Cisco Catalyst SD-WAN

Cisco Catalyst SD-WAN Monitoring - Security Unified Logging Connection Events API

The Monitoring - Security Unified Logging Connection Events API from Cisco Catalyst SD-WAN — 9 operation(s) for monitoring - security unified logging connection events.

Documentation GitHub OpenAPI

Operations 13

GET /statistics/sul/connections #

POST /statistics/sul/connections #

GET /statistics/sul/connections/aggregation #

POST /statistics/sul/connections/aggregation #

POST /statistics/sul/connections/app-agg/aggregation #

GET /statistics/sul/connections/csv #

GET /statistics/sul/connections/doccount #

POST /statistics/sul/connections/doccount #

GET /statistics/sul/connections/fields #

GET /statistics/sul/connections/filter/policy_name/{policyType} #

GET /statistics/sul/connections/page #

POST /statistics/sul/connections/page #

GET /statistics/sul/connections/query/fields #

Documentation

📖

Documentation

https://developer.cisco.com/docs/sdwan/administration-and-setting/

📖

APIReference

https://developer.cisco.com/docs/sdwan/administration-and-setting/

📖

Documentation

https://developer.cisco.com/docs/sdwan/ux-1-0-configuration/

📖

APIReference

https://developer.cisco.com/docs/sdwan/ux-1-0-configuration/

📖

Documentation

https://developer.cisco.com/docs/sdwan/ux-2-0-configuration/

📖

APIReference

https://developer.cisco.com/docs/sdwan/ux-2-0-configuration/

📖

Documentation

https://developer.cisco.com/docs/sdwan/feature-profiles-sd-wan-system/

📖

APIReference

https://developer.cisco.com/docs/sdwan/feature-profiles-sd-wan-system/

📖

Documentation

https://developer.cisco.com/docs/sdwan/feature-profiles-sd-wan-transport/

📖

APIReference

https://developer.cisco.com/docs/sdwan/feature-profiles-sd-wan-transport/

📖

Documentation

https://developer.cisco.com/docs/sdwan/feature-profiles-sd-wan-service/

📖

APIReference

https://developer.cisco.com/docs/sdwan/feature-profiles-sd-wan-service/

📖

Documentation

https://developer.cisco.com/docs/sdwan/feature-profiles-others/

📖

APIReference

https://developer.cisco.com/docs/sdwan/feature-profiles-others/

📖

Documentation

https://developer.cisco.com/docs/sdwan/feature-profiles-sd-routing/

📖

APIReference

https://developer.cisco.com/docs/sdwan/feature-profiles-sd-routing/

📖

Documentation

https://developer.cisco.com/docs/sdwan/feature-profiles-mobility-and-nfv/

📖

APIReference

https://developer.cisco.com/docs/sdwan/feature-profiles-mobility-and-nfv/

📖

Documentation

https://developer.cisco.com/docs/sdwan/monitoring-and-troubleshooting/

📖

APIReference

https://developer.cisco.com/docs/sdwan/monitoring-and-troubleshooting/

📖

Documentation

https://developer.cisco.com/docs/sdwan/sd-wan-services/

📖

APIReference

https://developer.cisco.com/docs/sdwan/sd-wan-services/

📖

Documentation

https://developer.cisco.com/docs/sdwan/partner-integrations/

📖

APIReference

https://developer.cisco.com/docs/sdwan/partner-integrations/

📖

Documentation

https://developer.cisco.com/docs/sdwan/others/

📖

APIReference

https://developer.cisco.com/docs/sdwan/others/

Specifications

⚙

OpenAPI

https://raw.githubusercontent.com/api-evangelist/cisco-catalyst-sdwan/refs/heads/main/openapi/cisco-catalyst-sdwan-monitoring-security-unified-logging-connection-events-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/cisco-catalyst-sdwan-monitoring-security-unified-logging-connection-events-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Monitoring and Troubleshooting Monitoring - Security Unified Logging Connection Events API
  description: "Includes API operations for the following:\n  Real-time monitoring\n  Accessing statistics APIs and statistics bulk APIs\n  Retrieving device state\n  Managing alarms and events"
  contact:
    email: vmanage@cisco.com
  license:
    name: Commercial License
    url: https://www.cisco.com/c/en/us/solutions/enterprise-networks/sd-wan/index.html
  version: 26.1.0+2026-01-06
  x-provenance:
    method: harvested
    authored_by: Cisco Catalyst SD-WAN
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    provider_published: true
    source_host: pubhub.devnetcloud.com
    note: 4,138 operations across 2,841 paths, published by Cisco as self-contained per-operation OpenAPI 3.1.0 fragments on the DevNet CDN and consolidated here into 13 documents. Ownership verified from info.contact vmanage@cisco.com and the Cisco license URL rather than from the fetch host.
  x-evidence:
  - type: source
    url: https://pubhub.devnetcloud.com/media/cisco-catalyst-sd-wan-26-1-api-guide/docs/
  - type: source
    url: https://developer.cisco.com/docs/sdwan/
servers:
- url: /dataservice
tags:
- name: Monitoring - Security Unified Logging Connection Events
paths:
  /statistics/sul/connections:
    get:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get security connection events stats raw data
      operationId: getSulStatDataRawData
      parameters:
      - name: query
        in: query
        description: Query string
        schema:
          type: string
        example:
          query:
            condition: AND
            rules:
            - value:
              - '24'
              field: entry_time
              type: date
              operator: last_n_hours
            - value:
              - 172.16.255.15
              field: vdevice_name
              type: string
              operator: in
      - name: page
        in: query
