Docs
DocumentationQuery ReferenceAPI Reference
Open Console→→
DocumentationQuery ReferenceAPI Reference

Get started

IntroductionSend dataQuery dataPaginationAPI limits

Annotations

List all annotationsGETRetrieve annotationGETCreate annotationPOSTUpdate annotationPUTDelete annotationDELETE

API tokens

List all API tokensGETRetrieve API tokenGETCreate API tokenPOSTRegenerate API tokenPOSTDelete API tokenDELETE

Dashboards

List all dashboardsGETRetrieve dashboardGETCreate dashboardPOSTUpdate dashboardPUTPatch dashboard elementPATCHDelete dashboardDELETE

Datasets

List all datasetsGETRetrieve datasetGETList all fields in datasetGETRetrieve field in datasetGETCreate datasetPOSTIngest dataPOSTRun queryPOSTRun query (legacy)POSTTrim datasetPOSTUpdate datasetPUTUpdate fieldPUTVacuum datasetPOSTDelete datasetDELETE

Edge

Ingest data to edge deploymentIngest Splunk HEC eventsIngest raw Splunk HEC eventsCheck Splunk HEC healthRun APL query to edge deploymentRun batch query to edge deploymentRun MPL query to edge deploymentGet metrics for a datasetGet metric tags for a datasetGet metric tag values for a datasetGet tags for a datasetGet tag values for a dataset

Map fields

List all map fieldsGETCreate map fieldPOSTUpdate list of map fieldsPUTDelete map fieldsDELETE

Monitors

List all monitorsGETRetrieve monitorGETRetrieve monitor historyGETCreate monitorPOSTUpdate monitorPUTDelete monitorDELETE

Notifiers

List all notifiersGETRetrieve notifierGETCreate notifierPOSTUpdate notifierPUTDelete notifierDELETE

Organizations

List all orgsGETRetrieve orgGETCreate orgPOSTUpdate orgPUTProvision orgPOST

Role-based access control

List all rolesGETRetrieve roleGETList all groupsGETRetrieve groupGETCreate rolePOSTCreate groupPOSTUpdate rolePUTUpdate groupPUTDelete roleDELETEDelete groupDELETE

Saved queries

List all saved queriesGETRetrieve saved queryGETCreate saved queryPOSTUpdate saved queryPUTDelete saved queryDELETE

Users

Retrieve current userGETList all usersGETRetrieve userGETCreate userPOSTUpdate current userPUTUpdate user rolePUTDelete user from orgDELETE

Views

List all viewsGETRetrieve viewGETCreate viewPOSTUpdate viewPUTDelete viewDELETE

Virtual fields

List all virtual fieldsGETRetrieve virtual fieldGETCreate virtual fieldPOSTUpdate virtual fieldPUTDelete virtual fieldDELETE
Monitors

Create monitor

POST/v2/monitors

Create monitor

Body

Configuration for a monitoring rule. Monitors can be configured to: - Check threshold values (e.g., CPU usage > 90%) - Match specific events in logs - Detect anomalies based on historical patterns Each monitor runs on a specified interval and can trigger notifications through configured notifiers.

application/json
PropertyTypeDescription
alertOnNoDatabooleanWhether to alert when no data is received
aplQuerystringAPL (Axiom Processing Language) query string used for monitoring. This query defines what data to analyze and how to process it. At least one of aplQuery or mplQuery must be provided.
columnNamestringName of the column to monitor
compareDaysnumber<int64>Number of days to compare for anomaly detection
createdAtstring<date-time>Timestamp when the monitor was created
createdBystringID of the user who created the monitor
descriptionstringDetailed description of the monitor's purpose
disabledbooleanWhether the monitor is currently disabled
disabledUntilstring<date-time>Timestamp until when the monitor should remain disabled
intervalMinutesinteger<int64>How frequently the monitor should run, in minutes. Minimum value is 1 minute.
mplQuerystringMPL (Metrics Processing Language) query string for metrics-based monitoring. Use this as an alternative to aplQuery for metrics datasets. At least one of aplQuery or mplQuery must be provided.
namestringRequiredName of the monitor
notifierIdsstring[]List of notifier IDs that will receive alerts. Notifiers can be email, Slack, webhook endpoints, etc.
notifyByGroupbooleanWhether to group notifications
notifyEveryRunbooleanWhether to send notifications on every check
operatorstringComparison operator for threshold checks: - Below: Trigger when value < threshold - BelowOrEqual: Trigger when value <= threshold - Above: Trigger when value > threshold - AboveOrEqual: Trigger when value >= threshold - AboveOrBelow: Trigger when value is outside a range
rangeMinutesinteger<int64>Time window to evaluate in each check, in minutes. For example, "last 5 minutes of data"
resolvablebooleanWhether the alert can be manually resolved
secondDelaynumber<int64>Delay in seconds before triggering the alert
skipResolvedbooleanWhether to skip resolved alerts
thresholdnumber<double>Threshold value for triggering the alert
tolerancenumberTolerance percentage for anomaly detection
triggerAfterNPositiveResultsnumber<int64>Number of positive results needed before triggering
triggerFromNRunsnumber<int64>Number of consecutive check runs that must fail before triggering an alert. Use this to avoid alerting on temporary spikes.
typestringRequiredType of monitoring check to perform: - Threshold: Compares a numeric value against a threshold - MatchEvent: Looks for specific events or patterns - AnomalyDetection: Identifies unusual patterns based on historical data
updatedAtstring<date-time>Timestamp when the monitor was last updated

Request

curl -X POST 'https://api.axiom.co/v2/monitors' \
  -H 'Authorization: Bearer API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"alertOnNoData":true,"aplQuery":"| where severity = 'error' | count() > 100","columnName":"cpu_usage","compareDays":7,"createdAt":"2024-03-20T10:00:00Z","createdBy":"usr_789xyz","description":"Monitors CPU usage and alerts when it exceeds 90%","disabled":false,"disabledUntil":"2024-04-01T00:00:00Z","intervalMinutes":5,"mplQuery":"test-metrics:http_request_duration_seconds","name":"Production CPU Monitor","notifierIds":["notify_slack_prod","notify_email_oncall"],"notifyByGroup":false,"notifyEveryRun":false,"operator":"Above","rangeMinutes":5,"resolvable":true,"secondDelay":300,"skipResolved":false,"threshold":90,"tolerance":10,"triggerAfterNPositiveResults":2,"triggerFromNRuns":3,"type":"Threshold","updatedAt":"2024-03-20T10:30:00Z"}'
Try itRun this request against your Axiom organization

Credentials stay in this browser tab and are only sent to Axiom when you run the request.

Response

200Monitor
application/json
Was this page helpful?
Suggest edits on GitHub
PreviousRetrieve monitor historyNextUpdate monitor
On this page
BodyRequestResponse