Oracle Management Cloud Common REST API

Perform search (Stream)

post

/serviceapi/querylanguage.export

Perform a search by using the ExportRequest object. The only mandatory body parameter is queryString. To learn more about how queries work, see Get Started With Log Analytics.

This API will output the query results as a stream as they become available.

Request

Supported Media Types

application/json

Header Parameters

X-REMOTE-USER: string

User name
X-USER-IDENTITY-DOMAIN-NAME: string

Tenant ID

Query to be exported

Root Schema : ExportRequest

Type: object

Show Source

includeColumns(optional): boolean

Default Value: false

Include columns in response

Example: true
localize(optional): boolean

Default Value: false

Localize results, including header columns, LOV and timestamp values.
maxTotalCount(optional): integer(int32)

Maximum number of results retrieved from data source. Note a maximum value will be enforced; if the export results can be streamed, the maximum will be 50000000, otherwise 10000; that is, if not streamed, actualMaxTotalCountUsed = Math.min(maxTotalCount, 10000). Export will incrementally stream results depending on the queryString. Some commands including head/tail are not compatible with streaming result delivery and therefore enforce a reduced limit on overall maxtotalcount. no sort command or sort by id, e.g. ' | sort id ' - is streaming compatible sort by time and id, e.g. ' | sort -time, id ' - is streaming compatible all other cases, e.g. ' | sort -time, id, mtgtguid ' - is not streaming compatible due to the additional sort field

Example: 500
outputMode(optional): string

Allowed Values: [ "csv" ]

Specifies the format for the returned results. Possible values include: csv (comma delimited).

Example: csv
queryString: string

Query to perform. To learn more about how queries work, see Get Started With Log Analytics.

Example: * | stats count by 'Log Source'
queryTimeout(optional): integer(int32)

Amount of time, in seconds, allowed for a query to complete. If this time expires before the query is complete, any partial results will be returned.
subSystem(optional): string

Allowed Values: [ "LOG", "SECURITY" ]

Each subsystem has its own namespace for fields it contains. This means two fields in different subsystems can have the same name; for example, log.status and target.status refer to two different fields. The subsystem parameter identifies the default subsystem to use when validating/querying a field that is not explicity qualifed by its subsystem.
targetFilters(optional): object TargetFilters
timeFilter(optional): object TimeFilter

Discriminator: type

{
    "properties":{
        "includeColumns":{
            "default":false,
            "description":"Include columns in response",
            "example":true,
            "type":"boolean"
        },
        "localize":{
            "default":false,
            "description":"Localize results, including header columns, LOV and timestamp values.",
            "type":"boolean"
        },
        "maxTotalCount":{
            "description":"Maximum number of results retrieved from data source.  Note a maximum value will be enforced; if the export results can be streamed, the maximum will be 50000000, otherwise 10000; that is, if not streamed, actualMaxTotalCountUsed = Math.min(maxTotalCount, 10000).\n\n\nExport will incrementally stream results depending on the queryString.\n\nSome commands including head/tail are not compatible with streaming result delivery and therefore enforce a reduced limit on overall maxtotalcount.\n no sort command or sort by id, e.g. ' | sort id ' - is streaming compatible\n sort by time and id, e.g. ' | sort -time, id ' - is streaming compatible\nall other cases, e.g. ' | sort -time, id, mtgtguid ' - is not streaming compatible due to the additional sort field",
            "example":500,
            "format":"int32",
            "type":"integer"
        },
        "outputMode":{
            "description":"Specifies the format for the returned results. Possible values include: csv (comma delimited).",
            "enum":[
                "csv"
            ],
            "example":"csv",
            "type":"string"
        },
        "queryString":{
            "description":"Query to perform. To learn more about how queries work, see <a href='LogAnalytics.html'>Get Started With Log Analytics</a>.",
            "example":"* | stats count by 'Log Source'",
            "type":"string"
        },
        "queryTimeout":{
            "description":"Amount of time, in seconds, allowed for a query to complete. If this time expires before the query is complete, any partial results will be returned.",
            "format":"int32",
            "type":"integer"
        },
        "subSystem":{
            "description":"Each subsystem has its own namespace for fields it contains. This means two fields in different subsystems can have the same name; for example, log.status and target.status refer to two different fields. The subsystem parameter identifies the default subsystem to use when validating/querying a field that is not explicity qualifed by its subsystem.",
            "enum":[
                "LOG",
                "SECURITY"
            ],
            "type":"string"
        },
        "targetFilters":{
            "$ref":"#/definitions/TargetFilters"
        },
        "timeFilter":{
            "$ref":"#/definitions/TimeFilter"
        }
    },
    "required":[
        "queryString"
    ],
    "type":"object"
}

