search_audits
Search sidecar query audits with filters including user, query ID, database, table, and date range. Returns a search UUID for later retrieval of results.
Instructions
Search sidecar query audits with filters.
Triggers an async search and returns a search_uuid (valid 30 days).
Use get_audit_results with the search_uuid to retrieve results.
All filters are combined with AND logic.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results (default 10000, max 100000). | |
| offset | No | Skip this many results. | |
| from_date_time | No | RFC3339 UTC start time (e.g. "2025-01-01T00:00:00Z"). | |
| to_date_time | No | RFC3339 UTC end time. | |
| consuming_user | No | Filter by consuming usernames (case-insensitive). Pass a single string or a list of strings. | |
| consuming_user_email | No | Filter by consuming user emails. Pass a single string or a list of strings. | |
| query_id | No | Filter by specific query IDs. Pass a single string or a list of strings. | |
| sidecar_id | No | Filter by sidecar IDs. Pass a single string or a list of strings. | |
| sidecar_instance_id | No | Filter by sidecar instance IDs. Pass a single string or a list of strings. | |
| table_name | No | Filter by table names. Pass a single string or a list of strings. | |
| schema_name | No | Filter by schema names. Pass a single string or a list of strings. | |
| database_name | No | Filter by database names. Pass a single string or a list of strings. | |
| column_name | No | Filter by column names. Pass a single string or a list of strings. | |
| statement_type | No | Filter by statement types. Pass a single string or a list of strings. | |
| statement_text_contains | No | Case-insensitive substring match on SQL text. | |
| order_by | No | "asc" or "desc" (default "desc"). | |
| sort_by | No | "event_time" or "rows_accessed" (default "event_time"). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||