        description: page number
        schema:
          minimum: 1
          type: integer
          format: int64
      - name: pageSize
        in: query
        description: page size
        schema:
          minimum: 1
          type: integer
          format: int64
      - name: sortBy
        in: query
        description: sort by
        schema:
          pattern: ^[a-zA-Z-_]+$
          type: string
      - name: sortOrder
        in: query
        description: sort order
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Search result:
                  description: Search result
                  value:
                    data:
                    - ip_proto: 6
                      device_model: vedge-CSR-1000v
                      egress_intf: cpu
                      packets: 5
                      src_ip: 10.20.24.1
                      fw_zone_pair: ulogging_in2out
                      statcycletime: 1616121001459
                      octets: 300
                      sdvt_drop_reason_name: Service Node not healthy
                      tenant: default
                      dest_port: 80
                      entry_time: 1616120034778
                      create_time: 1616120009235
                      fw_dst_zone: ulogging_z_out
                      end_time: 1616120024267
                      fw_action: Pass
                      vmanage_system_ip: 172.16.255.15
                      fw_src_zone: ulogging_z_in
                      fw_policy: p1
                      src_port: 34128
                      start_time: 1616120009235
                      application: unknown
                      fw_protocol: http
                      ingress_intf: GigabitEthernet5
                      fw_class: '1'
                      vdevice_name: 172.16.255.15
                      dest_ip: 103.235.46.39
                      vip_idx: 1
                      family: network-service
                      host_name: vm5
                      vpn_id: 1
                      id: _dlRSHgBQcANHsKKdbP0
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Device Monitoring-read
    post:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get stats raw data
      operationId: getStatsRawData_MonitoringSecurityUnifiedLoggingConnectionEvents_2704
      parameters:
      - name: page
        in: query
        description: page number
        schema:
          minimum: 1
          type: integer
          format: int64
      - name: pageSize
        in: query
        description: page size
        schema:
          minimum: 1
          type: integer
          format: int64
      - name: sortBy
        in: query
        description: sort by
        schema:
          pattern: ^[a-zA-Z-_]+$
          type: string
      - name: sortOrder
        in: query
        description: sort order
        schema:
          type: string
      requestBody:
        description: Stats query string
        content:
          application/json:
            schema:
              type: object
            examples:
              Stats query string:
                description: Stats query string
                value:
                  query:
                    condition: AND
                    rules:
                    - value:
                      - '24'
                      field: entry_time
                      type: date
                      operator: last_n_hours
                    - value:
                      - 172.16.255.15
                      field: vdevice_name
                      type: string
                      operator: in
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Search result:
                  description: Search result
                  value:
                    data:
                    - ip_proto: 6
                      device_model: vedge-CSR-1000v
                      egress_intf: cpu
                      packets: 5
                      src_ip: 10.20.24.1
                      fw_zone_pair: ulogging_in2out
                      statcycletime: 1616121001459
                      octets: 300
                      sdvt_drop_reason_name: Service Node not healthy
                      tenant: default
                      dest_port: 80
                      entry_time: 1616120034778
                      create_time: 1616120009235
                      fw_dst_zone: ulogging_z_out
                      end_time: 1616120024267
                      fw_action: Pass
                      vmanage_system_ip: 172.16.255.15
                      fw_src_zone: ulogging_z_in
                      fw_policy: p1
                      src_port: 34128
                      start_time: 1616120009235
                      application: unknown
                      fw_protocol: http
                      ingress_intf: GigabitEthernet5
                      fw_class: '1'
                      vdevice_name: 172.16.255.15
                      dest_ip: 103.235.46.39
                      vip_idx: 1
                      family: network-service
                      host_name: vm5
                      vpn_id: 1
                      id: _dlRSHgBQcANHsKKdbP0
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Device Monitoring-read
  /statistics/sul/connections/aggregation:
    get:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get aggregated data based on input query and filters. The data can be filtered on time and other unique parameters based upon necessity and intended usage
