Docs
DocumentationQuery ReferenceAPI Reference
Open Console→→
DocumentationQuery ReferenceAPI Reference

Get started

IntroductionSend dataQuery dataPaginationAPI limits

Annotations

List all annotationsGETRetrieve annotationGETCreate annotationPOSTUpdate annotationPUTDelete annotationDELETE

API tokens

List all API tokensGETRetrieve API tokenGETCreate API tokenPOSTRegenerate API tokenPOSTDelete API tokenDELETE

Dashboards

List all dashboardsGETRetrieve dashboardGETCreate dashboardPOSTUpdate dashboardPUTPatch dashboard elementPATCHDelete dashboardDELETE

Datasets

List all datasetsGETRetrieve datasetGETList all fields in datasetGETRetrieve field in datasetGETCreate datasetPOSTIngest data (legacy)POSTRun queryPOSTRun query (legacy)POSTTrim datasetPOSTUpdate datasetPUTUpdate fieldPUTVacuum datasetPOSTDelete datasetDELETE

Edge

Ingest data to edge deploymentIngest Splunk HEC eventsIngest raw Splunk HEC eventsCheck Splunk HEC healthRun APL query to edge deploymentRun batch query to edge deploymentRun MPL query to edge deploymentGet metrics for a datasetGet metric tags for a datasetGet metric tag values for a datasetGet tags for a datasetGet tag values for a dataset

Map fields

List all map fieldsGETCreate map fieldPOSTUpdate list of map fieldsPUTDelete map fieldsDELETE

Monitors

List all monitorsGETRetrieve monitorGETRetrieve monitor historyGETCreate monitorPOSTUpdate monitorPUTDelete monitorDELETE

Notifiers

List all notifiersGETRetrieve notifierGETCreate notifierPOSTUpdate notifierPUTDelete notifierDELETE

Organizations

List all orgsGETRetrieve orgGETCreate orgPOSTUpdate orgPUTProvision orgPOST

Role-based access control

List all rolesGETRetrieve roleGETList all groupsGETRetrieve groupGETCreate rolePOSTCreate groupPOSTUpdate rolePUTUpdate groupPUTDelete roleDELETEDelete groupDELETE

Saved queries

List all saved queriesGETRetrieve saved queryGETCreate saved queryPOSTUpdate saved queryPUTDelete saved queryDELETE

Users

Retrieve current userGETList all usersGETRetrieve userGETCreate userPOSTUpdate current userPUTUpdate user rolePUTDelete user from orgDELETE

Views

List all viewsGETRetrieve viewGETCreate viewPOSTUpdate viewPUTDelete viewDELETE

Virtual fields

List all virtual fieldsGETRetrieve virtual fieldGETCreate virtual fieldPOSTUpdate virtual fieldPUTDelete virtual fieldDELETE
Datasets

Run query

POST/v1/datasets/_apl?format=tabular

Query

Warning

This endpoint allows you to query data stored in any edge deployment, but query results are routed through the US East 1 (AWS) deployment. This means that if you store data in an edge deployment other than US East 1 (AWS), query results leave the edge deployment where your data is stored. For more information, see Edge deployments.

The base domain for this endpoint is https://api.axiom.co, irrespective of your edge deployment.

To query data without results leaving the edge deployment where your data is stored, use the Run APL query to edge deployment or Run batch query to edge deployment endpoints.

Parameters

PropertyTypeLocationDescription
formatstringRequiredquery—
nocachebooleanquery—
saveAsKindstringquery—
dataset_namestringqueryWhen saveAsKind is true, this parameter indicates the name of the associated dataset.

Body

application/json
PropertyTypeDescription
aplstringRequiredAPL query to execute. For more information, see [Introduction to APL](/apl/introduction).
cursorstring—
endTimestring—
includeCursorboolean—
queryOptionsobject—
└againststring—
└againstStartstring—
└againstTimestampstring—
└aggChartOptsstring—
└caseSensitivestring—
└containsTimeFilterstring—
└datasetsstring—
└displayNullstring—
└editorContentstring—
└endColumnstring—
└endLineNumberstring—
└endTimestring—
└integrationsFilterstring—
└openIntervalsstring—
└quickRangestring—
└resolutionstring—
└shownColumnsstring—
└startColumnstring—
└startLineNumberstring—
└startTimestring—
└timeSeriesVariantstring—
└timeSeriesViewstring—
startTimestringstart and end time for the query, these must be specified as RFC3339 strings or using relative time expressions (e.g. now-1h, now-1d, now-1w, etc)
variablesobjectVariables is an optional set of additional variables that are inserted into the APL

Request

curl -X POST 'https://api.axiom.co/v1/datasets/_apl?format=tabular' \
  -H 'Authorization: Bearer API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"apl":"[\"dataset-name\"] | limit 10","startTime":"string","endTime":"string"}'
Try itRun this request against your Axiom organization

Credentials stay in this browser tab and are only sent to Axiom when you run the request.