Nested Schema : TargetFilters

Type: object

Show Source

filters(optional): array filters
match(optional): string

Allowed Values: [ "ALL", "ANY" ]

{
    "properties":{
        "filters":{
            "items":{
                "$ref":"#/definitions/TargetFilter"
            },
            "type":"array"
        },
        "match":{
            "enum":[
                "ALL",
                "ANY"
            ],
            "type":"string"
        }
    },
    "type":"object"
}

Nested Schema : TimeFilter

Type: object

Discriminator: type

Nested Schema : filters

Type: array

Show Source

Array of: object TargetFilter

{
    "items":{
        "$ref":"#/definitions/TargetFilter"
    },
    "type":"array"
}

Nested Schema : TargetFilter

Type: object

Show Source

name(optional): string

Allowed Values: [ "ENTITY_NAME", "ME_ID", "MEMBER_OF", "USED_BY", "USES", "SAVED_SEARCH" ]
operator(optional): string

Allowed Values: [ "IS_EQUAL" ]
values(optional): array values

{
    "properties":{
        "name":{
            "enum":[
                "ENTITY_NAME",
                "ME_ID",
                "MEMBER_OF",
                "USED_BY",
                "USES",
                "SAVED_SEARCH"
            ],
            "type":"string"
        },
        "operator":{
            "enum":[
                "IS_EQUAL"
            ],
            "type":"string"
        },
        "values":{
            "items":{
                "type":"string"
            },
            "type":"array"
        }
    },
    "type":"object"
}

Nested Schema : values

Type: array

Show Source

Array of: string

{
    "items":{
        "type":"string"
    },
    "type":"array"
}

Response

Supported Media Types

application/octet-stream

200 Response

Operation succeeded

Root Schema : OutputStream

Type: object

400 Response

Bad request. See response body for explanation.

Root Schema : InternalErrorResponse

Type: object

Show Source

messages(optional): array messages
type(optional): string

Allowed Values: [ "PARSERERROR", "INVALIDPARAMETER", "UNSUPPORTEDSUBSYSTEM", "UNSUPPORTEDFILTER", "UNSUPPORTEDVERSION", "INVALIDJOBID", "INVALIDQUERYID", "FORBIDDEN", "INTERNALERROR", "JSONERROR", "INTERRUPTEDERROR", "EXECUTIONERROR", "COMPILATIONERROR", "SERVICEAVAILABILITYERROR" ]
violations(optional): array violations

{
    "properties":{
        "messages":{
            "items":{
                "type":"string"
            },
            "type":"array"
        },
        "type":{
            "enum":[
                "PARSERERROR",
                "INVALIDPARAMETER",
                "UNSUPPORTEDSUBSYSTEM",
                "UNSUPPORTEDFILTER",
                "UNSUPPORTEDVERSION",
                "INVALIDJOBID",
                "INVALIDQUERYID",
                "FORBIDDEN",
                "INTERNALERROR",
                "JSONERROR",
                "INTERRUPTEDERROR",
                "EXECUTIONERROR",
                "COMPILATIONERROR",
                "SERVICEAVAILABILITYERROR"
            ],
            "type":"string"
        },
        "violations":{
            "items":{
                "$ref":"#/definitions/ParserViolation"
            },
            "type":"array"
        }
    },
    "type":"object"
}

