset."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"limit"}),(0,r.jsx)("td",{children:"Int"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsx)("td",{children:"The number of records starting at offset to return. The maximum value for limit is 10,000 records. "})]})]}),(0,r.jsx)(s.h5,{id:"sample-session-2",children:"Sample session"}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-bash",children:"curl -b cookies.txt -c cookies.txt -H\n'Accept: application/json' --user <ACCESSID>:<ACCESSKEY>\n'https://api.sumologic.com/api/v1/search/jobs/37589506F194FC80/records?offset=0&limit=1'\n"})}),(0,r.jsx)(s.p,{children:"This is the formatted result document:"}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-json",children:'{\n "warning": "",\n "fields":[\n {\n "name":"_sourceCategory",\n "fieldType":"string",\n "keyField":true\n },\n {\n "name":"_count",\n "fieldType":"int",\n "keyField":false\n }\n ],\n "records":[\n {\n "map":{\n "_count":"90",\n "_sourceCategory":"service"\n }\n }\n ]\n}\n'})}),(0,r.jsx)(s.p,{children:"The returned document is similar to the one returned for the message paging API. The schema of the records returned is described by the list of fields as part of the fields element. The records themselves are a list of maps."}),(0,r.jsxs)(s.p,{children:["The *",(0,r.jsx)(s.strong,{children:"warnings"})," contains the detailed information about the warning while paging through the records found by a Search Job."]})]}),"\n",(0,r.jsx)(s.h3,{id:"post-methods",children:"POST Methods"}),"\n",(0,r.jsx)(s.h4,{id:"create-a-search-job",children:"Create a search job"}),"\n",(0,r.jsxs)(t,{children:[(0,r.jsxs)("summary",{children:[(0,r.jsx)("span",{className:"api post",children:"POST"}),(0,r.jsx)("code",{children:"/v1/search/jobs"})]}),(0,r.jsx)("p",{}),(0,r.jsxs)(s.p,{children:["To create a search job (step 1 in the ",(0,r.jsx)(s.a,{href:"#process-flow",children:"process flow"}),"), send a JSON request to the search job endpoint. JSON files need to be UTF-8 encoded following ",(0,r.jsx)(s.a,{href:"https://tools.ietf.org/html/rfc8259",children:"RFC 8259"}),"."]}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"Which API endpoint should I use?"}),(0,r.jsx)(c.Ay,{})]}),(0,r.jsx)(s.h5,{id:"headers",children:"Headers"}),(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Header"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Value"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"Content-Type"}),(0,r.jsx)("td",{children:"application/json"})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"Accept"}),(0,r.jsx)("td",{children:"application/json"})]})]}),(0,r.jsx)(s.h5,{id:"request-parameters-3",children:"Request parameters"}),(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Parameter"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Type"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Required"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Description"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"query"}),(0,r.jsx)("td",{children:"String "}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsxs)("td",{children:["The actual search expression. Make sure your query is valid JSON format following ",(0,r.jsx)("a",{href:"https://tools.ietf.org/html/rfc8259",children:"RFC 8259"}
1),", you may need to escape certain characters."]})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"from "}),(0,r.jsx)("td",{children:"String"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsxs)("td",{children:["The ",(0,r.jsx)("a",{href:"https://www.w3.org/TR/NOTE-datetime",children:"ISO 8601"})," date and time of the time range to start the search. ",(0,r.jsxs)("p",{children:["For example, to specify July 16, 2017, use the form ",(0,r.jsxs)("code",{children:["YYYY-MM-DDTHH:mm",":ss"]}),", or ",(0,r.jsx)("code",{children:"2017-07-16T00:00:00"}),"."]