Summary

The searchDomains() GraphQL query returns a list of search domains in an organization and information about each.

API Stability Short-Term

Syntax

graphql
searchDomains: [SearchDomain]!

This query takes no input. The syntax omits parentheses.

For the results, you can get the name and unique identifier of each search domain — which you may need for other queries and mutations — as well as other information about the search domains. See Returned Values for more.

Example

Raw
graphql
query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchDomains ^
  { id, name,  ^
    dashboards {id, displayName} ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchDomains": [
      {
        "id": "abc123",
        "name": "humio-activity",
        "dashboards": []
      },
      {
        "id": "def456",
        "name": "humio",
        "dashboards": [
          {
            "id": "ghi789",
            "displayName": "Parsers"
          },
          {
            "id": "jkl012",
            "displayName": "Overview"
          },
          {
            "id": "mno345",
            "displayName": "Request-Response"
          },
      ...
    ]
  }
}

Notice that the example above requests three values, separated by commas. In addition to requesting the search domain's ID and name, it requests a list of dashboards for each. For that, the parameter dashboard is given with its sub-parameters within curly brackets.

Returned Values

For the results, you can get the unique identifier of each search domain and other information about the search domains.

Table: SearchDomain Interface Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 12, 2026
actionViewAction):Booleanyes Long-Term

A saved action. See Action.

actionIdsString]):[Actionyes Long-TermThe result will only include actions with the specified ids. Omit to find all actions.
aggregateAlertsAggregateAlertyes Long-TermA list of saved aggregate alerts. See AggregateAlert.
alert(id: String!)Alertyes Long-Term

A saved alert. See Alert.

alertsAlertyes Long-TermSaved alerts. See Alert.
allowedViewActionsViewActionyes Long-TermReturns all actions the user is allowed to perform on the view. See ViewAction.
automaticSearchBooleanyes Long-TermWhether to execute automatically the default search query.
awsExternalIdStringyes Long-TermThe AWS External ID used when assuming roles in AWS on behalf of this repository. Stability: Long-term
categoriesString]):[PackageRegistrySearchResultItemyes Long-TermPackages with any of these categories will be included.
dashboard(id: String!)Dashboardyes Long-Term

The default or initial Dashboard to use. See Dashboard.

dashboardsDashboardyes Long-TermAll dashboards available on the view. See Dashboard.
defaultQuerySavedQuery  Long-TermStability: Long-term
deletedDateLong  Long-TermThe point in time the search domain was marked for deletion.
descriptionString  Long-TermA description of the search domain.
fieldNameString,yes  Name of the field in the file to return entries from.
fieldsToIncludeString],yes  Names of the fields to include in the result.
fileNameString,yes  Name of the csv or json file to retrieve the field entries from.
filesFileyes Long-TermFiles belonging to the search domain. See File.
filterString,   Filter input to limit the returned packages
filterAlertsFilterAlertyes Long-TermSaved filter alerts. See FilterAlert.
gcpExternalIdString  Long-TermThe value to set as the 'logscale-external-id' label on the GCS bucket. Stability: Long-term (added in 1.259)
gcsActionServiceAccountEmailString  Long-TermThe email of the GCP service account that LogScale uses to impersonate target service accounts for GCS actions. Stability: Long-term (added in 1.259)
groupsGroupyes Long-TermGroups with assigned roles. See Group.
hasPackageInstalled(packageId: VersionedPackageSpecifier!)Booleanyes Long-Term

Whether there is an installed package. VersionedPackageSpecifier is a scalar.

idString):ScheduledReportyes Long-TermThe unique identifier for the search domain.
installedPackagesPackageInstallationyes Long-TermList packages installed on a specific view or repository. See PackageInstallation.
interactionsViewInteractionyes Long-TermAll interactions defined on the view. See ViewInteraction.
isStarredBooleanyes Long-TermWhether the search domain is highlighted with a star.
limitInt):PersistedAggregationResultSetyes PreviewThe amount of results to return.
maxEntriesInt):[[DictionaryEntryType]yes Long-TermMaximum number of values to retrieve from the file.
nameString):ScheduledSearchyes Long-TermThe name of the search domain. RepoOrViewName is a scalar.
orderByOrderBy,   Choose the order in which the results are returned.
packageIdVersionedPackageSpecifier):Package2yes Long-TermThe package id of the package to get.
packageVersions(packageId: UnversionedPackageSpecifier!)RegistryPackageVersionInfoyes Long-Term

The available versions of a package.

UnversionedPackageSpecifier is a scalar. See RegistryPackageVersionInfo.

permanentlyDeletedAtLong  Long-TermThe point in time the search domain will not be restorable anymore.
permissionFilterPermission,   Permission that the users must have on the search domain. Leave out to get users with any permission on the view
prefixFilterString,   Text to filter values by prefix on.
recentQueriesV2RecentQueryyes Long-TermAll recent queries for the search domain. See RecentQuery.
redirectQueryAssetLookupToSearchDomain  PreviewThe redirected query asset lookup view used for asset resolution when set. Assets like saved queries and lookup files will be resolved from this view instead of the current view.
reposExcludedInSearchLimitStringyes Long-TermRepositories not part of the search limitation.
resourceStringyes Short-TermThe resource identifier for the search domain.
s3ActionArnString  Long-TermThe ARN of the AWS IAM identity that will write to S3 for S3 actions. Stability: Long-term
savedQueriesSavedQueryyes Long-TermThe saved queries. See SavedQuery.
savedQuery(id: String!)SavedQueryyes Long-Term

A saved query. See SavedQuery.

scheduledReportsScheduledReportyes Long-TermSaved scheduled reports. See ScheduledReport.
scheduledSearchesScheduledSearchyes Long-TermThe scheduled searches to use with the search domain. See ScheduledSearch.
searchString,   Search for a user whose email or name matches this search string
searchLimitedMsLong  Long-TermLimit in milliseconds to which searches should are limited.
skipInt,   The number of results to skip or the offset to use. For instance if implementing pagination, set skip = limit * (page - 1)
sortByPersistedAggregationSortBy,   The field by which to sort persisted aggregations. Defaults to Name.
starredFieldsStringyes Long-TermAll fields in the search domain to mark with a star.
tagsStringyes Long-TermAll tags from all datasources.
usersUseryes Long-TermUsers who have access to the search domain. See User.
valueFiltersFileFieldFilterType],yes  The exact values that given fields should have for an entry to be part of the result.
viewerQueryPrefixStringyes Long-TermThe query prefix prepended to each search in this domain.