      operationId: getAggregationDataByQuery_MonitoringSecurityUnifiedLoggingConnectionEvents_3903
      parameters:
      - name: query
        in: query
        description: Query filter
        schema:
          type: string
        example:
          query:
            condition: AND
            rules:
            - value:
              - '24'
              field: entry_time
              type: date
              operator: last_n_hours
            - value:
              - 172.16.255.15
              field: vdevice_name
              type: string
              operator: in
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Aggregated each result:
                  description: Aggregated each result
                  value:
                    data:
                    - latency: 0.6404125644631974
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Device Monitoring-read
    post:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get aggregated data based on input query and filters. The data can be filtered on time and other unique parameters based upon necessity and intended usage
      operationId: getPostAggregationDataByQuery_MonitoringSecurityUnifiedLoggingConnectionEvents_3904
      requestBody:
        description: Stats query string
        content:
          application/json:
            schema:
              type: object
            examples:
              Stats query string:
                description: Stats query string
                value:
                  query:
                    condition: AND
                    rules:
                    - value:
                      - '24'
                      field: entry_time
                      type: date
                      operator: last_n_hours
                    - value:
                      - 172.16.255.15
                      field: vdevice_name
                      type: string
                      operator: in
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Aggregated search result:
                  description: Aggregated search result
                  value:
                    data:
                    - ip_proto: 6
                      device_model: vedge-CSR-1000v
                      egress_intf: cpu
                      packets: 5
                      src_ip: 10.20.24.1
                      statcycletime: 1616170802027
                      octets: 300
                      sdvt_drop_reason_name: Service Node not healthy
                      tenant: default
                      dest_port: 80
                      entry_time: 1616170026992
                      create_time: 1616170001492
                      end_time: 1616170016505
                      fw_action: Pass
                      vmanage_system_ip: 172.16.255.15
                      fw_policy: p1
                      src_port: 53105
                      start_time: 1616170001492
                      application: unknown
                      fw_protocol: http
                      ingress_intf: GigabitEthernet5
                      fw_class: '1'
                      vdevice_name: 172.16.255.15
                      dest_ip: 90.130.70.73
                      vip_idx: 1
                      family: network-service
                      host_name: vm5
                      vpn_id: 1
                      id: uNlJS3gBQcANHsKKW_5s
                    pageInfo:
                      startTime: '1615956601540'
                      endTime: '1616170802027'
                      scrollId: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAQXMWSm81WWtQX1NUeXU4UnpKYm9VV2Nudw==_500
                      hasMoreData: false
                      count: 14
                      totalCount: 14
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Device Monitoring-read,dca
  /statistics/sul/connections/app-agg/aggregation:
    post:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get aggregated data based on input query and filters. The data can be filtered on time and other unique parameters based upon necessity and intended usage
      operationId: getPostAggregationAppDataByQuery_MonitoringSecurityUnifiedLoggingConnectionEvents_4704
      requestBody:
        description: Stats query string
        content:
          application/json:
            schema:
              type: object
            examples:
              Stats query string:
                description: Stats query string
                value:
                  query:
                    field: latency
                    type: long
                    value:
                    - '1'
                    operator: greater
                  fields:
                  - latency
                  aggregation:
                    metrics:
                    - property: latency
                      type: avg
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Aggregated search result:
                  description: Aggregated search result
                  value:
                    data:
                    - latency: 0.6404125644631974
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Device Monitoring-read,dca
  /statistics/sul/connections/csv:
    get:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get raw data with optional query as CSV
      operationId: getStatDataRawDataAsCSV_MonitoringSecurityUnifiedLoggingConnectionEvents_3103
      parameters:
      - name: query
        in: query
