client_idThe client id to extractstring
flow_idA flow ID (client or server artifacts)string
hunt_idRetrieve sources from this hunt (combines all results from all clients)string
artifactThe name of the artifact collection to fetchstring
sourceAn optional named source within the artifactstring
start_timeStart return events from this date (for event sources)Any
end_timeStop end events reach this time (event sources).Any
notebook_idThe notebook to read from (should also include cell id)string
notebook_cell_idThe notebook cell read from (should also include notebook id)string
notebook_cell_tableA notebook cell can have multiple tables.)int64
start_rowStart reading the result set from this rowint64
countMaximum number of clients to fetch (default unlimited)'int64


Extract monitoring log from a client. If client_id is not specified we watch the global journal which contains event logs from all clients.