search

Description

Performs a log analytics search, if shouldRunAsync is false returns the query results once they become available subject to 60 second timeout. If a query is subject to exceed that time then it should be run asynchronously. Asynchronous query submissions return the queryWorkRequestId to use for execution tracking, query submission lifecycle actions and to poll for query results.

Usage

oci log-analytics query search [OPTIONS]

Required Parameters

--compartment-id, -c [text]

Compartment Identifier OCID .

--namespace-name, --namespace, -ns [text]

The Logging Analytics namespace used for the request.

--query-string [text]

Query to perform. Must conform to logging analytic querylanguage syntax. Syntax errors will be returned if present.

--sub-system [text]

Default subsystem to qualify fields with in the queryString if not specified.

Accepted values are:

LOG

Optional Parameters

--async-mode [text]

Execution mode for the query if running asynchronously i.e (shouldRunAsync is set to true).

Accepted values are:

BACKGROUND, FOREGROUND

--compartment-id-in-subtree [boolean]

Flag to search all child compartments of the compartment Id specified in the compartmentId query parameter.

--from-json [text]

Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id –> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

For examples on usage of this option, please see our “using CLI with advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

--limit [integer]

Maximum number of results to return in this request. Note a limit=-1 returns all results from pageId onwards up to maxtotalCount.

--max-total-count [integer]

Maximum number of results to count. Note a maximum of 2001 will be enforced; that is, actualMaxTotalCountUsed = Math.min(maxTotalCount, 2001).

--max-wait-seconds [integer]

The maximum time to wait for the work request to reach the state defined by --wait-for-state. Defaults to 1200 seconds.

--page [text]

The page token representing the page at which to start retrieving results. This is usually retrieved from a previous list call.

--query-timeout-in-seconds [integer]

Amount of time, in seconds, allowed for a query to execute. If this time expires before the query is complete, any partial results will be returned.

--scope-filters [complex type]

List of filters to be applied when the query executes. More than one filter per field is not permitted.

This option is a JSON list with items of type ScopeFilter. For documentation on ScopeFilter please see our API reference: https://docs.cloud.oracle.com/api/#/en/loganalytics/20200601/datatypes/ScopeFilter. This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

--should-include-columns [boolean]

Include columns in response

--should-include-fields [boolean]

Include fields in response

--should-include-total-count [boolean]

Include the total number of results from the query. Note, this value will always be equal to or less than maxTotalCount.

--should-run-async [boolean]

Option to run the query asynchronously. This will lead to a LogAnalyticsQueryJobWorkRequest being submitted and the {workRequestId} will be returned to use for fetching the results.

--should-use-acceleration [boolean]

Controls if query should ignore pre-calculated results if available and only use raw data. If set and no acceleration data is found it will fallback to raw data.

--time-end [datetime]

Date-time for query to stop matching results to. End Time must be greater than or equal to start time otherwise it will result in error.

The following datetime formats are supported:

UTC with microseconds

Format: YYYY-MM-DDTHH:mm:ss.ssssssTZD
Example: 2017-09-15T20:30:00.123456Z

UTC with milliseconds
***********************
.. code::

    Format: YYYY-MM-DDTHH:mm:ss.sssTZD
    Example: 2017-09-15T20:30:00.123Z

UTC without milliseconds
**************************
.. code::

    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T20:30:00Z

UTC with minute precision
**************************
.. code::

    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T20:30Z

Timezone with microseconds

Format: YYYY-MM-DDTHH:mm:ssTZD
Example: 2017-09-15T12:30:00.456789-08:00, 2017-09-15T12:30:00.456789-0800

Timezone with milliseconds
***************************
.. code::

    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00.456-08:00, 2017-09-15T12:30:00.456-0800

Timezone without milliseconds
*******************************
.. code::

    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00-08:00, 2017-09-15T12:30:00-0800

Timezone with minute precision
*******************************
.. code::

    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T12:30-08:00, 2017-09-15T12:30-0800

Short date and time
********************
The timezone for this date and time will be taken as UTC (Needs to be surrounded by single or double quotes)

.. code::

    Format: 'YYYY-MM-DD HH:mm' or "YYYY-MM-DD HH:mm"
    Example: '2017-09-15 17:25'

Date Only
**********
This date will be taken as midnight UTC of that day

.. code::

    Format: YYYY-MM-DD
    Example: 2017-09-15

Epoch seconds
**************
.. code::

    Example: 1412195400

--time-start [datetime]

Date-time for query to start matching results from. Start time must be less than end time otherwise it will result in error.