        description: Query string
        schema:
          type: string
        example:
          query:
            condition: AND
            rules:
            - value:
              - '168'
              field: entry_time
              type: date
              operator: last_n_hours
            - value:
              - '1'
              field: vpn_id
              type: int
              operator: in
            - value:
              - p1
              field: fw_policy
              type: string
              operator: in
            - value:
              - 172.16.255.15
              field: vdevice_name
              type: string
              operator: in
      responses:
        '200':
          description: Success
          content:
            text/csv:
              schema:
                type: string
              examples:
                Search result in csv format:
                  description: Search result in csv format
                  value: blob:https://<vmanageIP>/82c972bc-f9b3-4cce-bb70-1e1b033ef1cd
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Device Monitoring-read
  /statistics/sul/connections/doccount:
    get:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get response count of a query
      operationId: getCount_MonitoringSecurityUnifiedLoggingConnectionEvents_3603
      parameters:
      - name: query
        in: query
        description: Query
        required: true
        schema:
          type: string
        example:
          query:
            condition: AND
            rules:
            - value:
              - '24'
              field: entry_time
              type: date
              operator: last_n_hours
            - value:
              - 172.16.255.15
              field: vdevice_name
              type: string
              operator: in
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Query result count:
                  description: Query result count
                  value:
                    count: 9642
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
    post:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get response count of a query
      operationId: getCountPost_MonitoringSecurityUnifiedLoggingConnectionEvents_3604
      requestBody:
        description: Query
        content:
          application/json:
            schema:
              type: object
            examples:
              Query:
                description: Query
                value:
                  query:
                    condition: AND
                    rules:
                    - value:
                      - '24'
                      field: entry_time
                      type: date
                      operator: last_n_hours
                    - value:
                      - 172.16.255.15
                      field: vdevice_name
                      type: string
                      operator: in
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Query result count:
                  description: Query result count
                  value:
                    count: 9642
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
  /statistics/sul/connections/fields:
    get:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get fields and type
      operationId: getStatDataFields_MonitoringSecurityUnifiedLoggingConnectionEvents_3403
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              example:
              - dataType: string
                property: mac
              - dataType: string
                property: vap
              - dataType: number
                property: rssi
              - dataType: string
                property: mode
              - dataType: number
                property: bandwidth
              - dataType: string
                property: data_security
              - dataType: number
                property: rx_rate
              - dataType: string
                property: assoc_time
              - dataType: date
                property: entry_time
              - dataType: date
                property: statcycletime
              - dataType: string
                property: ssid
              - dataType: number
                property: vip_idx
              - dataType: date
                property: vip_time
              - dataType: string
                property: vdevice_name
              - dataType: string
                property: host_name
              - dataType: string
                property: device_model
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
  /statistics/sul/connections/filter/policy_name/{policyType}:
    get:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get filter Policy Name list
      operationId: getFilterPolicyNameList
      parameters:
      - name: policyType
        in: path
        description: Policy type
        required: true
        schema:
          type: string
          enum:
          - zoneBasedFW
          - intrusionPrevention
          - urlFiltering
          - advancedMalwareProtection
      - name: query
        in: query
        description: query string
        required: true
        schema:
          type: string
        example:
          query:
            condition: AND
            rules:
            - field: vdevice_name
              type: string
              operator: in
              value:
              - 172.16.255.15
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
