GET /ariel/searches/{search_id}/results

Retrieves search results in the requested format.

Retrieve the results of the Ariel search that is identified by the search ID. The Accepts request header indicates the format of the result. The formats are RFC compliant and can be JSON, CSV, XML, or tabular text.

By default, all query result records are returned. To restrict the results to a contiguous subset of the records, you can supply a Range header to specify the inclusive range of records to be returned.

This end-point works with query results that are generated by AQL query expressions. This endpoint might not work as expected for results that are generated by other means. Search results might not be retrievable for searches that are created on the Console.

The response samples are for the following query: Select sourceIP, destinationIP from events.

Table 1. GET /ariel/searches/{search_id}/results resource details
MIME Type
application/json application/csv text/table application/xml

Table 2. GET /ariel/searches/{search_id}/results request parameter details
Parameter	Type	Optionality	Data Type	MIME Type	Description
search_id	path	Required	String	text/plain	The ID of the search criteria for the returned results.
data_lake	query	Optional	String	text/plain	Optional - If the search was for QCDL then "qcdl" should be entered in this field. Only "qcdl" can be entered in this field
Range	header	Optional	String	text/plain	Optional - Use this parameter to restrict the number of elements that are returned in the list to a specified range. The list is indexed starting at zero.

Table 3. GET /ariel/searches/{search_id}/results response codes
HTTP Response Code	Unique Code	Description
200		The search results were retrieved.
404	1002	The search does not exist.
404	1003	Search results not found. The search is still in progress.
422	1005	A request parameter is not valid.
500	1020	An error occurred during the attempt to retrieve the search results.
503	1010	The Ariel server might be temporarily unavailable or offline. Please try again later.

Response Description

The search results for the specified search ID. The format that is used to encapsulate the data depends on the format specified in the Accept header for this request.

Response Sample


{
  "events": [
    {
      "sourceIP": "1.1.1.1",
      "destinationIP": "127.0.0.1",
      "qid": 1004
    },
    {
      "sourceIP": "1.1.1.1",
      "destinationIP": "127.0.0.1",
      "qid": 1005
    }
  ]
}