Before
An analyst submitted the search, returned later to inspect its job status, and copied the available host results into the coverage review. Empty or incomplete results required additional checking to determine whether hosts were silent or the search had not finished.
How it works
- Receive a coverage search request and start it as an asynchronous job.
- Wait ten seconds, then check the job status and retrieve up to 10,000 available result rows.
- Return the status, job details, and results so the coverage workflow can identify genuine logging gaps separately from inconclusive searches.
Workflow details
- Request handling: A calling coverage flow supplies a search query covering recent log activity across hosts and log types.
- Search execution: The workflow starts the search as an asynchronous job and waits ten seconds for processing to progress.
- Status validation: It reads whether the job is done, still running, failed, or canceled, preserving an unknown status when the search service does not respond.
- Evidence retrieval: The workflow retrieves available search results, with capacity for up to 10,000 rows, so host reporting evidence can be passed to the coverage review.
- Operational handoff: It combines the job details, status, and results into a structured response, allowing the caller to distinguish silent hosts from an unfinished or failed search.
What changed
The search status and available evidence are returned automatically after the fixed wait, including explicit running, failed, canceled, or unknown states. The coverage workflow can now decide whether a host is silent or whether the search itself remains inconclusive without requiring a separate analyst handoff.
Work removed
Submitting the recurring search, revisiting the search job to check its status, retrieving the available host results, and copying those results into the coverage review.
Expected outcome
Each coverage check removes at least three recurring analyst actions—submission, status review, and result copying—while providing a clearer basis for investigating hosts with genuinely overdue logs.