}),"\n",(0,r.jsx)("p",{children:"Can also be milliseconds since epoch."})]})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"to"}),(0,r.jsx)("td",{children:"String"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsxs)("td",{children:["The ",(0,r.jsx)("a",{href:"https://www.w3.org/TR/NOTE-datetime",children:"ISO 8601"})," date and time of the time range to end the search.",(0,r.jsxs)("p",{children:["For example, to specify July 26, 2017, use the form ",(0,r.jsxs)("code",{children:["YYYY-MM-DDTHH:mm",":ss"]}),", or ",(0,r.jsx)("code",{children:"2017-07-26T00:00:00"}),"."]}),(0,r.jsx)("p",{children:"Can also be milliseconds since epoch."})]})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"timeZone "}),(0,r.jsx)("td",{children:"String "}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsxs)("td",{children:["The time zone if from/to is not in milliseconds. See this ",(0,r.jsx)("a",{href:"https://en.wikipedia.org/wiki/List_of_tz_database_time_zones",children:"Wikipedia article"})," for a list of time zone codes. ",(0,r.jsx)("br",{}),(0,r.jsx)("br",{}),(0,r.jsxs)("p",{children:[(0,r.jsx)("strong",{children:"Note"})," Alternatively, you can use the parameter timezone instead of timeZone."]})]})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"byReceiptTime"}),(0,r.jsx)("td",{children:"Boolean"}),(0,r.jsx)("td",{children:"No "}),(0,r.jsxs)("td",{children:["Define as ",(0,r.jsx)("code",{children:"true"})," to run the search using ",(0,r.jsx)(s.a,{href:"/docs/search/get-started-with-search/build-search/use-receipt-time",children:"receipt time"}),". By default, searches do not run by receipt time. "]})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"bySearchableTime"}),(0,r.jsx)("td",{children:"Boolean"}),(0,r.jsx)("td",{children:"No "}),(0,r.jsxs)("td",{children:["Define as ",(0,r.jsx)("code",{children:"true"})," to run the search using ",(0,r.jsx)(s.a,{href:"/docs/search/get-started-with-search/build-search/use-searchable-time",children:"searchable time"}),". By default, searches do not run by searchable time. "]})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"autoParsingMode "}),(0,r.jsx)("td",{children:"String "}),(0,r.jsx)("td",{children:"No"}),(0,r.jsxs)("td",{children:["This enables ",(0,r.jsx)(s.a,{href:"/docs/search/get-started-with-search/build-search/dynamic-parsing",children:"dynamic parsing"}),". Values are: ",(0,r.jsx)("br",{}),(0,r.jsx)("br",{}),(0,r.jsx)("code",{children:"AutoParse"})," - Sumo Logic will perform field extraction on JSON log messages when you run a search.",(0,r.jsx)("br",{}),(0,r.jsx)("br",{}),(0,r.jsx)("code",{children:"Manual"})," - (Default value) Sumo Logic will not autoparse JSON logs at search time. ",(0,r.jsx)("br",{}),(0,r.jsx)("br",{}),(0,r.jsx)("strong",{children:"Note"})," Previously, the supported values for this parameter were ",(0,r.jsx)("code",{children:"performance"}),", ",(0,r.jsx)("code",{children:"intelligent"}),", and ",(0,r.jsx)("code",{children:"verbose"}),". These values still function, but are deprecated. Sumo Logic recommends the use of the new supported values: ",(0,r.jsx)("code",{children:"AutoParse"})," and ",(0,r.jsx)("code",{children:"Manual"}),". "]})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"requiresRawMessages"}),(0,r.jsx)("td",{children:"Boolean"}),(0,r.jsx)("td",{children:"No "}),(0,r.jsxs)("td",{children:["By default, the parameter value is set to ",(0,r.jsx)("code",{children:"false"})," to improve the performance of aggregate queries as raw messages will not be generated. "]})]})]}),(0,r.jsx)(s.h5,{id:"status-codes",children:"Status codes"}),(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsxs)("td",{children:[(0,r.jsx)("strong",{children:"Code"})," "]}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Text"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Description"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"202"}),(0,r.jsx)("td",{children:"Accepted"}),(0,r.jsx)("td",{children:"The search job has been successfully created."