Skip to main content
search can answer “how many, by what?” without returning rows. Add groupBy, the name of one field, and search returns each value of that field with the number of objects that carry it.
The response is the same page object search returns for the kind, with counts in place of results:
The tool result’s text carries the same counts for hosts that read only text.

Request

Response

sum(groups.count) + otherCount always equals total. A count uses the same account, permissions and data source as the list it summarises. It never returns rows. total is the number of objects that match the search with its filters applied, not the number the account holds. A plain search of inventory_source reports the same number as its total, so the two always agree. Earlier previews also returned matched on that plain search; it is gone, because total now carries that meaning.

Which kinds can be counted

Other kinds do not support groupBy yet. The listed tools/list schema for your account is authoritative: accounts that cannot count any kind do not see the field. Source health is not counted, because it is read per source and not from the list.

Errors

VALIDATION_ERROR is the code every v3 input refusal carries on the wire. Correct the request and call again. See Errors for the full envelope. Grouping by more than one field, and grouping by time period, are not part of this contract.