This documentation includes content for releases that might not be available on-premises. For the latest on-premises Reporting documentation, see the PDF version of Tanium™ Reporting User Guide version 1.20.25.
Reference: API Gateway examples for Reporting
For additional API Gateway example syntax, see Tanium API Gateway User Guide: Reference: Filter syntax and Tanium API Gateway User Guide: Reference: API Gateway examples.
Reporting query filter syntax
Reporting queries support the following filter fields:
- authorNames
- contentSetNames
- createdAfter
- createdBefore
- labels
- moduleNames
- text
For more information on syntax, see reportFieldFilter in the Documentation Explorer pane of the query explorer.
Report author
You can filter reports based on the author name. Define a filter object using the syntax:
{authorNames: [name-1, name-2, name-...n]}
For example, the following request filters and returns only report definitions whose author is either testadmin-1 or testadmin-2:
1
2
3
4
5
6
7
8
9
query getReportsByAuthor ($author1: String!, $author2: String!) {
reports (filter: {authorNames: [$author1, $author2]}) {
edges {
node {
id
}
}
}
}
Include the count and time variables in the QUERY VARIABLES panel or in your variables dictionary:
1
2
3
4
{
"author1": "testadmin-1",
"author2": "testadmin-2"
}
Content set membership
You can filter reports based on the report content set membership. Define a filter object using the syntax:
{contentSetNames: [content-set-name-1, content-set-name-2, content-set-name-...n]}
If you define multiple solutions, a report only needs to match one of the content sets to pass the filter.
For example, the following request filters and returns only report definitions belonging to the Base or Default content sets:
1
2
3
4
5
6
7
8
9
query getReportsByContentSet ($contentSet1: String!, $acontentSet2: String!) {
reports (filter: {contentSetNames: [$contentSet1, $contentSet2]}) {
edges {
node {
id
}
}
}
}
Include the content set variables in the QUERY VARIABLES panel or in your variables dictionary:
1
2
3
4
{
"contentSet1": "Base",
"contentSet2": "Default"
}
Creation time
You can filter reports based on the report creation time, either before or after a specified time. To filter reports created before a specified time, define a filter object using the syntax:
{createdBefore: rfc-3339-time}
For example, the following request filters and returns only report definitions created before 2022-01-01T00:00:00Z:
1
2
3
4
5
6
7
8
9
query getReportsBefore ($timeBefore: Time) {
reports (filter: {createdBefore: $timeBefore}) {
edges {
node {
id
}
}
}
}
Include the timestamp variable in the QUERY VARIABLES panel or in your variables dictionary:
1
2
3
{
"timeBefore": "2022-01-01T00:00:00Z"
}
To filter reports created after a specified time, define a filter object using the syntax:
{createdAfter: rfc-3339-time}
For example, the following request filters and returns only report definitions created after 2022-01-01T00:00:00Z:
1
2
3
4
5
6
7
8
9
query getReportsAfter ($timeAfter: Time) {
reports (filter: {createdAfter: $timeAfter}) {
edges {
node {
id
}
}
}
}
Include the timestamp variable in the QUERY VARIABLES panel or in your variables dictionary:
1
2
3
{
"timeAfter": "2022-01-01T00:00:00Z"
}
Report labels
You can filter reports based on the associated labels. Define a filter object using the syntax:
{labels: [label-1label-1, label-2, label-...n]}
If you define multiple labels, a report only needs to match one of the labels to pass the filter.
For example, the following request filters and returns only report definitions with a label of testlabel-1 or testlabel-2:
1
2
3
4
5
6
7
8
9
query getReportsByLabel ($label1: String!, $label2: String!) {
reports (filter: {labels: [$label1, $label2]}) {
edges {
node {
id
}
}
}
}
Include the label variables in the QUERY VARIABLES panel or in your variables dictionary:
1
2
3
4
{
"label1": "testlabel-1",
"label2": "testlabel-2"
}
Associated Tanium solution
You can filter reports based on the associated Tanium solution. Define a filter object using the syntax:
{moduleNames: [solution-1, solution-2, solution-...n]}
If you define multiple solutions, a report only needs to match one of the solutions to pass the filter.
