searchDomainAssets()

API Stability Preview

The searchDomainAssets() GraphQL query fetches the list of assets found in one or more search domains.

There are a few queries that are related to this one: searchDomain() to get information on a search domain; searchDomains() and searchDomainsPage() to get a list of search domains. There are also some related mutations: deleteSearchDomain() and deleteSearchDomainById() for deleting search domains; restoreDeletedSearchDomain() for restoring deleted search domains; as well as renameSearchDomain() and renameSearchDomainById() for changing a search domain's name.

For more information on assets, see the Asset page describing them and related information.

Syntax

graphql
searchDomainAssets(
      searchDomainNames: [string]!, 
      assetTypes: [AssetPermissionsAssetType], 
      searchFilter: string, 
      orderBy: OrderBy,
      skip: integer,
      limit: integer
   ): SearchDomainAssetsResultSet

For searchDomainNames, you'll have to provide is a list of search domains to search. If empty, assets from all search domains for which you has access will be searched. For assetTypes, you can choose from a list of several asset types (e.g., dashboards, aggregate alerts). See the Given Datatypes section for your choices. If you leave this empty, all asset types are included. The searchFilter is used to provide text on which to search for domain assets.

For ordering results alphanumerically, use orderBy — the default value for is ASC. You can opt to skip the first so many results with the skip parameter — it's default value is 0. Use the limit parameter to limit the number of results returned — its default is 50.

For the results, you can get the total number of search domain assets, and through sub-parameters, the name of each asset, the type of asset, and other related information. See the Returned Datatype section further down this page for more on what may be returned.

Example

Below is an example of this query field with a few values requested:

Raw
graphql
query {
	searchDomainAssets(
    searchDomainNames: [ "humio" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
	searchDomainAssets( ^
    searchDomainNames: [ \"humio\" ] ^
    assetTypes: [], ^
    skip: 2, ^
    limit: 2 ^
    orderBy: DESC   ^
  ) ^
  { totalResults, results { name, assetType, id }  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
	searchDomainAssets(
    searchDomainNames: [ \"humio\" ]
    assetTypes: [],
    skip: 2,
    limit: 2
    orderBy: DESC  
  )
  { totalResults, results { name, assetType, id }  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchDomainAssets": {
      "totalResults": 37,
      "results": [
        {
          "name": "parseHumioText",
          "assetType": "SavedQuery",
          "id": "1S2bN2y5JwrzP6wEHHAQtL7bicF8mS0Y"
        },
        {
          "name": "my-webhook-action",
          "assetType": "Action",
          "id": "ZUFq14KhgRAZiakZgzBTFFaLqbnixCJz"
        }
      ]
    }
  }
}

Given Datatypes

There are a couple of given datatypes for this query. One allows you to limit the search for domains to those with access to certain types of assets. Your choices for this are listed in the table here:

Table: AssetPermissionsAssetType

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 30, 2025
Action   Short-TermSet to this option if the asset permission is related to an action.
AggregateAlert   Short-TermSet to this if asset permission is related to an aggregate alert.
Dashboard   Short-TermSet if asset permission is related to a dashboard.
File   Short-TermSet this option if related to a file.
FilterAlert   Short-TermUsed to indicate the asset permission is related to a filter alert.
LegacyAlert   Short-TermUsed if related to a legacy alert.
SavedQuery   Short-TermThe asset permission is related to a saved query.
ScheduledReport   Short-TermIndicates the asset permission is related to a scheduled report.
ScheduledSearch   Short-TermThe asset permission is related to a scheduled search.

The other input datatype is a simple one. You can return results based on whether they are in ascending or descending order, alphanumerically.

Table: OrderBy

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 10, 2025
ASC  ✓Long-TermOrder results in ascending order (e.g., 0 to 9, A to Z).
DESC   Long-TermOrder results in descending order (e.g., 9 to 0, Z to A).

Returned Datatype

With the returned datatype, you can get the total number of search domain assets, and through sub-parameters, the name of each asset, the type of asset, and a resource string that can be used for assigning asset permissions. The table below lists the first level parameters, and provides links to more parameters through other datatypes:

Table: SearchDomainAssetsResultSet

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Aug 19, 2025
results[SearchDomainAsset]yes Short-TermThe paginated result set. See SearchDomainAsset.
totalResultsintegeryes Short-TermThe total number of matching results.