})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"400"}),(0,r.jsx)("td",{children:"Bad Request"}),(0,r.jsx)("td",{children:"Generic request error by the client. "})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"415"}),(0,r.jsx)("td",{children:"Unsupported Media Type"}),(0,r.jsx)("td",{children:"Content-Type wasn't set to application/json."})]})]}),(0,r.jsx)(s.h5,{id:"response-headers",children:"Response headers"}),(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"Header"}),(0,r.jsx)("td",{children:"Value"})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"Location"}),(0,r.jsxs)("td",{children:[" ",(0,r.jsxs)("code",{children:[(0,r.jsx)(s.a,{href:"https://api.sumologic.com/api/v1/search/jobs/<SEARCH_JOB_ID>",children:"https://api.sumologic.com/api/v1/search/jobs/<SEARCH_JOB_ID>"}),";"]})]})]})]}),(0,r.jsx)(s.h5,{id:"result-1",children:"Result"}),(0,r.jsx)(s.p,{children:"A JSON document containing the ID of the newly created search job. The ID is a string to use for all API interactions relating to the search job."}),(0,r.jsx)(s.p,{children:"Example error response:"}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-json",children:'{\n "warning": "A 404 status (Page Not Found) on a follow-up request may be due to a cookie not accompanying the request",\n "id": "IUUQI-DGH5I-TJ045",\n "link": {\n "rel": "self",\n "href": "https://api.sumologic.com/api/v1/search/jobs/IUUQI-DGH5I-TJ045"\n }\n}\n'})}),(0,r.jsx)(s.h5,{id:"sample-session-3",children:"Sample session"}),(0,r.jsxs)(s.p,{children:["The following sample session uses cURL. The Search Job API requires cookies to be honored by the client. Use ",(0,r.jsx)(s.code,{children:"curl -b cookies.txt -c cookies.txt"})," options to receive, store, and send back the cookies set by the API."]}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-bash",children:"curl -b cookies.txt -c cookies.txt -H 'Content-type: application/json'\n-H 'Accept: application/json' -X POST -T createSearchJob.json\n--user <ACCESSID>:<ACCESSKEY> https://api.sumologic.com/api/v1/search/jobs\n"})}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"Which API endpoint should I use?"}),(0,r.jsx)(c.Ay,{})]}),(0,r.jsxs)(s.p,{children:["The ",(0,r.jsx)(s.strong,{children:"createSearchJob.json"})," file looks like this:"]}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-json",children:'{\n "query": "| count _sourceCategory",\n "from": "2019-05-03T12:00:00",\n "to": "2019-05-03T12:05:00",\n "timeZone": "IST",\n "byReceiptTime": true\n}\n'})}),(0,r.jsxs)(s.p,{children:["The response from Sumo Logic returns the Search Job ID as the \u201CLocation\u201D header in the format: ",(0,r.jsx)(s.code,{children:"https://api.sumologic.com/api/v1/search/jobs/[SEARCH_JOB_ID]"}),"."]})]}),"\n",(0,r.jsx)(s.h3,{id:"delete-methods",children:"DELETE Methods"}),"\n",(0,r.jsx)(s.h4,{id:"delete-a-search-job",children:"Delete a search job"}),"\n",(0,r.jsxs)(t,{children:[(0,r.jsxs)("summary",{children:[(0,r.jsx)("span",{className:"api delete",children:"DELETE"}),(0,r.jsx)("code",{children:"/v1/search/jobs/{SEARCH_JOB_ID}"})]}),(0,r.jsx)("p",{}),(0,r.jsx)(s.p,{children:"Although search jobs ultimately time out in the Sumo Logic backend, it's a good practice to explicitly cancel a search job when it is not needed anymore."}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"Which API endpoint should I use?"}),(0,r.jsx)(c.Ay,{})]}),(0,r.jsx)(s.h5,{id:"request-parameters-4",children:"Request parameters"}),(0,r.jsxs)("table",{children:[(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Parameter"})}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Type"})}),(0,r.jsxs)("td",{children:[(0,r.jsx)("strong",{children:"Required"})," "]}),(0,r.jsx)("td",{children:(0,r.jsx)("strong",{children:"Description"})})]}),(0,r.jsxs)("tr",{children:[(0,r.jsx)("td",{children:"searchJobId"}),(0,r.jsx)("td",{children:"String"}),(0,r.jsx)("td",{children:"Yes"}),(0,r.jsx)("td",{children:"The ID of the search job. "})]})]}),(0,r.jsx)(s.h5,{id:"sample-session-4",children:"Sample session"}),(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-bash",children:"curl -b cookies.txt -c cookies.txt -X DELETE\n-H 'A