              examples:
                Filter Policy Name list:
                  description: Filter Policy Name list
                  value:
                  - fw_policy: FW-Block-AV
                  - fw_policy: FW-Block-p2p
                  - fw_policy: FW_policy1
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
  /statistics/sul/connections/page:
    get:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get stats raw data
      operationId: getStatsPaginationRawData_MonitoringSecurityUnifiedLoggingConnectionEvents_3203
      parameters:
      - name: query
        in: query
        description: Query string
        schema:
          type: string
        example:
          query:
            condition: AND
            rules:
            - value:
              - '24'
              field: entry_time
              type: date
              operator: last_n_hours
      - name: scrollId
        in: query
        description: ES scroll Id
        schema:
          type: string
        example: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAOIWZ1NQbXpvQ29Uc0stNzZ2UzlwTEREUQ==
      - name: count
        in: query
        description: Result size
        schema:
          type: integer
          format: int64
        example: 10
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Search result:
                  description: Search result
                  value:
                    data:
                    - mem_used: 19407626240
                      disk_avail: 9305948160
                      device_model: vmanage
                      mem_cached: 6740430848
                      mem_util: 0.59
                      min1_avg: 0.92
                      disk_used: 5789007872
                      statcycletime: 1647394800045
                      tenant: 57501bad-32a7-4f52-8f54-8547dcd7403e
                      entry_time: 1647393870251
                      runningp: 0
                      cpu_user: 8.63
                      cpu_idle_new: 88.14
                      vip_time: 1647393870252
                      min15_avg: 1.08
                      totalp: 2427
                      cpu_idle: 88.14
                      mem_buffers: 892911616
                      cpu_system: 3.23
                      vmanage_system_ip: 169.254.10.2
                      min5_avg: 1.07
                      cpu_min1_avg: 0.115
                      mem_free: 5716930560
                      vdevice_name: 172.16.255.201
                      vip_idx: 82
                      cpu_min15_avg: 0.135
                      system_ip: 172.16.255.201
                      cpu_user_new: 8.63
                      cpu_system_new: 3.23
                      host_name: vm201
                      cpu_min5_avg: 0.13375
                      id: 4YphkH8BPIGvVbrdtzXi
                    - mem_used: 19534016512
                      disk_avail: 9304268800
                      device_model: vmanage
                      mem_cached: 6747897856
                      mem_util: 0.6
                      min1_avg: 1.14
                      disk_used: 5790687232
                      statcycletime: 1647394800046
                      tenant: 57501bad-32a7-4f52-8f54-8547dcd7403e
                      entry_time: 1647394110479
                      runningp: 0
                      cpu_user: 5.53
                      cpu_idle_new: 91.49
                      vip_time: 1647394110479
                      min15_avg: 1.1
                      totalp: 2323
                      cpu_idle: 91.49
                      mem_buffers: 902213632
                      cpu_system: 2.97
                      vmanage_system_ip: 169.254.10.2
                      min5_avg: 1.14
                      cpu_min1_avg: 0.1425
                      mem_free: 5573771264
                      vdevice_name: 172.16.255.201
                      vip_idx: 86
                      cpu_min15_avg: 0.1375
                      system_ip: 172.16.255.201
                      cpu_user_new: 5.53
                      cpu_system_new: 2.97
                      host_name: vm201
                      cpu_min5_avg: 0.1425
                      id: 5YphkH8BPIGvVbrdtzXi
                    pageInfo:
                      startTime: '1647394800045'
                      endTime: '1647394800047'
                      scrollId: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAf4WcUlydS1uYzlTdXFhR05GTlBpTFJ4QQ==
                      hasMoreData: true
                      count: 2
                      totalCount: 11140
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Device Monitoring-read
    post:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get stats raw data
      operationId: getPostStatsPaginationRawData_MonitoringSecurityUnifiedLoggingConnectionEvents_3204
      parameters:
      - name: scrollId
        in: query
        description: ES scroll Id
        schema:
          type: string
        example: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAOIWZ1NQbXpvQ29Uc0stNzZ2UzlwTEREUQ==
      - name: count
        in: query
        description: Result size
        schema:
          type: integer
          format: int64
        example: 10
      requestBody:
        description: Stats query string
        content:
          application/json:
            schema:
              type: object
            examples:
              Stats query string:
