chart_data

Returns the data you can use to display a chart and the table under the chart. The chart_data request also returns the results of aggregate operators like sort, tail, and head. For an example of returning the results of aggregate operators, see Example: Returning Aggregate Search Data.

Resource URL

Use the following URL when making chart data requests.

https://<hostname>:<port>/server/search/chart_data

Note: In order to get valid chart_data results, the search query you made earlier must include the pipeline chart operator. For example:

... |chart sum(deviceCustomNumber1) by deviceEventClassId

Parameters

This request accepts the following parameters.

Name

Type

Required

Default

Description

search_session_id

Number

Yes

 

The Search Session ID you specified when first starting the search session.

user_session_id

String

Yes

 

The User Session ID generated by the login API.

length

Number

 

25

The length or number of results to retrieve. Maximum number is 100.

offset

Number

 

0

The offset from the first result.

Response

This request returns one of the status codes listed in http status codes.

This request returns the following values.

Attribute

Description

fields

The list of field objects for the results.

The field object will have: "name": field name, "type": field type (string/number/date), "alias": original name if the field name is renamed.

results

The list of results for each field. This will be list of arrays, where each array has values for each field specified in the fields attribute.

For information about returned error messages, see Error Messages.

Example 1

This example returns the data necessary to display a chart.

curl -k https://<hostname>:<port>/server/search/chart_data -H "Content-Type:  application/json ; charset=UTF-8" -d '{
    "search_session_id" : 1399546550086,
    "user_session_id" : "UDIWj3m-iGksVI_zSMViSdqF48r6DXpbTQpRQQiEbgw."
}'

{
    "fields" : [
        {"name": "deviceEventClassId", "type": "string", "alias": "deviceEventClassId"},
        {"name": "sum_deviceCustomNumber1", "type": "number",  "alias": "sum_deviceCustomNumber1"}
    ],
    "results": [
        ["TCP_NC_MISS", 450]
        ...
    ]
}