Searching and getting results asynchronously with a REST API - BMC TrueSight IT Data Analytics 2.7

searchType

Supported with both POST and GET methods

Required for the POST method

Optional for the GET method, default is saved search name

Search criteria by which you want to search.

Can be one of the following:

• savedSearchName: Indicates that you want to search by the saved search name.
• savedSearchId: Indicates that you want to search by the saved search ID.
• queryString: Indicates that you want to search by a query string. This parameter is not supported while running a GET request.

searchValue

Supported with both POST and GET methods

Required

Value corresponding to the searchType specified.

Can be one of the following:

• Saved search name
• Saved search ID
• Query string

Note: Tabular commands are not supported in the query string or the saved search query. For more information about tabular commands, see Search commands.

startTime

Supported with POST method only

Optional, default is now-60min

Date and time marking the starting point of the search.

Can be one of the following:

• Time in the epoch format (in milliseconds). 
• Time in the format, now<sign><value><unit>
  For example, now+60m or now-2.

The following definitions apply while specifying time in the format, now<sign><value><unit>:

• <sign>: can be "+" or "-" depending on whether you want to specify a value after some time from now (+) or before some time from now (-).
• <value>: refers to a whole number.
• <unit>: can be either seconds, minutes, hours, or days.
  Units can be specified in the following ways:
  • Seconds: s, sec, secs, seconds
  • Minutes: m, min, mins, minutes
  • Hours: h, hr, hrs, hour, hours
  • Days: d, day, days

Note: While running the POST request, the start time and end time parameters function in the following way:

• While searching with the saved search name or ID: If not specified, the start and end time of the saved search is used.
• While searching with the search query: If not specified, the default start and end time values are used (that is last 60 minutes from the time of running the search).

endTime

Supported with POST method only

Optional, default is now

Date and time marking the ending point of the search.

Can be one of the following:

• Time in the epoch format. 
• Time in the format, now<sign><value><unit>
  For example, now+60m or now-2.

The following definitions apply while specifying time in the format, now<sign><value><unit>:

• <sign>: can be "+" or "-" depending on whether you want to specify a value after some time from now (+) or before some time from now (-).
• <value>: refers to a whole number.
• <unit>: can be either seconds, minutes, hours, or days.
  Units can be specified in the following ways:
  • Seconds: s, sec, secs, seconds
  • Minutes: m, min, mins, minutes
  • Hours: h, hr, hrs, hour, hours
  • Days: d, day, days

Note: While running the POST request, the start time and end time parameters function in the following way:

• While searching with the saved search name or ID: If not specified, the start and end time of the saved search is used.
• While searching with the search query: If not specified, the default start and end time values are used (that is last 60 minutes from the time of running the search).

pageNumber

Supported with POST method only

Optional, default is 0

Index of the page from which records (or events) must be returned.

pageSize

Supported with POST method only

Optional, default is 100

Maximum number of records (or events) to return in a page.

resultCountReq

Supported with both POST and GET methods

Optional, default is Yes

Total count of search results available for the search run.

Can be one of the following:

source

Supported with both POST and GET methods

Optional, applicable only if the searchType is a saved search name.

Source type of the saved search.

Can be one of the following:

• cp: Indicates that the saved search was imported via a content pack.
• user: Indicates that the saved search was created by a user.

sourceName

Supported with both POST and GET methods

Optional, applicable only if the searchType is a saved search name.

Value corresponding to the source specified.

Can be one of the following:

• Name of the content pack via which the saved search was imported.
• Name of the user who created the saved search.