The API allows you to run alert search requests in the background. With help of this you can monitor the progress of the request and view the results as and when they become available.
Here are the steps involved in executing an asynchronous alerts query:
You can make a request with a set of required metadata and asynchronous parameters.
The server will respond with a request ID and the search is performed in background thread.
You can check the status of the request through the Jobs endpoint.
Once the job is done, you can fetch the results using the jobs/results endpoint.
The search results will be available in EventLog Analyzer for 24 hours after which they are deleted by the cleanup thread.
Synchronous Alerts
Asynchronous Alerts
It retrieves data within the retention period. The response time taken is based on data fetched.
It retrieves large amount of data based on the given criteria. The response will be a request ID and the search is performed in background thread
In order to acquire the next set of results, keep requesting with the next cursor.
Once the job is done, in order to acquire the next result page, search with the next page_no using the job results endpoint.
The request needs to be sent in the body of the request using JSON format. And should contain following key/value parameters
Parameter name
Default value
Mandatory
Type
Description
query
*
No
String
Start value of the list
alert_profiles
all
No
JSONArray
List of alert profiles
severity
all
No
JSONArray
List of severity
status
all
No
JSONArray
List of status
from
current time - 24 hours
No
Long
Start time for search in Unix milliseconds
to
current time
No
Long
End time for search in Unix milliseconds
Note:
Quotes i.e ( " ") in query string should to be escaped. If query in EventLog Analyzer's search page is REMOTE_INTERFACE = "switch 1", then for Rest Api the query parameter should be written as "REMOTE_INTERFACE = \"switch 1\""
Response
The response will be a JSON object which will contain the following key/value pairs
Parameter name
Description
hits
JSON object which contain search hits for the request
Contains following fields hits: List of alert hits hits_count_in_current_page: Hits count in current alert hit response
Download PDF