For example, the following request filters and returns only report definitions associated with Tanium Interact or Tanium Trends:
1
2
3
4
5
6
7
8
9
query getReportsBySolution ($solution1: String!, $solution2: String!) {
reports (filter: {moduleNames: [$solution1, $solution2]}) {
edges {
node {
id
}
}
}
}
Include the solution name variables in the QUERY VARIABLES panel or in your variables dictionary:
1
2
3
4
{
"solution1": "Tanium Interact",
"solution2": "Tanium Trends"
}
Name or description text
You can filter reports based on text in the report name or report description. . Define a filter object using the syntax:
{text: text-string}
For example, the following request filters and returns only report definitions that have test-string either in the name or the definition:
1
2
3
4
5
6
7
8
9
query getReportsByText ($text: String) {
reports (filter: {text: $text}) {
edges {
node {
id
}
}
}
}
Include the text variable in the QUERY VARIABLES panel or in your variables dictionary:
1
2
3
{
"text": "test-string"
}
Reporting examples
The following queries and mutation require Reporting and retrieve reports or report results, export report definitions, and import report definitions.
Get a report (query.report)
Get a report by ID
The following query retrieves the report that matches the referenced ID.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
query getReportByID ($id: ID!) {
report(ref: {id: $id}) {
id
author {
user {
id
}
persona {
id
}
}
contentSet {
id
}
createdTime
description
favorite
labels
lastModifiedBy {
user {
id
}
persona {
id
}
}
modifiedTime
moduleName
name
viewDetails {
columns {
name
}
}
}
}
Include the report ID variable in the QUERY VARIABLES panel or in your variables dictionary.
1
2
3
{
"id": "12345678-90ab-cdef-1234-567890abcdef"
}
Example response:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
"data": {
"report": {
"id": "12345678-90ab-cdef-1234-567890abcdef",
"author": {
"user": {
"id": "1"
},
"persona": {
"id": "0"
}
},
"contentSet": {
"id": "21"
},
"createdTime": "2022-01-01T05:33:35.838686969Z",
"description": "",
"favorite": false,
"labels": null,
"lastModifiedBy": {
"user": {
"id": "1"
},
"persona": {
"id": "0"
}
},
"modifiedTime": "2022-06-01T05:33:35.838686969Z",
"moduleName": null,
"name": "Example report",
"viewDetails": {
"columns": [
{
"name": "Example report column"
}
]
}
}
}
}
Get multiple reports (query.reports)
Get reports
The following query retrieves the first 2 reports.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
query getReports($first: Int) {
reports(first: $first) {
edges {
node {
id
author {
user {
id
}
persona {
id
}
}
contentSet {
id
}
createdTime
description
favorite
labels
lastModifiedBy {
user {
id
}
persona {
id
}
}
modifiedTime
moduleName
name
}
}
}
}
Include the pagination variable in the QUERY VARIABLES panel or in your variables dictionary.
1
2
3
{
"first": 2
}
Example response:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
{
"data": {
"reports": {
"edges": [
{
"node": {
"id": "12345678-90ab-cdef-1234-567890abcdef",
"author": {
"user": {
"id": "1"
},
"persona": {
"id": "0"
}
},
"contentSet": {
"id": "21"
},
"createdTime": "2022-01-01T05:33:35.838686969Z",
"description": "Example description",
"favorite": false,
"labels": null,
"lastModifiedBy": {
"user": {
"id": "1"
},
"persona": {
"id": "0"
}
},
"modifiedTime": "2022-03-17T05:33:35.838686969Z",
"moduleName": null,
"name": "Example report"
}
},
{
"node": {
"id": "abcdef12-3456-7890-abcd-ef1234567890",
"author": {
"user": {
"id": "2"
},
"persona": {
"id": "1"
}
},
"contentSet": {
"id": "123"
},
"createdTime": "2022-01-01T19:58:08.175603337Z",
"description": "Example report 2",
"favorite": false,
"labels": null,
"lastModifiedBy": {
"user": {
"id": "3"
},
"persona": {
"id": "0"
}
},
"modifiedTime": "2022-06-01T19:58:08.175603337Z",
"moduleName": null,
"name": "Example report 2"
}
}
]
}
}
}
Get report result data (query.reportResultData)
Get report results by report ID
The following query retrieves column values for the first 2 report results. The query also retrieves report definition details, including report column name, sourceName, and sourceColumnName.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
query getReportResultData($id: ID!, $first: Int) {
reportResultData(id: $id, first: $first) {
edges {
node {
columns {
values
}
}
}
viewDetails {
columns {
name
sourceName
sourceColumnName
}
}
}
}
Include the pagination variable in the QUERY VARIABLES panel or in your variables dictionary.