1ccept: application/json' --user <ACCESSID>:<ACCESSKEY>\nhttps://api.sumologic.com/api/v1/search/jobs/37589506F194FC80\n"})}),(0,r.jsxs)(t,{children:[(0,r.jsx)("summary",{children:"Which API endpoint should I use?"}),(0,r.jsx)(c.Ay,{})]})]}),"\n",(0,r.jsx)(s.h3,{id:"bash-this-search-job",children:"Bash this Search Job"}),"\n",(0,r.jsx)(s.p,{children:"You can use the following script to exercise the API."}),"\n",(0,r.jsx)(s.admonition,{type:"note",children:(0,r.jsx)(s.p,{children:"Ensure that you send ACCESSID/ACCESSKEY pair even if cookies are sent for the Search Job APIs."})}),"\n",(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-bash",children:'#!/bin/bash\n\n# Variables.\nPROTOCOL=$1 \xa0 \xa0# HTTPS is the only acceptable PROTOCOL\nHOST=$2 \xa0 \xa0 \xa0 \xa0# Use your Sumo endpoint as the HOST\nACCESSID=$3 \xa0 \xa0# Authenticate with an access id and key\nACCESSKEY=$4\nOPTIONS="--silent -b cookies.txt -c cookies.txt"\nOPTIONS="-v -b cookies.txt -c cookies.txt"\nOPTIONS="-v --trace-ascii -b cookies.txt -c cookies.txt"\n\nCreate a search job from a JSON file.\n#\nRESULT=$(curl $OPTIONS \xa0\\\n\xa0 \xa0 \xa0 \xa0 \xa0 -H "Content-type: application/json" \xa0 \\\n\xa0 \xa0 \xa0 \xa0 \xa0 -H "Accept: application/json" \xa0 \\\n\xa0 \xa0 \xa0 \xa0 \xa0 -d @createSearchJob.json \xa0\xa0\\\n\xa0 \xa0 \xa0 \xa0 \xa0 --user $ACCESSID:$ACCESSKEY \xa0\xa0 \\\n\xa0 \xa0 \xa0 \xa0 \xa0 "$PROTOCOL://$HOST/api/v1/search/jobs")\nJOB_ID=$(echo $RESULT | perl -pe \'s|.*"id":"(.*?)"[,}].*|\\1|\')\necho Search job created, id: $JOB_ID\n\n# Wait until the search job is done.\n\nSTATE=""\nuntil [ "$STATE" = "DONE GATHERING RESULTS" ]; do\n\xa0 sleep 5\n\xa0 RESULT=$(curl $OPTIONS \xa0\\\n\xa0 \xa0 \xa0 \xa0 \xa0 \xa0 -H "Accept: application/json" \\\n\xa0 \xa0 \xa0 \xa0 \xa0 \xa0 --user $ACCESSID:$ACCESSKEY \\\n\xa0 \xa0 \xa0 \xa0 \xa0 \xa0 "$PROTOCOL://$HOST/api/v1/search/jobs/$JOB_ID")\n\xa0 STATE=$(echo $RESULT | sed \'s/.*"state":"\\(.*\\)"[,}].*/\\1/\')\n\xa0 MESSAGES=$(echo $RESULT | perl -pe \'s|.*"messageCount":(.*?)[,}].*|\\1|\')\n\xa0 RECORDS=$(echo $RESULT | perl -pe \'s|.*"recordCount":(.*?)[,}].*|\\1|\')\n\xa0 echo Search job state: $STATE, message count: $MESSAGES, record count: $RECORDS\ndone\n\n\n# Get the first ten messages.\n\nRESULT=$(curl $OPTIONS \xa0\\\n\xa0 \xa0 \xa0 \xa0 \xa0 -H "Accept: application/json" \xa0 \\\n\xa0 \xa0 \xa0 \xa0 \xa0 --user $ACCESSID:$ACCESSKEY \xa0\\\n\xa0 \xa0 \xa0 \xa0 \xa0 "$PROTOCOL://$HOST/api/v1/search/jobs/$JOB_ID/messages?offset=0&limit=10")\necho Messages:\necho $RESULT\n\n\n# Get the first 2 records.\n\nRESULT=$(curl $OPTIONS \xa0\\\n\xa0 \xa0 \xa0 \xa0 \xa0 -H "Accept: application/json" \\\n\xa0 \xa0 \xa0 \xa0 \xa0 --user $ACCESSID:$ACCESSKEY \xa0\xa0\\\n\xa0 \xa0 \xa0 \xa0 \xa0 "$PROTOCOL://$HOST/api/v1/search/jobs/$JOB_ID/records?offset=0&limit=1")\necho Records:\necho $RESULT\n\n\n# Delete the search job.\n\nRESULT=$(curl $OPTIONS \xa0 \xa0\\\n\xa0 \xa0 \xa0 \xa0 \xa0 -X DELETE \\\n\xa0 \xa0 \xa0 \xa0 \xa0 -H "Accept: application/json" \\\n\xa0 \xa0 \xa0 \xa0 \xa0 --user $ACCESSID:$ACCESSKEY \xa0\\\n\xa0 \xa0 \xa0 \xa0 \xa0 "$PROTOCOL://$HOST/api/v1/search/jobs/$JOB_ID")\nJOB_ID=$(echo $RESULT | sed \'s/^.*"id":"\\(.*\\)".*$/\\1/\')\necho Search job deleted, id: $JOB_ID\n'})})]})}function g(e={}){let{wrapper:s}={...(0,i.R)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(p,{...e})}):p(e)}},41957(e,s,t){t.d(s,{Ay:()=>c,RM:()=>i});var n=t(74848),r=t(28453);let i=[];function l(e){let s={a:"a",code:"code",p:"p",strong:"strong",...