Search Object

[k2niner]

Part 2 of the Web Resource Object / Activity: Create a search object. This is intended to capture the details of a search operation if the activity = search.

{
  "caption": "Search/Query Information",
  "description": "This object provides details related to a search or query activity/event.",
  "extends": "object",
  "name": "search",
  "attributes": {
    "search_type": {
        "description": "The search type, normalized to the caption of the search_type_id value. In the case of 'Other', it is defined by the event source",
        "requirement": "optional"
      },
    "search_type_id": {
      "description": "The search type indentifier",
      "requirement": "mandatory",
      "enum": {
        "1": {
          "caption": "simple"
        },
        "2": {
          "caption": "faceted"
        },
        "3": {
          "caption": "dynamic"
        },
        "4": {
          "caption": "complex"
        },
        "5": {
          "caption": "scheduled"
          },
        "6": {
          "caption": "automated"
      }
    }
  },
    "search_term": {
        "description": "The string that was searched.",
        "requirement": "optional"
      },
    "search_details": {
        "description": "Search details for faceted or complex search functions.",
        "requirement": "optional"
    },
    "search_result_number": {
      "description": "Number of search results matching the search.",
      "requirement": "optional"
    },
    "search_result": {
        "description": "Results of the search presented to user.",
        "requirement": "optional"
    }
  }
} 

Might a search object be more broadly applicable? System:Search?

[pagbabian-splunk]

My only comment in support is that the enum, search_type_id, will need an Unknown and Other value per standard enums and the description for search_type above.