Response

200Successful APL result
application/json
403Forbidden
application/json
PropertyTypeDescription
bucketsobject—
└seriesobject[]—
└endTimestring<date-time>Required—
└groupsobject[]—
└aggregationsobject[]—
└dataobject—
└opstringRequired—
└valueobjectRequired—
└groupobjectRequired—
└idinteger<uint64>Required—
└startTimestring<date-time>Required—
└totalsobject[]—
└aggregationsobject[]—
└dataobject—
└opstringRequired—
└valueobjectRequired—
└groupobjectRequired—
└idinteger<uint64>Required—
datasetNamesstring[]Required—
fieldsMetaMapobjectFieldsMetaMap contains the unit information (if we have it) for each field in the given dataset entry
formatstringRequiredFormat specifies the result set format. Either "legacy" (default) or "tabular".
matchesobject[]Matches hold the matching events of a filter query in the "legacy" result format
└_rowIdstringRequired—
└_sysTimestring<date-time>Required—
└_timestring<date-time>Required—
└dataobjectRequired—
requestobject—
└aggregationsobject[]—
└aliasstring—
└argumentobject—
└fieldstringRequired—
└opstringRequired—
└continuationTokenstring—
└cursorstring—
└endTimestringRequired—
└fieldsMetaobject[]FieldsMeta contains the unit information (if we have it) for each field
└descriptionstring—
└hiddenbooleanRequired—
└namestringRequired—
└typestringRequired—
└unitstringRequired—
└filterobject—
└caseSensitivebooleanSupported for these filters: starts-with, not-starts-with, ends-with, not-ends-with, contains, not-contains, eq, ne.
└childrenstring[]Supported for these filters: and, or, not.
└fieldstringRequired—
└opstringRequiredWe also support '==', but we’re not exporting that to swagger, because it can’t deal with it add >, >=, <, <= to that list, it breaks codegen.
└valueobject—
└groupBystring[]—
└includeCursorboolean—
└limitinteger<uint32>—
└orderobject[]—
└descbooleanRequired—
└fieldstringRequired—
└projectobject[]—
└aliasstring—
└fieldstringRequired—
└resolutionstringRequiredThe time resolution of the query’s graph, in seconds. Valid values are the query’s time range /100 at maximum and /1000 at minimum or "auto".
└startTimestringRequiredstart and end time for the query, these must be specified as RFC3339 strings or using relative time expressions (e.g. now-1h, now-1d, now-1w, etc)
└virtualFieldsobject[]—
└aliasstringRequired—
└exprstringRequired—
statusobjectRequired—
└blocksExaminedinteger<uint64>Required—
└cacheStatusinteger<uint8>Required—
└continuationTokenstring—
└elapsedTimeinteger<int64>Required—
└isEstimateboolean—
└isPartialbooleanRequired—
└maxBlockTimestring<date-time>Required—
└maxCursorstringRow id of the newest row, as seen server side. May be higher than what the results include if the server scanned more data than included in the results. Can be used to efficiently resume time-sorted non-aggregating queries (ie filtering only).
└messagesobject[]—
└codestring—
└countinteger<int64>Required—
└msgstringRequired—
└prioritystringRequired—
└minBlockTimestring<date-time>Required—
└minCursorstringRow id of the oldest row, as seen server side. May be lower than what the results include if the server scanned more data than included in the results. Can be used to efficiently resume time-sorted non-aggregating queries (ie filtering only).
└numGroupsinteger<uint32>Required—
└rowsExaminedinteger<uint64>Required—
└rowsMatchedinteger<uint64>Required—
tablesobject[]Tables hold the result tables in the "tabular" result format
└bucketsobjectThe standard mode of operation is to create buckets on the _time column,
└fieldstringRequiredField specifies the field used to create buckets on. Normally this would be _time.
└sizeobjectRequiredAn integer or float representing the fixed bucket size. When the bucket field is _time this value is in nanoseconds.
└columnsobject[][]Columns contain a series of arrays with the raw result data. The columns here line up with the fields in the Fields array.
└fieldsobject[]RequiredFields contain information about the fields included in these results. The order of the fields match up with the order of the data in Columns.
└aggobjectAggInfo captures information about an aggregation
└argsobject[]Args specifies any non-field arguments for the aggregation. Fx. [10] for topk(players, 10).
└fieldsstring[]Fields specifies the names of the fields this aggregation is computed on. Fx ["players"] for topk(players, 10)
└namestringRequiredName is the system name of the aggregation, which is the string form of aggregation.Type. If the aggregation is aliased, the alias is stored in the parent FieldInfo
└namestringRequired—
└typestringRequired—
└groupsobject[]RequiredGroups specifies which grouping operations has been performed on the results.
└namestring—
└namestringRequiredName is the name assigned to this table. Defaults to "0". The name "_totals" is reserved for system use.
└orderobject[]RequiredOrder echoes the ordering clauses that was used to sort the results.
└descbooleanRequired—
└fieldstringRequired—
└rangeobject—
└endstring<date-time>RequiredEnd is the ending time the query is limited by. Queries are restricted to the interval [start,end).
└fieldstringRequiredField specifies the field name on which the query range was restricted. Normally _time
└startstring<date-time>RequiredStart is the starting time the query is limited by. Queries are restricted to the interval [start,end).
└sourcesobject[]RequiredSources contain the names of the datasets that contributed data to these results.
└namestringRequired—
Was this page helpful?
Suggest edits on GitHub
PreviousIngest data (legacy)NextRun query (legacy)
On this page
ParametersBodyRequestResponse