Activity Log Event Query

Event for a query

Field NameTypeValueAvailabilityDescription
@id    A unique identifier for the event. Can be used to refer to and re-find specific events.
@ingesttimestamp    The timestamp of when the event was ingested. The value is milliseconds-since-epoch.
@rawstring    The original text of the event. As it keeps the original data on ingestion, this field allows you to do free-text searching across all logs and to extract virtual fields in queries.
@timestamp    Timestamp in milliseconds since the epoch (1st Jan 1970, 00:00) of the ingested event, e.g. 2022-11-22 09:50:20.100 if the event has an identifiable timestamp.
@timestamp.nanos    Extended precision of timestamp below millisecond. E.g. 295000
@timezone    The timezone the event originated in, if known. This is often set when the event's timestamp is parsed.
cancelled    Indicates whether the query was cancelled
category    Category of the event, such as Alert, Request, IngestFeed, Fdr, Query, Action, and ScheduledSearch
customKey.alertId    Custom alert ID extracted from query
customKey.alertName    Customer alert name extracted from query
data_scanned    Amount of data scanned in bytes during the event
error    Error message
externalQueryId    External ID of the running query
#category    Category of the event
#repo    Name of the repo where the event is stored
#severity    Severity of the event from original log source
isLive    Was the query executed as a live query
live_cost    Total live cost of the event
live_cost_minute    Cost per minute of the event
message    Message of the alert or event
proxy    Was the request made through a proxy
queryEnd    End of the time interval for the query
queryInput    The query that was run
queryStart    Start of the time interval for the query
queued    Whether query was queued before running
resultPipelineExecutionCount    Number of times the result calculation pipeline ran for the query
severity    Severity of the event
static_cost_total    Cost of the static (non-live) query
time    Time for the request
timestamp    Timestamp in milliseconds of the event
user    User who runs the query
username    User name
viewId    View ID
warnings    Warnings when query ran