(0,r.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.p,{children:"To determine which Sumo Logic API endpoint you should use, find the deployment pod referenced in your browser's Sumo Logic service URL."}),"\n",(0,n.jsxs)(s.p,{children:["If you see ",(0,n.jsx)(s.code,{children:"https://service.us2.sumologic.com"}),", for example, that means you're running on the ",(0,n.jsx)(s.strong,{children:"US2"})," pod and need to use the API endpoint ",(0,n.jsx)(s.code,{children:"https://api.us2.sumologic.com/api/"}),". For the service URL ",(0,n.jsx)(s.code,{children:"https://service.eu.sumologic.com"}),", you'd need to use the API endpoint ",(0,n.jsx)(s.code,{children:"https://api.eu.sumologic.com/api/"}),", and so on. The only exception is the ",(0,n.jsx)(s.strong,{children:"US1"})," pod (",(0,n.jsx)(s.code,{children:"https://service.sumologic.com"}),"), which uses the API endpoint ",(0,n.jsx)(s.code,{children:"https://api.sumologic.com/api/"}),"."]}),"\n",(0,n.jsxs)(s.p,{children:["To view all available endpoints, see ",(0,n.jsx)(s.a,{href:"/docs/api/about-
1apis/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security",children:"Sumo Logic Endpoints"}),"."]})]})}function c(e={}){let{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},12869(e,s,t){t.d(s,{Ay:()=>c,RM:()=>i});var n=t(74848),r=t(28453);let i=[];function l(e){let s={a:"a",p:"p",...(0,r.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsxs)(s.p,{children:["To get started with Sumo Logic APIs, see ",(0,n.jsx)(s.a,{href:"/docs/api/about-apis/getting-started",children:"API Authentication, Endpoints, and Security"}),"."]}),"\n",(0,n.jsxs)(s.p,{children:["Our APIs are built with ",(0,n.jsx)(s.a,{href:"https://www.openapis.org/",children:"OpenAPI"}),". You can generate client libraries in several languages and explore automated testing."]}),"\n",(0,n.jsxs)(s.p,{children:["To access our API documentation, navigate to the appropriate link based on your Sumo Logic deployment. Deployment types differ based on geographic location and account creation date. If unsure, see ",(0,n.jsx)(s.a,{href:"/docs/api/about-apis/getting-started#which-endpoint-should-i-should-use",children:"Which endpoint should I use?"})]})]})}function c(e={}){let{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},68959(e,s,t){t.d(s,{Ay:()=>c,RM:()=>i});var n=t(74848),r=t(28453);let i=[];function l(e){let s={code:"code",li:"li",ul:"ul",...(0,r.R)(),...e.components};return(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:"A rate limit of four API requests per second (240 requests per minute) applies to all API calls from a user."}),"\n",(0,n.jsx)(s.li,{children:"A rate limit of 10 concurrent requests to any API endpoint applies to an access key."}),"\n",(0,n.jsxs)(s.li,{children:["If a rate is exceeded, a ",(0,n.jsx)(s.code,{children:"429 Too Many Requests"})," status code is returned."]}),"\n"]})}function c(e={}){let{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},42258(e,s,t){t.d(s,{Ay:()=>c,RM:()=>i});var n=t(74848),r=t(28453);let i=[];function l(e){let s={a:"a",p:"p",...(0,r.R)(),...e.components};return(0,n.jsxs)(s.p,{children:["To use the APIs in this resource, the user or account executing APIs must have the following ",(0,n.jsx)(s.a,{href:"/docs/manage/users-roles/roles/role-capabilities",children:"role capabilities"}),":"]})}function c(e={}){let{wrapper:s}={...(0,r.R)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},28453(e,s,t){t.d(s,{R:()=>l,x:()=>c});var n=t(96540);let r={},i=n.createContext(r);function l(e){let s=n.useContext(i);return n.useMemo(function(){return"function"==typeof e?e(s):{...s,...e}},[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),n.createElement(i.Provider,{value:s},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.