Hello ​@mwisener ,

Maybe this is just a copy/paste typo but you have an extra “/” in your endpoint URL, right before the “:” after the UUID of your instance. It should be : https://us-chronicle.googleapis.com/v1alpha/projects/<project>/locations/us/instances/<uuid>:searchRawLogs

You can see the expected POST body and the possible values by using the rawlog search in the SecOps UI. Access the UDM search UI and type the query raw = “ASA” for example, then you can inspect the POST query to searchRawLogs using your browser’s dev tools ! Note that the field names can be camelcase in the browser but they work also with snakecase also just like in the API docs.

Regarding your particular issue, the problem is in the value of “baseline_query”, it looks like it should always include raw = , updating the value to raw = /ASA/ should fix :)

Additionnally, after a bit of testing, the UI does not seem to use the “log_type” parameter in the POST request to limit by LogType. It just appends a filter to the baseline_query, using the name of the LogType as it appears in the drop-down list (ex: “Microsoft Powershell” for log_type “POWERSHELL”).
Example :
raw = "http" log_source IN ["Microsoft PowerShell"]

Thanks ​@chrisd2  - I originally had raw = /ASA/ when i had the log-type stuff in there which I’m guessing was also wrong -  then through several permutations of fiddling with params to try to get it to work, it morphed into /ASA/ but with log-type stuff removed! 

So raw = /ASA/ appeared to be my issue for sure. Also doesn’t matter on the / either one works, with or without the / before the :

thanks!