Find Dashboards saved objects
malcolm_saved_objectsSearch Malcolm's built-in dashboards, visualizations, and saved searches to discover existing analysis before writing queries from scratch.
Instructions
Find the dashboards, visualizations and saved searches this Malcolm ships.
Use this to discover what pre-built analysis already exists before
building a query by hand — Malcolm ships over a hundred dashboards, and
one of them usually already covers the protocol you are looking at. This
is catalogue metadata only: for the query behind a saved search or
visualization take its `id` to malcolm_saved_object_detail, and for how
a DASHBOARD is built take its `id` to malcolm_dashboard_export — that
endpoint resolves ids as dashboards only, and answers 200 with an
embedded 404 for a visualization or saved-search id.
This searches the Dashboards catalogue, NOT network traffic: for traffic
use malcolm_search, and for the field names behind a visualization use
malcolm_field_search.
Returns JSON {"total", "showing", "objects"}; field names are in the
output schema, which also records why the panel layout is absent.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max objects to return. | |
| search | No | Match against the object TITLE only, e.g. "DNS", "Zeek*". Wildcards work. Empty = every object of the type. | |
| object_type | No | Which saved-object types to search, comma-separated: dashboard, visualization, search, index-pattern. E.g. "dashboard"; "dashboard,search". Values are trimmed and matched case-insensitively, so "Dashboard, Search" works; anything outside the four is refused with the list of what is allowed. | dashboard |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |