API Stability |
Long-Term
|
The searchDomains() GraphQL query is used to search domains.
For more information on searching repositories and views, see the Searching Data documentation page.
Syntax
Below is the syntax for the searchDomains() query field:
searchDomains: [SearchDomain!]!
After entering searchDomains, there are no
given input. SearchDomain
is the return
datatype. You'll have to specify which values you want returned
— at least id. A complete list of
values is provided in the next section. However, below is an
example with a few:
query {
searchDomains
{ id, name,
dashboards {id, displayName}
}
}
{
"data": {
"searchDomains": [
{
"id": "abK5mgWJhsq5UAJNQc2FWGLe",
"name": "humio-activity",
"dashboards": []
},
{
"id": "aK9GKAsTnMXfRxT8Fpecx3fX",
"name": "humio",
"dashboards": [
{
"id": "pKZuBbLOqlXonJBJrBnLAQAlele9e9tm",
"displayName": "Parsers"
},
{
"id": "fn0aLMtXg0M4zJ5v1Qyft7aIwzRkhy4W",
"displayName": "Overview"
},
{
"id": "sVDzR6aL93MFnVtzyNJZmFR2vnqlnLgj",
"displayName": "Request-Response"
},
...
]
}
}
Notice that the example above requests three values, separated by commas. In addition to requesting the search domain's ID and name, query requests a list of dashboards for each. For that, the parameter dashboard is given along with its parameters within curly-brackets.
Returned Datatype
The returned datatype searchDomain() has its own parameters. Below is a list of them along with their datatypes and a description of each:
Table: SearchDomain
Parameter | Type | Required | Default | Stability | Description |
---|---|---|---|---|---|
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column. | |||||
Table last updated: Mar 27, 2025 | |||||
action | multiple | yes | Long-Term | A saved action. The multiple datatype consists of (id: string): Action. See Action . | |
actions | Action | yes | Long-Term | A list of saved actions. See Action . | |
aggregateAlert | multiple | yes | Long-Term | A saved aggregate alert. The multiple datatype consists of (id: string): AggregateAlert. See AggregateAlert . | |
aggregateAlerts | [AggregateAlert ] | yes | Long-Term | A list of saved aggregate alerts. See AggregateAlert . | |
alert | multiple | yes | Long-Term | A saved alert. The multiple datatype consists of (id: string): Alert. See Alert . | |
alerts | [Alert ] | yes | Long-Term | Saved alerts. See Alert . | |
allowedViewActions | [ViewAction ] | yes | Long-Term | Returns the all actions the user is allowed to perform on the view. See ViewAction . | |
automaticSearch | boolean | yes | Long-Term | Whether to execute automatically the default search query. | |
availablePackages | multiple | yes | Long-Term | Returns a list of available packages that can be installed. The multiple datatype consists of (filter: string, tags: [PackageTag], categories: [string]): [PackageRegistrySearchResultItem]. PackageTag is a scalar. See PackageRegistrySearchResultItem . | |
dashboard | multiple | yes | Long-Term | The default or initial Dashboard to use. The multiple datatype consists of (id: string): Dashboard. See Dashboard ). | |
dashboards | [Dashboard ] | yes | Long-Term | All dashboards available on the view. See Dashboard . | |
defaultQuery | SavedQuery | yes | Long-Term | The default query used for the search domain when none is selected. See SavedQuery . | |
deletedDate | long | Long-Term | The point in time the search domain was marked for deletion. | ||
description | string | Long-Term | A description of the search domain. | ||
fileFieldSearch | multiple | yes | Long-Term | Used to search fields in a CSV or JSON file. The multiple datatype consists of fileFieldSearch(fileName: string, fieldName: string, prefixFilter: string, valueFilters: [FileFieldFilterType], fieldsToInclude: [string], maxEntries: integer): [[DictionaryEntryType]]. See FileFieldFilterType and DictionaryEntryType . | |
files | [File ] | yes | Long-Term | Files belonging to the search domain. See File . | |
filterAlert | multiple | yes | Long-Term | A saved filter alert. The multiple datatype consists of (id: string): FilterAlert. See FilterAlert . | |
filterAlerts | [FilterAlert ] | yes | Long-Term | Saved filter alerts. See FilterAlert . | |
groups | [Group ] | yes | Long-Term | Groups with assigned roles. See Group . | |
hasPackageInstalled | multiple | yes | Long-Term | Whether there is an installed package. The multiple datatype consists of (packageId: VersionedPackageSpecifier): boolean. VersionedPackageSpecifier is a scalar. | |
id | string | yes | Long-Term | The unique identifier for the search domain. | |
installedPackages | [PackageInstallation ] | yes | Long-Term | List packages installed on a specific view or repository. See PackageInstallation . | |
interactions | [ViewInteraction ] | yes | Long-Term | All interactions defined on the view. See ViewInteraction . | |
isActionAllowed | multiple | yes | Long-Term | Whether the current user is allowed to perform the action. The multiple datatype consists of (action: ViewAction): boolean. See ViewAction . | |
isStarred | boolean | yes | Long-Term | Whether the search domain is highlighted with a star. | |
name | RepoOrViewName | yes | Long-Term | The name of the search domain. RepoOrViewName is a scalar. | |
packageV2 | multiple | yes | Long-Term | Returns a specific version of a package given a package version. The multiple datatype consists of (packageId: VersionedPackageSpecifier): Package2. VersionedPackageSpecifier is a scalar value. See Package2 . | |
permanentlyDeletedAt | long | Long-Term | The point in time the search domain will not be restorable anymore. | ||
recentQueriesV2 | [RecentQuery ] | yes | Long-Term | All recent queries for the search domain. See RecentQuery . | |
reposExcludedInSearchLimit | [string] | yes | Long-Term | Repositories not part of the search limitation. | |
resource | string | yes | Short-Term | The resource identifier for the search domain. | |
savedQueries | [SavedQuery ] | yes | Long-Term | The saved queries. See SavedQuery . | |
savedQuery | multiple | yes | Long-Term | A saved query. The multiple datatype consists of (id: string): SavedQuery. SavedQuery ). | |
scheduledReport | multiple | yes | Long-Term | A saved scheduled report. The multiple datatype consists of (id: string): ScheduledReport. See ScheduledReport . | |
scheduledReports | [ScheduledReport ] | yes | Long-Term | Saved scheduled reports. See ScheduledReport . | |
scheduledSearch | multiple | yes | Long-Term | A saved scheduled search. The multiple datatype consists of (id: string): ScheduledSearch. See ScheduledSearch ). | |
scheduledSearches | [ScheduledSearch ] | yes | Long-Term | The scheduled searches to use with the search domain. See ScheduledSearch . | |
searchLimitedMs | long | Long-Term | Limit in milliseconds to which searches should are limited. | ||
starredFields | [string] | yes | Long-Term | All fields in the search domain to mark with a star. | |
tags | [string] | yes | Long-Term | All tags from all datasources. | |
users | [User ] | yes | Long-Term | Users who have access to the search domain. See User . | |
usersandgroups | multiple | yes | Long-Term | Users and groups associated with the search domain. The multiple datatype consists of (search: string, skip: integer, limit: integer): UsersAndGroupsSearchResultSet. See UsersAndGroupsSearchResultSet . | |
usersV2 | multiple | yes | Preview | Search users with a given permission, whose email or name matches this search string. The multiple datatype consists of (search: string, permissionFilter: Permission, skip: integer, limit: integer): Users. See | |
viewerQueryPrefix | string | yes | Long-Term | The query prefix prepended to each search in this domain. |