The following datetime formats are supported:

UTC with microseconds

Format: YYYY-MM-DDTHH:mm:ss.ssssssTZD
Example: 2017-09-15T20:30:00.123456Z

UTC with milliseconds
***********************
.. code::

    Format: YYYY-MM-DDTHH:mm:ss.sssTZD
    Example: 2017-09-15T20:30:00.123Z

UTC without milliseconds
**************************
.. code::

    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T20:30:00Z

UTC with minute precision
**************************
.. code::

    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T20:30Z

Timezone with microseconds

Format: YYYY-MM-DDTHH:mm:ssTZD
Example: 2017-09-15T12:30:00.456789-08:00, 2017-09-15T12:30:00.456789-0800

Timezone with milliseconds
***************************
.. code::

    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00.456-08:00, 2017-09-15T12:30:00.456-0800

Timezone without milliseconds
*******************************
.. code::

    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00-08:00, 2017-09-15T12:30:00-0800

Timezone with minute precision
*******************************
.. code::

    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T12:30-08:00, 2017-09-15T12:30-0800

Short date and time
********************
The timezone for this date and time will be taken as UTC (Needs to be surrounded by single or double quotes)

.. code::

    Format: 'YYYY-MM-DD HH:mm' or "YYYY-MM-DD HH:mm"
    Example: '2017-09-15 17:25'

Date Only
**********
This date will be taken as midnight UTC of that day

.. code::

    Format: YYYY-MM-DD
    Example: 2017-09-15

Epoch seconds
**************
.. code::

    Example: 1412195400

--timezone [text]

Time zone for query. Should use long time zone name e.g America/New_York to handle daylight savings properly.

--wait-for-state [text]

This operation asynchronously creates, modifies or deletes a resource and uses a work request to track the progress of the operation. Specify this option to perform the action and then wait until the work request reaches a certain state. Multiple states can be specified, returning on the first state. For example, --wait-for-state SUCCEEDED --wait-for-state FAILED would return on whichever lifecycle state is reached first. If timeout is reached, a return code of 2 is returned. For any other error, a return code of 1 is returned.

Accepted values are:

ACCEPTED, CANCELED, CANCELING, FAILED, IN_PROGRESS, SUCCEEDED

--wait-interval-seconds [integer]

Check every --wait-interval-seconds to see whether the work request has reached the state defined by --wait-for-state. Defaults to 30 seconds.

Global Parameters

Use oci --help for help on global parameters.

--auth-purpose, --auth, --cert-bundle, --cli-auto-prompt, --cli-rc-file, --config-file, --connection-timeout, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --latest-version, --max-retries, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --proxy, --query, --raw-output, --read-timeout, --realm-specific-endpoint, --region, --release-info, --request-id, --version, -?, -d, -h, -i, -v

Example using required parameter

Copy the following CLI commands into a file named example.sh. Run the command by typing “bash example.sh” and replacing the example parameters with your own.

Please note this sample will only work in the POSIX-compliant bash-like shell. You need to set up the OCI configuration and appropriate security policies before trying the examples.

    export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/log-analytics/query/search.html#cmdoption-compartment-id
    export namespace_name=<substitute-value-of-namespace_name> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/log-analytics/query/search.html#cmdoption-namespace-name
    export query_string=<substitute-value-of-query_string> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/log-analytics/query/search.html#cmdoption-query-string
    export sub_system=<substitute-value-of-sub_system> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/log-analytics/query/search.html#cmdoption-sub-system

    oci log-analytics query search --compartment-id $compartment_id --namespace-name $namespace_name --query-string $query_string --sub-system $sub_system