humio-audit Query Structure

The query structure defines information about the query used at the time of the audit event. A scheduled search or alert uses a query executed by a specific user with specific criteria. The basic format of the structure has the following fields:

  • query.allowEventSkipping — whether event skipping was enabled

  • query.end — the end time of the selected interval

  • query.includeDeletedEvents — did the query included deleted events

  • query.ingestEnd — timestamp end of when the returned events were ingested.

  • query.ingestStart — timestamp start of when the returned events were ingested.

  • query.isAlertQuery — was the query triggered as part of an alert

  • query.isInteractive — was the query interactive (true if through the UI or via the API; false when through an automation such as an alert or scheduled search). The value is used by LogScale to determine whether the user can continue to interact with the query results and enables LogScale to be more responsive in those situations.

  • query.isLive — was the query executed in live mode

  • query.isRepeatingSubquery — was it a repeating subquery of another query

  • query.languageVersion — what language version was used to parse the query string

  • query.noResultUntilDone — was the result delayed until the full data set was ready (uused in some alerts)

  • query.queryString — the query string

  • query.showQueryEventDistribution — whether query event distibution was enabled

  • query.start — the start time of the selected interval

  • query.timeZoneOffsetMinutes — timezone offset

  • query.useIngestTime — the timestamp when the data was ingested