stack kb security-osquery-api osquery-get-scheduled-query-results cli command

elastic stack kb security-osquery-api osquery-get-scheduled-query-results \
  --schedule-id <schedule-id> \
  --execution-count <execution-count> \
  [options]
		

Get scheduled query results

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--schedule-id string required

The schedule ID of the scheduled query.

--execution-count string required

The execution count for this scheduled query run.

--kuery string

The kuery to filter the results by.

--page number

The page number to return. The default is 1.

--page-size number

The number of results to return per page. The default is 20.

--sort string

The field that is used to sort the results.

--sort-order enum

Specifies the sort order.

Values: asc, desc

--start-date string

The start date filter (ISO 8601) to narrow down results.

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--json

output as JSON