                description: Stats query string
                value:
                  query:
                    condition: AND
                    rules:
                    - value:
                      - '24'
                      field: entry_time
                      type: date
                      operator: last_n_hours
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Search result:
                  description: Search result
                  value:
                    data:
                    - mem_used: 19407626240
                      disk_avail: 9305948160
                      device_model: vmanage
                      mem_cached: 6740430848
                      mem_util: 0.59
                      min1_avg: 0.92
                      disk_used: 5789007872
                      statcycletime: 1647394800045
                      tenant: 57501bad-32a7-4f52-8f54-8547dcd7403e
                      entry_time: 1647393870251
                      runningp: 0
                      cpu_user: 8.63
                      cpu_idle_new: 88.14
                      vip_time: 1647393870252
                      min15_avg: 1.08
                      totalp: 2427
                      cpu_idle: 88.14
                      mem_buffers: 892911616
                      cpu_system: 3.23
                      vmanage_system_ip: 169.254.10.2
                      min5_avg: 1.07
                      cpu_min1_avg: 0.115
                      mem_free: 5716930560
                      vdevice_name: 172.16.255.201
                      vip_idx: 82
                      cpu_min15_avg: 0.135
                      system_ip: 172.16.255.201
                      cpu_user_new: 8.63
                      cpu_system_new: 3.23
                      host_name: vm201
                      cpu_min5_avg: 0.13375
                      id: 4YphkH8BPIGvVbrdtzXi
                    - mem_used: 19534016512
                      disk_avail: 9304268800
                      device_model: vmanage
                      mem_cached: 6747897856
                      mem_util: 0.6
                      min1_avg: 1.14
                      disk_used: 5790687232
                      statcycletime: 1647394800046
                      tenant: 57501bad-32a7-4f52-8f54-8547dcd7403e
                      entry_time: 1647394110479
                      runningp: 0
                      cpu_user: 5.53
                      cpu_idle_new: 91.49
                      vip_time: 1647394110479
                      min15_avg: 1.1
                      totalp: 2323
                      cpu_idle: 91.49
                      mem_buffers: 902213632
                      cpu_system: 2.97
                      vmanage_system_ip: 169.254.10.2
                      min5_avg: 1.14
                      cpu_min1_avg: 0.1425
                      mem_free: 5573771264
                      vdevice_name: 172.16.255.201
                      vip_idx: 86
                      cpu_min15_avg: 0.1375
                      system_ip: 172.16.255.201
                      cpu_user_new: 5.53
                      cpu_system_new: 2.97
                      host_name: vm201
                      cpu_min5_avg: 0.1425
                      id: 5YphkH8BPIGvVbrdtzXi
                    pageInfo:
                      startTime: '1647394800045'
                      endTime: '1647394800047'
                      scrollId: DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAf4WcUlydS1uYzlTdXFhR05GTlBpTFJ4QQ==
                      hasMoreData: true
                      count: 2
                      totalCount: 11140
        '400':
          description: Bad Request
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-roles-required: Device Monitoring-read
  /statistics/sul/connections/query/fields:
    get:
      tags:
      - Monitoring - Security Unified Logging Connection Events
      description: Get query fields
      operationId: getStatQueryFields_MonitoringSecurityUnifiedLoggingConnectionEvents_4003
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
              examples:
                Query result count:
                  description: Query result count
                  value:
                    data:
                    - property: entry_time
                      name: Event Time
                      isRequired: true
                      dataType: date
                      fieldData:
                        type: dateList
                      options:
                      - key: last_1_hour
                        value: Last 1 hour
                        number: '1'
                        enableDateFields: false
                      - key: last_3_hours
                        value: Last 3 hours
                        number: '3'
                        enableDateFields: false
                      - key: last_6_hours
                        value: Last 6 hours
                        number: '6'
                        enableDateFields: false
                      - key: last_12_hours
                        value: Last 12 hours
                        number: '12'
                        enableDateFields: false
                      - key: last_24_hours
                        value: Last 24 hours


# --- truncated at 32 KB (32 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-catalyst-sdwan/refs/heads/main/openapi/cisco-catalyst-sdwan-monitoring-security-unified-logging-connection-events-api-openapi.yml