1
2
3
4
{
"id": "12345678-90ab-cdef-1234-567890abcdef",
"first": 2
}
Example response:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
{
"data": {
"reportResultData": {
"edges": [
{
"node": {
"columns": [
{
"values": [
"Example computer 1"
]
},
{
"values": [
"2001:DB8::1234",
"192.0.2.10"
]
}
]
}
},
{
"node": {
"columns": [
{
"values": [
"Example computer 2"
]
},
{
"values": [
"2001:DB8::1234",
"192.0.2.20"
]
}
]
}
}
],
"viewDetails": {
"columns": [
{
"name": "Computer Name",
"sourceName": "Computer Name",
"sourceColumnName": "Computer Name"
},
{
"name": "IP Address",
"sourceName": "IP Address",
"sourceColumnName": "IP Address"
}
]
}
}
}
}
Get refreshed report result data (query.reportResultData.collectionInfo.startCursor, query.reportResultData (refresh))
Retrieve report results collection start cursor
The following query retrieves report details that are slow to respond, with collectionInfo.startCursor included in the response to use for refreshing the request. For more information on refreshing a collection, see Refreshing Collections.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
query getReportResultCursor ($id: ID!, $first: Int){
reportResultData(id: $id, first: $first) {
edges {
node {
columns {
values
}
}
}
collectionInfo {
active
startCursor
}
}
}
Include the pagination and report ID variables in the QUERY VARIABLES panel or in your variables dictionary.
1
2
3
4
{
"id": "12345678-90ab-cdef-1234-567890abcdef",
"first": 2
}
Example response for an ongoing collection with a startCursor value:
1
2
3
4
5
6
7
8
9
10
11
{
"data": {
"reportResultData": {
"edges": [],
"collectionInfo": {
"active": true,
"startCursor": "4t2cB0ZGNPqy4J4P7O7opwz/24/5zgPi6OinDAA=:0"
}
}
}
}
Refresh report results collection using starting cursor
The following query refreshes the collection using the returned startCursor value:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
query refreshReportResultCursor($id: ID!, $first: Int, $refresh: Cursor) {
reportResultData(id: $id, first: $first, refresh: $refresh) {
edges {
node {
columns {
values
}
}
}
collectionInfo {
active
startCursor
}
}
}
Include the pagination and report ID variables in the QUERY VARIABLES panel or in your variables dictionary:
1
2
3
4
5
{
"id": "12345678-90ab-cdef-1234-567890abcdef",
"first": 2,
"refresh": "4t2cB0ZGNPqy4J4P7O7opwz/24/5zgPi6OinDAA=:0"
}
Example response with a completed collection:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
{
"data": {
"reportResultData": {
"edges": [
{
"node": {
"columns": [
{
"values": [
"Example computer 1"
]
},
{
"values": [
"2001:DB8::1234",
"192.0.2.10"
]
}
]
}
},
{
"node": {
"columns": [
{
"values": [
"Example computer 2"
]
},
{
"values": [
"2001:DB8::1234",
"192.0.2.20"
]
}
]
}
}
],
"collectionInfo": {
"active": false,
"startCursor": null
}
}
}
}
Export report definition (query.reportExport)
Export a report by ID
The following query exports the report definition that matches the referenced ID. You can import this definition using the importReport mutation.
1
2
3
4
5
query exportReportDefinition ($id: ID!) {
reportExport (ref: {id: $id}) {
reportDefinition
}
}
Include the report ID variable in the QUERY VARIABLES panel or in your variables dictionary.
