Stability Level Preview

Summary

The searchDataDistribution() GraphQL query will get segment data distribution statistics for a repository or view within a time range. Views with multiple connections return per-repository results.

Syntax

graphql
searchDataDistribution(
     input: SearchDataDistributionInput!
   ): SearchDataDistributionResult!

For the input, you'll have to give the query string for tag-based datasource filtering, and the name of the search domain to analyze. See the Input Parameters section for more.

For the results, you can get a list of repositories, their names, identifiers, organization, and the query component that scans this repository. See the Returned Values section for more details.

Example

Raw
graphql
query {
  searchDataDistribution(
    input: { queryString: "something",
             searchDomainName: "our_view" }
  ) repositories { repositoryId, repositoryName }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchDataDistribution(
    input: { queryString: \"something\",
             searchDomainName: \"our_view\" }
  ) repositories { repositoryId, repositoryName }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchDataDistribution(
    input: { queryString: \"something\",
             searchDomainName: \"our_view\" }
  ) repositories { repositoryId, repositoryName }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchDataDistribution( ^
    input: { queryString: \"something\", ^
             searchDomainName: \"our_view\" } ^
  ) repositories { repositoryId, repositoryName } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchDataDistribution(
    input: { queryString: \"something\",
             searchDomainName: \"our_view\" }
  ) repositories { repositoryId, repositoryName }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  searchDataDistribution(
    input: { queryString: \"something\",
             searchDomainName: \"our_view\" }
  ) repositories { repositoryId, repositoryName }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchDataDistribution(
    input: { queryString: \"something\",
             searchDomainName: \"our_view\" }
  ) repositories { repositoryId, repositoryName }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchDataDistribution(
    input: { queryString: \"something\",
             searchDomainName: \"our_view\" }
  ) repositories { repositoryId, repositoryName }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchDataDistribution": {
      "repositories" { 
          [{ "repositoryId": "abc123",
             "repositoryName": "repo_1" },
           { "repositoryId": "def456",
             "repositoryName": "repo_2" },
          ]
      },
    }
  }
}

Input Parameters

For the input, you'll have to provide the query string for tag-based datasource filtering, as well as the name of the repository or view to analyze. There are a few optional parameters. They're listed and described in the table below:

Table: SearchDataDistributionInput Input Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jul 10, 2026
arguments[QueryArgumentInputType]  PreviewAny query arguments for parameterized queries. See QueryArgumentInputType.
maxDatasourcesinteger  PreviewThe maximum number of datasources to return. Defaults to 200.
maxTagEntriesinteger  PreviewThe maximum number of tag distribution entries to return. Defaults to 200.
queryStringstringyes PreviewThe query string for tag-based datasource filtering. Empty string matches all datasources.
searchDomainNamestringyes PreviewThe repository or view to analyze. Views with multiple connections return per-repository results.
timeBucketsinteger  PreviewThe number of time buckets for the distribution histogram. Defaults to 50, with a maximum of 50.
timeIntervalQueryTimeInterval  PreviewThe time range. Defaults to last twenty-four hours. See QueryTimeInterval.

Returned Values

For the results, you can get a list of repositories and information relevant to a search data distribution. The datatype used is described in this table below, but the second table describes the values you'll probably want.

Table: SearchDataDistributionResult Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jul 10, 2026
repositories[SearchDataDistributionRepository]yes PreviewPer-repository distribution statistics. See SearchDataDistributionRepository.

The datatype above uses another datatype for repository information. For your convenience, the table for that sub-datatype is included here:

Table: SearchDataDistributionRepository Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Jul 10, 2026
datasources[SearchDataDistributionDatasource]yes PreviewPer-datasource segment statistics. See SearchDataDistributionDatasource.
maxEventTimelong  PreviewLatest event timestamp (epoch ms) across all matching segments, if any.
maxIngestTimelong  PreviewLatest ingest timestamp (epoch ms) across all matching segments, if any.
minEventTimelong  PreviewEarliest event timestamp (epoch ms) across all matching segments, if any.
minIngestTimelong  PreviewEarliest ingest timestamp (epoch ms) across all matching segments, if any.
organizationIdstring  PreviewThe organization that owns this repository, if any.
originstringyes PreviewThe query component that scans this repository: query means the main query, join-N means join subqueries, and defineTable-name the table-building queries.
repositoryIdstringyes PreviewThe unique identifier of the repository.
repositoryNamestringyes PreviewThe name of the repository.
scanPercentageCompressedfloatyes PreviewThe percentage of repository compressed bytes that the search would scan.
scanPercentageOriginalfloatyes PreviewThe ppercentage of repository original bytes that the search would scan.
tagDistribution[SearchDataDistributionTagDistributionEntry]yes PreviewAggregated byte statistics per tag key-value pair across matching datasources. See SearchDataDistributionTagDistributionEntry.
timeDistributionSearchDataDistributionTimeDistributionyes PreviewText describing the field. See SearchDataDistributionTimeDistribution.
totalDatasourceCountintegeryes PreviewThe total number of matching datasources before applying maxDatasources limit.
totalRepositoryCompressedByteslongyes PreviewThe total compressed bytes across all datasources in the repository within the time range.
totalRepositoryOriginalByteslongyes PreviewThe total original bytes across all datasources in the repository within the time range.
totalTagEntryCountintegeryes PreviewThe total number of tag distribution entries before applying maxTagEntries limit.