searchDomainAssets()

API Stability	`Preview`

The searchDomainAssets() GraphQL query fetches the list of assets in the given search domains.

Syntax

Below is the syntax for the searchDomainAssets() query field:

graphql

searchDomainAssets(
      searchDomainNames: [string!]!, 
      assetTypes: [AssetPermissionsAssetType!], 
      searchFilter: string, 
      limit: integer, 
      skip: integer, 
      orderBy: OrderBy
   ): SearchDomainAssetsResultSet!

searchDomainNames is a list of names of the search domains to search. If empty, assets from all search domains for which the requester has access will be searched. For assetTypes (see Given Datatypes below), if empty, all asset types are included in search. The searchFilter is used to filter.

Below is an example of this query field with a few values requested:

Show:

graphql

query {
	searchDomainAssets(
    searchDomainNames: [ "humio" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
	searchDomainAssets( ^
    searchDomainNames: [ \"humio\" ] ^
    assetTypes: [], ^
    skip: 2, ^
    limit: 2 ^
    orderBy: DESC   ^
  ) ^
  { totalResults, results { name, assetType, id }  } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "searchDomainAssets": {
      "totalResults": 37,
      "results": [
        {
          "name": "parseHumioText",
          "assetType": "SavedQuery",
          "id": "1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y"
        },
        {
          "name": "my-webhook-action",
          "assetType": "Action",
          "id": "ZUFq14KhgRAZiakZgzBTFFaLqbnixCJz"
        }
      ]
    }
  }
}

Given Datatypes

AssetPermissionsAssetType is an enumerated list of choices.

Table: AssetPermissionsAssetType

Parameter	Type	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 13, 2024
`Action`	boolean	`Preview`	The asset permission is related to an action.
`AggregateAlert`	boolean	`Preview`	The asset permission is related to an aggregate alert.
`Dashboard`	boolean	`Preview`	The asset permission is related to a dashboard.
`File`	boolean	`Preview`	The asset permission is related to a file.
`FilterAlert`	boolean	`Preview`	The asset permission is related to a filter alert.
`LegacyAlert`	boolean	`Preview`	The asset permission is related to a legacy alert.
`SavedQuery`	boolean	`Preview`	The asset permission is related to a saved query.
`ScheduledReport`	boolean	`Preview`	The asset permission is related to a scheduled report.
`ScheduledSearch`	boolean	`Preview`	The asset permission is related to a scheduled search.

Returned Datatypes

The returned datatype SearchDomainAssetsResultSet has a couple of parameters, and some sub-parameters. Below is a list of them:

Table: SearchDomainAssetsResultSet

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 3, 2025
`results`	[`SearchDomainAsset`]	yes	`Preview`	The paginated result set. See `SearchDomainAsset`.
`totalResults`	integer	yes	`Preview`	The total number of matching results.

GraphQL Queries

GraphQL API Stability

GraphQL Mutations

GraphQL Datatypes