Search Incidents Api error

[neerajtiwar]

Describe the bug
As per the datadog Api docs its mentioned to use the browser query into the query parameter of the Api After entering a search query in your Incidents page , use the query parameter value in the URL of the page as the value for this parameter. which sometimes also contains the from_ts & to_ts fields however when used with these fields the API gives the following error which i think should be working, I want to use these params to only search for incidents within a specific timeframe.

Exception

root@b8ed42750901:/app# python app.py
/usr/local/lib/python3.11/site-packages/datadog_api_client/api_client.py:655: UserWarning: Using unstable operation 'search_incidents'
  warnings.warn("Using unstable operation '{0}'".format(self.settings["operation_id"]))
{"event": " failed to pull data from datadog API due to: Exception=(400)\nReason: Bad Request\nHTTP response headers: HTTPHeaderDict({'Date': 'Thu, 28 Sep 2023 17:49:30 GMT', 'Content-Type': 'application/json', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'x-frame-options': 'SAMEORIGIN', 'content-security-policy': \"frame-ancestors 'self'; report-uri https://logs.browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pube4f163c23bbf91c16b8f57f56af9fc58&dd-evp-origin=content-security-policy&ddsource=csp-report&ddtags=site%3Adatadoghq.com\", 'vary': 'Accept-Encoding', 'content-encoding': 'gzip', 'x-ratelimit-limit': '100', 'x-ratelimit-period': '60', 'x-ratelimit-remaining': '99', 'x-ratelimit-reset': '30', 'x-ratelimit-name': 'incidents_search_incidents', 'x-content-type-options': 'nosniff', 'strict-transport-security': 'max-age=31536000; includeSubDomains; preload'})\nHTTP response body: {'errors': [\"Query should be of form: 'key1:value1 AND (key2:value2 OR key3:value3)'\"]}\n", "level": "error", "timestamp": "2023-09-28T17:49:30.983679Z"}
Traceback (most recent call last):

my fucntion

def get_incident_data(search_query):
    configuration = Configuration()
    configuration.unstable_operations["search_incidents"] = True
    try:
        with ApiClient(configuration) as api_client:
            api_instance = IncidentsApi(api_client)
            response = api_instance.search_incidents(query=search_query)
    except Exception as e:
        LOGGER.error(f" failed to pull data from datadog API due to: Exception={e}")
    return response

where search_query is "state:(active OR stable OR resolved OR completed)&from_ts=1693233872794&to_ts=1695912272794"
I also tried with raw query like state%3A%28active%20OR%20stable%20OR%20resolved%20OR%20completed%29&page=1&from_ts=1693233872794&to_ts=1695912272794 but it also doesn't work.

To Reproduce
Steps to reproduce the behavior:

1. Export DD site, API_key and App_key
2. define the search_query param
3. run the above function
4. See error

Expected behavior
the API should return the response without any errors

Screenshots
If applicable, add screenshots to help explain your problem.

Environment and Versions (please complete the following information):
A clear and precise description of your setup:

• python3.11
• datadog-api-client==2.14.0

Additional context
when running inside ipython on my mac it works fine but inside the container it doesn't

[therve]

Hi,

I think the doc is wrong, the error message gives you the proper syntax key1:value1 AND (key2:value2 OR key3:value3). I don't know if there is a facet for time filtering, I'll ask the backend team. Sorry for the inconvenience.

[neerajtiwar]

Hi @therve no problem, if there is a way to use a time range that would be great, also could you please update the doc.

[cperryk]

👋 Hi @neerajtiwar — Engineering manager of the Incident Management team here. Sorry it's taken us awhile to get back to you. Thank you for flagging this issue. We have removed the confusing language in our API documentation.

You can use the terms created_before and created_after in your search query to specify a date range. The value format is Unix time to seconds precision. Note that this is a lower precision than the values you'll see in from_ts and to_ts query params when looking at the Datadog Web UI.

Example query: created_after:1696132800 created_before:1696219140 state:(active OR stable OR resolved)

[therve]

Fixed in #1699