Summary

The searchDomainAssets() GraphQL query fetches the list of assets found in one or more search domains.

API Stability Preview

Syntax

graphql
searchDomainAssets(
      searchDomainNames: [string]!, 
      assetTypes: [AssetPermissionsAssetType], 
      searchFilter: string, 
      orderBy: OrderBy,
      skip: integer,
      limit: integer
   ): SearchDomainAssetsResultSet

For the input, you would give any text on which to search domain assets, a list of search domain names, any particular asset types, how to order results, and the number of results to skip and how many to return. See the Input Parameters section for details.

For the results, you can get the total number of search domain assets, and through sub-parameters, the name of each asset, the type of asset, and other related information. See the Returned Datatype section further down this page for more on what may be returned.

Example

Raw
graphql
query {
	searchDomainAssets(
    searchDomainNames: [ "humio" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
	searchDomainAssets( ^
    searchDomainNames: [ \"humio\" ] ^
    assetTypes: [], ^
    skip: 2, ^
    limit: 2 ^
    orderBy: DESC   ^
  ) ^
  { totalResults, results { name, assetType, id }  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchDomainAssets": {
      "totalResults": 37,
      "results": [
        {
          "name": "parseHumioText",
          "assetType": "SavedQuery",
          "id": "abc123"
        },
        {
          "name": "my-webhook-action",
          "assetType": "Action",
          "id": "def456"
        }
      ]
    }
  }
}

Input Parameters

For the input, you would provide any text on which to search domain assets, a list of search domain names, any particular asset types that are of interest (see the second table below), how to order results (see third), and the number of results to skip and how many to return.

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this query. Since some of the parameters use special datatypes, additional tables for them are included below.
assetTypes [AssetPermissionsAssetType]     The types of assets to include. If empty, all asset types are included. See table below.
limit integer   50 The maximum number of results to return.
orderBy OrderBy   ASC How to order results. See table below.
searchDomainNames [string]     A list of repository and view names.
searchFilter string     Any text on which to filter results.
skip integer   0 The number of results to skip, or offset to use.

This special datatype will allow you to limit the search for domains to those with access to certain types of assets.

Table: AssetPermissionsAssetType Enum Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 30, 2025
Action   Short-TermSet to this option if the asset permission is related to an action.
AggregateAlert   Short-TermSet to this if asset permission is related to an aggregate alert.
Dashboard   Short-TermSet if asset permission is related to a dashboard.
File   Short-TermSet this option if related to a file.
FilterAlert   Short-TermUsed to indicate the asset permission is related to a filter alert.
LegacyAlert   Short-TermUsed if related to a legacy alert.
SavedQuery   Short-TermThe asset permission is related to a saved query.
ScheduledReport   Short-TermIndicates the asset permission is related to a scheduled report.
ScheduledSearch   Short-TermThe asset permission is related to a scheduled search.

The other input datatype is a simple one. You can return results based on whether they are in ascending or descending order, alphanumerically.

Table: OrderBy Enum Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 10, 2025
ASC  ✓Long-TermOrder results in ascending order (e.g., 0 to 9, A to Z).
DESC   Long-TermOrder results in descending order (e.g., 9 to 0, Z to A).

Returned Values

For the results, you can get the total number of search domain assets, the name of each asset, the type of asset, and a resource string that can be used for assigning asset permissions.

Table: SearchDomainAssetsResultSet Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Aug 19, 2025
results[SearchDomainAsset]yes Short-TermThe paginated result set. See SearchDomainAsset.
totalResultsintegeryes Short-TermThe total number of matching results.

The datatype above uses another datatype for information on assets in a search domain. For your convenience, the table for that sub-datatype is included here:

Table: SearchDomainAsset Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Dec 10, 2025
assetTypeAssetPermissionsAssetTypeyes Short-TermThe type of the asset. See AssetPermissionsAssetType.
idstringyes Short-TermThe unique identifier of the asset.
namestringyes Short-TermThe name of the asset.
resourcestringyes Short-TermThe resource string representation of this asset. Can be used for assigning asset permissions for this asset.
searchDomainIdstringyes Short-TermThe unique identifier of the search domain.
searchDomainNamestringyes Short-TermThe name of the search domain.