API Stability Short-Term

The searchDomains() GraphQL query is used to get a list of search domains in an organization, and information about them.

Similar to this query is searchDomainsPage(). There are a couple of related queries: searchDomain() to get information on a search domain; and searchDomainAssets() to get a list of assets used by a search domain. There are also some related mutations: deleteSearchDomain() and deleteSearchDomainById() for deleting search domains; restoreDeletedSearchDomain() for restoring deleted search domains; as well as renameSearchDomain() and renameSearchDomainById() for changing a search domain's name.

For more information on searching repositories and views, see the Search Data documentation page.

Syntax

graphql
searchDomains: [SearchDomain]!

After entering searchDomains, there are no given input — not even the usual parentheses.

For the results, you can get the name and unique identifier of each search domain — which you might need for other queries and mutations — and other bits of information about the search domains. See the Returned Datatype section for more on this.

Example

Below is an example of how this query field might be used:

Raw
graphql
query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchDomains ^
  { id, name,  ^
    dashboards {id, displayName} ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchDomains
  { id, name, 
    dashboards {id, displayName}
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchDomains": [
      {
        "id": "abK5mgWJhsq5UAJNQc2FWGLe",
        "name": "humio-activity",
        "dashboards": []
      },
      {
        "id": "aK9GKAsTnMXfRxT8Fpecx3fX",
        "name": "humio",
        "dashboards": [
          {
            "id": "pKZuBbLOqlXonJBJrBnLAQAlele9e9tm",
            "displayName": "Parsers"
          },
          {
            "id": "fn0aLMtXg0M4zJ5v1Qyft7aIwzRkhy4W",
            "displayName": "Overview"
          },
          {
            "id": "sVDzR6aL93MFnVtzyNJZmFR2vnqlnLgj",
            "displayName": "Request-Response"
          },
      ...
    ]
  }
}

Notice that the example above requests three values, separated by commas. In addition to requesting the search domain's ID and name, query requests a list of dashboards for each. For that, the parameter dashboard is given along with its parameters within curly-brackets.

Returned Datatype

With the returned datatype you can get the unique identifier of each search domain and other information about the search domains. Below is a list of parameters with links to the some sub-parameters:

Table: SearchDomain

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Feb 3, 2026
action(id: string): Actionmultipleyes Long-Term

A saved action. See Action.

actions(actionIds: [string]): [Action]multipleyes Long-Term

A list of saved actions. See Action.

aggregateAlert(id: string): AggregateAlertmultipleyes Long-Term

A saved aggregate alert. See AggregateAlert.

aggregateAlerts[AggregateAlert]yes Long-TermA list of saved aggregate alerts. See AggregateAlert.
alert(id: string): Alertmultipleyes Long-Term

A saved alert. See Alert.

alerts[Alert]yes Long-TermSaved alerts. See Alert.
allowedViewActions[ViewAction]yes Long-TermReturns all actions the user is allowed to perform on the view. See ViewAction.
automaticSearchbooleanyes Long-TermWhether to execute automatically the default search query.
availablePackages(filter: string, tags: [PackageTag], categories: [string]): [PackageRegistrySearchResultItem]multipleyes Long-Term

Returns a list of available packages that can be installed.

PackageTag is a scalar. See PackageRegistrySearchResultItem.

dashboard(id: string): Dashboardmultipleyes Long-Term

The default or initial Dashboard to use. See Dashboard.

dashboards[Dashboard]yes Long-TermAll dashboards available on the view. See Dashboard.
deletedDatelong  Long-TermThe point in time the search domain was marked for deletion.
descriptionstring  Long-TermA description of the search domain.
fileFieldSearchfileFieldSearch(fileName: string, fieldName: string, prefixFilter: string, valueFilters: [FileFieldFilterType], fieldsToInclude: [string], maxEntries: integer): [[DictionaryEntryType]]multipleyes Long-Term

Used to search fields in a CSV or JSON file.

See FileFieldFilterType and DictionaryEntryType.

files[File]yes Long-TermFiles belonging to the search domain. See File.
filterAlert(id: string): FilterAlertmultipleyes Long-Term

A saved filter alert. See FilterAlert.

filterAlerts[FilterAlert]yes Long-TermSaved filter alerts. See FilterAlert.
groups[Group]yes Long-TermGroups with assigned roles. See Group.
hasPackageInstalled(packageId: VersionedPackageSpecifier): booleanmultipleyes Long-Term

Whether there is an installed package. VersionedPackageSpecifier is a scalar.

idstringyes Long-TermThe unique identifier for the search domain.
installedPackages[PackageInstallation]yes Long-TermList packages installed on a specific view or repository. See PackageInstallation.
interactions[ViewInteraction]yes Long-TermAll interactions defined on the view. See ViewInteraction.
isActionAllowed(action: ViewAction): booleanmultipleyes Long-Term

Whether the current user is allowed to perform the action. See ViewAction.

isStarredbooleanyes Long-TermWhether the search domain is highlighted with a star.
nameRepoOrViewNameyes Long-TermThe name of the search domain. RepoOrViewName is a scalar.
packageV2(packageId: VersionedPackageSpecifier): Package2multipleyes Long-Term

Returns a specific version of a package given a package version.

VersionedPackageSpecifier is a scalar value. See Package2.

packageVersions(packageId: UnversionedPackageSpecifier): [RegistryPackageVersionInfo]multipleyes Long-Term

The available versions of a package.

UnversionedPackageSpecifier is a scalar. See RegistryPackageVersionInfo.

permanentlyDeletedAtlong  Long-TermThe point in time the search domain will not be restorable anymore.
recentQueriesV2[RecentQuery]yes Long-TermAll recent queries for the search domain. See RecentQuery.
redirectQueryAssetLookupToSearchDomain  PreviewThe redirected query asset lookup view used for asset resolution when set. Assets like saved queries and lookup files will be resolved from this view instead of the current view.
reposExcludedInSearchLimit[string]yes Long-TermRepositories not part of the search limitation.
resourcestringyes Short-TermThe resource identifier for the search domain.
savedQueries[SavedQuery]yes Long-TermThe saved queries. See SavedQuery.
savedQuery(id: string): SavedQuerymultipleyes Long-Term

A saved query. See SavedQuery.

scheduledReport(id: string): ScheduledReportmultipleyes Long-Term

A saved scheduled report. See ScheduledReport.

scheduledReports[ScheduledReport]yes Long-TermSaved scheduled reports. See ScheduledReport.
scheduledSearch(id: string): ScheduledSearchmultipleyes Long-Term

A saved scheduled search. See ScheduledSearch.

scheduledSearches[ScheduledSearch]yes Long-TermThe scheduled searches to use with the search domain. See ScheduledSearch.
searchLimitedMslong  Long-TermLimit in milliseconds to which searches should are limited.
starredFields[string]yes Long-TermAll fields in the search domain to mark with a star.
tags[string]yes Long-TermAll tags from all datasources.
users[User]yes Long-TermUsers who have access to the search domain. See User.
usersandgroups(search: string, skip: integer, limit: integer): UsersAndGroupsSearchResultSetmultiple  Long-Term

Users and groups associated with the search domain. See UsersAndGroupsSearchResultSet.

usersV2(search: string, permissionFilter: Permission, skip: integer, limit: integer): Usersmultiple  Short-Term

Search users with a given permission, whose email or name matches this search string.

See Permission and Users.

viewerQueryPrefixstringyes Long-TermThe query prefix prepended to each search in this domain.