Method: dashboardQueries.execute

Full name: projects.locations.instances.dashboardQueries.execute

Execute a query and return the data.

HTTP request

POST https://chronicle.googleapis.com/v1alpha/{parent}/dashboardQueries:execute

Path parameters

Parameters
parent

string

Required. The parent, under which to run this dashboardQuery. Format: projects/{project}/locations/{region}/instances/{instance}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "query": {
    object (DashboardQuery)
  },
  "filters": [
    {
      object (DashboardFilter)
    }
  ]
}
Fields
query

object (DashboardQuery)

Required. The query to execute and get results back for. QueryID or 'query', 'input.time_window' fields will be used. Use 'native_dashboard' and 'dashboard_chart' fields if it is an in-dashboard query.
filters[]

object (DashboardFilter)

Optional. Dashboard level filters other than query string.

Response body

Response message for executing a dashboard query.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "results": [
    {
      object (ColumnData)
    }
  ],
  "data_sources": [
    enum (DataSource)
  ]
}
Fields
results[]

object (ColumnData)

Result rows that are queried.
data_sources[]

enum (DataSource)

Datasource of the query and results.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

ColumnData

JSON representation 
{
  "column": string,
  "values": [
    {
      object (ColumnType)
    }
  ]
}
Fields
column

string

Used to store column names.
values[]

object (ColumnType)

To store column data.

ColumnType

Singular vs list of values in a column.

JSON representation 
{

  // Union field type can be only one of the following:
  "value": {
    object (ColumnValue)
  },
  "list": {
    object (List)
  }
  // End of list of possible types for union field type.
}
Fields

Union field type.

type can be only one of the following:
value

object (ColumnValue)

Single value in a column.
list

object (List)

List of values in a column e.g. IPs

ColumnValue

Value of the column based on data type.

JSON representation 
{

  // Union field value can be only one of the following:
  "null_val": boolean,
  "bool_val": boolean,
  "bytes_val": string,
  "double_val": number,
  "int64_val": string,
  "uint64_val": string,
  "string_val": string,
  "timestamp_val": string,
  "date_val": {
    object (Date)
  },
  "proto_val": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field value.
}
Fields

Union field value.

value can be only one of the following:
null_val

boolean

True if the value is NULL.
bool_val

boolean

Boolean value.
bytes_val

string (bytes format)

Bytes value.

A base64-encoded string.
double_val

number

Double value.
int64_val

string (int64 format)

Integer value (signed).
uint64_val

string

Un-signed integer value.
string_val

string

String value. Enum values are returned as strings.
timestamp_val

string (Timestamp format)

Timestamp values. Does not handle interval.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
date_val

object (Date)

Date values.
proto_val

object

For any proto values that are not any of the above.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

Date

Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following:

  • A full date, with non-zero year, month, and day values.
  • A month and day, with a zero year (for example, an anniversary).
  • A year on its own, with a zero month and a zero day.
  • A year and month, with a zero day (for example, a credit card expiration date).

Related types:

JSON representation 
{
  "year": integer,
  "month": integer,
  "day": integer
}
Fields
year

integer

Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
month

integer

Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
day

integer

Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

List

Store list of values in a column.

JSON representation 
{
  "values": [
    {
      object (ColumnValue)
    }
  ]
}
Fields
values[]

object (ColumnValue)