logs
Search a profile's DNS query history to see what a device looked up or why a domain was blocked earlier. Returns one line per query with time, status, domain, device, and block reason.
Instructions
Search a profile's query log: single DNS queries, newest first, one line each with time (UTC), status, domain, device and block reason. Use it to see what a device looked up or why something was blocked earlier; use watch_logs for queries happening now, analytics for totals and check_domain to test one domain. Changes nothing. Returns a cursor line when there is more, or a private link to download the whole log with download_link; empty when logs are off for the profile.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | true: every query. false (default): only the useful ones (A, AAAA and HTTPS, without repeats). | |
| limit | No | How many queries, 10 to 1000. | |
| cursor | No | The cursor from the last answer, to get the next page. | |
| device | No | Only this device: a device ID from the devices report, or __UNIDENTIFIED__. | |
| search | No | Part of a domain to look for: facebook matches facebook.com, fbcdn.net and others. | |
| status | No | Only queries with this result: blocked, allowed, default or error. | |
| profile | No | The profile's ID or name. Leave empty for the only profile, or the default one. | |
| to_date | No | Where to stop, not included: an ISO date, Unix time or relative like -1h. Empty means now. | |
| from_date | No | Where to start, included: an ISO date, Unix time or relative like -6h, -7d or -1M. | |
| oldest_first | No | true: oldest first instead of newest first. | |
| download_link | No | true: give a link to download the whole log instead of showing it. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |