Search around an event

{
  "pointer": {
    "ts": 1700000000000000,
    "fingerprint": null
  },
  "before": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1700000000000000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  },
  "after": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1700000000500000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  }
}

{
  "pointer": {
    "ts": 1700000000000000,
    "fingerprint": null
  },
  "before": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1700000000000000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  },
  "after": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1700000000500000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  }
}

POST /api/v1/query/search_around

Returns the events immediately before and after a pointer within a ±24-hour search window. Counts default to 50 and are clamped to 1–1000. The operation requires streams.query; system telemetry access may use sys.telemetry.read. Body

Field	Type	Required	Default
`event_timestamp_us`	integer	✅	—
`stream`	string	✅	—
`stream_type`	string	✅	—
`event_fingerprint`	string	—	—
`before`	integer	—	50
`after`	integer	—	50

{
  "pointer": {
    "ts": 1700000000000000,
    "fingerprint": null
  },
  "before": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1700000000000000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  },
  "after": {
    "columns": ["_timestamp", "msg"],
    "rows": [[1700000000500000, "..."]],
    "scanned_rows": 100,
    "took_ms": 4
  }
}

Last modified on July 29, 2026

Overview

Authentication

Intake

Query

APM

Streams

Alerting

Correlation & Web

Platform & Administration