Method: instances.findUdmFieldValues

Full name: projects.locations.instances.findUdmFieldValues

Finds ingested UDM field values that match a query.

HTTP request


Path parameters

Parameters
instance

string

Required. Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}

Query parameters

Parameters
query

string

Required. The partial UDM field value to match.
pageSize

integer

Optional. The maximum number of value matches to return. If unspecified, a default value will be used.

Request body

The request body must be empty.

Response body

Ingested UDM field values that match a query.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "valueMatches": [
    {
      object (ValueMatch)
    }
  ],
  "fieldMatches": [
    {
      object (FieldMatch)
    }
  ],
  "fieldMatchRegex": string,
  "nextPageToken": string
}
Fields
valueMatches[]

object (ValueMatch)

Values that match the query.
fieldMatches[]

object (FieldMatch)

Fields that might contain a matching value.
fieldMatchRegex

string

A regular expression based on the query that can be used to find matching values within the field-level matches.
nextPageToken

string

Currently, this field is used only to indicate whether more value matches are available. If it is empty, there are no more value matches.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the instance resource:

  • chronicle.events.findUdmFieldValues

For more information, see the IAM documentation.

ValueMatch

A UDM field value that matches the query.

JSON representation 
{
  "fieldPath": string,
  "value": string,
  "ingestionTime": string,
  "matchStart": integer,
  "matchEnd": integer
}
Fields
fieldPath

string

The UDM field containing the matching value.
value

string

The matching value.
ingestionTime

string (Timestamp format)

The approximate time of the last ingestion of the value.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
matchStart

integer

The index within value where the matching text starts.
matchEnd

integer

The index within value where the matching text ends (exclusive).

FieldMatch

A UDM field that might contain a value that matches the query.

JSON representation 
{
  "fieldPath": string
}
Fields
fieldPath

string

The UDM field that might contain a matching value.