Skip to content

get_query_results

get_query_results(
    query_id: UUID,
    *,
    config_overrides: Optional[CloudTrailClientConfig] = None,
    event_data_store: Optional[EventDataStoreArn] = None,
    next_token: Optional[PaginationToken] = None,
    max_query_results: Optional[MaxQueryResults] = None,
    event_data_store_owner_account_id: Optional[AccountId] = None,
) -> GetQueryResultsResponse

CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see CloudTrail Lake availability change.

Gets event data results of a query. You must specify the QueryID value returned by the StartQuery operation.

Parameters:

  • event_data_store (Optional[EventDataStoreArn], default: None ) –

    The ARN (or ID suffix of the ARN) of the event data store against which the query was run.

  • query_id (UUID) –

    The ID of the query for which you want to get results.

  • next_token (Optional[PaginationToken], default: None ) –

    A token you can use to get the next page of query results.

  • max_query_results (Optional[MaxQueryResults], default: None ) –

    The maximum number of query results to display on a single page.

  • event_data_store_owner_account_id (Optional[AccountId], default: None ) –

    The account ID of the event data store owner.

Raises:

Source code in docs_src/capo_cloudtrail/_services/cloud_trail.py
def get_query_results(
    self,
    query_id: "capo_cloudtrail.types.uuid.UUID",
    *,
    config_overrides: Optional[CloudTrailClientConfig] = None,
    event_data_store: Optional[
        "capo_cloudtrail.types.event_data_store_arn.EventDataStoreArn"
    ] = None,
    next_token: Optional[
        "capo_cloudtrail.types.pagination_token.PaginationToken"
    ] = None,
    max_query_results: Optional[
        "capo_cloudtrail.types.max_query_results.MaxQueryResults"
    ] = None,
    event_data_store_owner_account_id: Optional[
        "capo_cloudtrail.types.account_id.AccountId"
    ] = None,
) -> "capo_cloudtrail.types.get_query_results_response.GetQueryResultsResponse":
    """<important> <p>CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see <a href="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-service-availability-change.html">CloudTrail Lake availability change</a>.</p> </important> <p>Gets event data results of a query. You must specify the <code>QueryID</code> value returned by the <code>StartQuery</code> operation.</p>

    Args:
        event_data_store: <p>The ARN (or ID suffix of the ARN) of the event data store against which the query was run.</p>
        query_id: <p>The ID of the query for which you want to get results.</p>
        next_token: <p>A token you can use to get the next page of query results.</p>
        max_query_results: <p>The maximum number of query results to display on a single page.</p>
        event_data_store_owner_account_id: <p> The account ID of the event data store owner. </p>

    Raises:
        capo_cloudtrail.errors.event_data_store_arn_invalid_exception.EventDataStoreARNInvalidException: <p>The specified event data store ARN is not valid or does not map to an event data store in your account.</p>
        capo_cloudtrail.errors.event_data_store_not_found_exception.EventDataStoreNotFoundException: <p>The specified event data store was not found.</p>
        capo_cloudtrail.errors.inactive_event_data_store_exception.InactiveEventDataStoreException: <p>The event data store is inactive.</p>
        capo_cloudtrail.errors.insufficient_encryption_policy_exception.InsufficientEncryptionPolicyException: <p>For the <code>CreateTrail</code> <code>PutInsightSelectors</code>, <code>UpdateTrail</code>, <code>StartQuery</code>, and <code>StartImport</code> operations, this exception is thrown when the policy on the S3 bucket or KMS key does not have sufficient permissions for the operation.</p> <p>For all other operations, this exception is thrown when the policy for the KMS key does not have sufficient permissions for the operation.</p>
        capo_cloudtrail.errors.invalid_max_results_exception.InvalidMaxResultsException: <p>This exception is thrown if the limit specified is not valid.</p>
        capo_cloudtrail.errors.invalid_next_token_exception.InvalidNextTokenException: <p>A token that is not valid, or a token that was previously used in a request with different parameters. This exception is thrown if the token is not valid.</p>
        capo_cloudtrail.errors.invalid_parameter_exception.InvalidParameterException: <p>The request includes a parameter that is not valid.</p>
        capo_cloudtrail.errors.no_management_account_slr_exists_exception.NoManagementAccountSLRExistsException: <p> This exception is thrown when the management account does not have a service-linked role. </p>
        capo_cloudtrail.errors.operation_not_permitted_exception.OperationNotPermittedException: <p>This exception is thrown when the requested operation is not permitted.</p>
        capo_cloudtrail.errors.query_id_not_found_exception.QueryIdNotFoundException: <p>The query ID does not exist or does not map to a query.</p>
        capo_cloudtrail.errors.unsupported_operation_exception.UnsupportedOperationException: <p>This exception is thrown when the requested operation is not supported.</p>
        capo_cloudtrail.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_cloudtrail.types.get_query_results_request.GetQueryResultsRequest]",
    ) -> OperationResponse[
        "capo_cloudtrail.types.get_query_results_response.GetQueryResultsResponse"
    ]:
        import capo_cloudtrail._operations.cloud_trail_20131101.get_query_results

        output, http_response = (
            capo_cloudtrail._operations.cloud_trail_20131101.get_query_results.get_query_results(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("GetQueryResults")
    )
    input_: capo_cloudtrail.types.get_query_results_request.GetQueryResultsRequest = {
        "query_id": query_id
    }
    if event_data_store is not None:
        input_["event_data_store"] = event_data_store
    if next_token is not None:
        input_["next_token"] = next_token
    if max_query_results is not None:
        input_["max_query_results"] = max_query_results
    if event_data_store_owner_account_id is not None:
        input_["event_data_store_owner_account_id"] = (
            event_data_store_owner_account_id
        )

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output