Nested Schema : messages

Type: array

Show Source

Array of: string

{
    "items":{
        "type":"string"
    },
    "type":"array"
}

Nested Schema : violations

Type: array

Show Source

Array of: object ParserViolation

{
    "items":{
        "$ref":"#/definitions/ParserViolation"
    },
    "type":"array"
}

Nested Schema : ParserViolation

Type: object

Show Source

end(optional): integer(int32)
message(optional): string
start(optional): integer(int32)

{
    "properties":{
        "end":{
            "format":"int32",
            "type":"integer"
        },
        "message":{
            "type":"string"
        },
        "start":{
            "format":"int32",
            "type":"integer"
        }
    },
    "type":"object"
}

403 Response

Forbidden. User does not have required privileges.

500 Response

Internal server error. See response body for explanation.

Root Schema : InternalErrorResponse

Type: object

Show Source

messages(optional): array messages
type(optional): string

Allowed Values: [ "PARSERERROR", "INVALIDPARAMETER", "UNSUPPORTEDSUBSYSTEM", "UNSUPPORTEDFILTER", "UNSUPPORTEDVERSION", "INVALIDJOBID", "INVALIDQUERYID", "FORBIDDEN", "INTERNALERROR", "JSONERROR", "INTERRUPTEDERROR", "EXECUTIONERROR", "COMPILATIONERROR", "SERVICEAVAILABILITYERROR" ]
violations(optional): array violations

{
    "properties":{
        "messages":{
            "items":{
                "type":"string"
            },
            "type":"array"
        },
        "type":{
            "enum":[
                "PARSERERROR",
                "INVALIDPARAMETER",
                "UNSUPPORTEDSUBSYSTEM",
                "UNSUPPORTEDFILTER",
                "UNSUPPORTEDVERSION",
                "INVALIDJOBID",
                "INVALIDQUERYID",
                "FORBIDDEN",
                "INTERNALERROR",
                "JSONERROR",
                "INTERRUPTEDERROR",
                "EXECUTIONERROR",
                "COMPILATIONERROR",
                "SERVICEAVAILABILITYERROR"
            ],
            "type":"string"
        },
        "violations":{
            "items":{
                "$ref":"#/definitions/ParserViolation"
            },
            "type":"array"
        }
    },
    "type":"object"
}

Nested Schema : messages

Type: array

Show Source

Array of: string

{
    "items":{
        "type":"string"
    },
    "type":"array"
}

Nested Schema : violations

Type: array

Show Source

Array of: object ParserViolation

{
    "items":{
        "$ref":"#/definitions/ParserViolation"
    },
    "type":"array"
}

Nested Schema : ParserViolation

Type: object

Show Source

end(optional): integer(int32)
message(optional): string
start(optional): integer(int32)

{
    "properties":{
        "end":{
            "format":"int32",
            "type":"integer"
        },
        "message":{
            "type":"string"
        },
        "start":{
            "format":"int32",
            "type":"integer"
        }
    },
    "type":"object"
}

Examples

This cURL call will return all logs for all Database Instance and Cluster Database targets whose name contains the substring TEST:

Create a new JSON file called testQuery.json and copy the following:

{
  "queryString": "'target type' in ('Database Instance', 'Cluster Database') target like '%TEST%' | fields target, 'target type', message"

Run the following cURL command:

curl -u "OMC_USERNAME" -X POST -H "Content-Type:application/json" "https://"OMC_URL"/serviceapi/querylanguage/{version}/export" -d "@testQuery.json"

Example of Response

The following shows an example of the response body.

{
  "columns":[{"name":"target", "displayName":"Target", "valueType":"string", ...},
    {"name":"target_type", "displayName":"Target Type", "valueType":"string", ...},
    {"name":"msg", "displayName":"Msg", "valueType":"string", ...}],
  "results":[["TEST_DB1", "oracle_database", "msg1"],
    ["TEST_DB2", "oracle_database", "msg2"],
    ["TEST_RAC1", "rac_database", "msg3"],
   ...]
}