1
2
3
{
"id": "12345678-90ab-cdef-1234-567890abcdef"
}
Example response:
1
2
3
4
5
6
7
{
"data": {
"reportExport": {
"reportDefinition": "{\"id\":\"12345678-90ab-cdef-1234-567890abcdef\", \"displayName\":\"Example Report\", \"description\":\"Example API Gateway Reporting functionality\", \"contentSet\":{\"name\":\"Reporting\"}, \"sourceView\":{\"id\":\"source data\", \"querySpec\":{\"hasChanged\":true, \"sources\":{\"Computer Name\":{\"id\":\"Computer Name\", \"sensor\":{\"sensorName\":\"Computer Name\", \"flatten\":true}}, \"IP Address\":{\"id\":\"IP Address\", \"sensor\":{\"sensorName\":\"IP Address\", \"flatten\":false}}}, \"selects\":[{\"id\":\"1\", \"sourceColumn\":{\"sourceId\":\"Computer Name\", \"columnName\":\"Computer Name\"}, \"displayName\":\"Computer Name\", \"display\":{}}, {\"id\":\"2\", \"sourceColumn\":{\"sourceId\":\"IP Address\", \"columnName\":\"IP Address\"}, \"displayName\":\"IP Address\", \"display\":{}}]}, \"summary\":{\"countId\":\"summary_count_id\", \"displayName\":\"Count\"}}, \"display\":{\"advanced_filters_enabled\":true, \"available_additional_filters\":[], \"available_quick_filters\":[\"quick:base:computerGroup\", \"quick:base:endpointLastSeen\", \"quick:base:os\"], \"version\":1}, \"categories\":[{\"name\":\"Test\"}], \"meta\":{\"class\":\"USER\", \"type\":\"V2\"}}"
}
}
}
Import report definition (mutation.reportImport)
Import a report definition
The following query imports a report definition that you exported using the reportExport query.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
mutation importReportDefinition($allowDuplicate: Boolean!, $reportDefinition: String!) {
reportImport(
input: {allowDuplicate: $allowDuplicate, reportDefinition: $reportDefinition}
) {
report {
id
}
error {
message
retryable
timedOut
}
}
}
Include the report ID variable in the QUERY VARIABLES panel or in your variables dictionary.
1
2
3
4
{
"allowDuplicate": false,
"reportDefinition": "{\"id\":\"12345678-90ab-cdef-1234-567890abcdef\", \"displayName\":\"Example report import\", \"description\":\"Example import functionality\", \"contentSet\":{\"name\":\"Reporting\"}, \"sourceView\":{\"id\":\"source data\", \"querySpec\":{\"hasChanged\":true, \"sources\":{\"Computer Name\":{\"id\":\"Computer Name\", \"sensor\":{\"sensorName\":\"Computer Name\", \"flatten\":true}}, \"IP Address\":{\"id\":\"IP Address\", \"sensor\":{\"sensorName\":\"IP Address\", \"flatten\":false}}}, \"selects\":[{\"id\":\"1\", \"sourceColumn\":{\"sourceId\":\"Computer Name\", \"columnName\":\"Computer Name\"}, \"displayName\":\"Computer Name\", \"display\":{}}, {\"id\":\"2\", \"sourceColumn\":{\"sourceId\":\"IP Address\", \"columnName\":\"IP Address\"}, \"displayName\":\"IP Address\", \"display\":{}}]}, \"summary\":{\"countId\":\"summary_count_id\", \"displayName\":\"Count\"}}, \"display\":{\"advanced_filters_enabled\":true, \"available_additional_filters\":[], \"available_quick_filters\":[\"quick:base:computerGroup\", \"quick:base:endpointLastSeen\", \"quick:base:os\"], \"version\":1}, \"categories\":[{\"name\":\"Test\"}], \"meta\":{\"class\":\"USER\", \"type\":\"V2\"}}"
}
Example response:
1
2
3
4
5
6
7
8
9
10
{
"data": {
"reportImport": {
"report": {
"id": "abcdef12-3456-7890-abcd-ef1234567890"
},
"error": null
}
}
}
Last updated: 5/30/2023 4:01 PM | Feedback