---
title: "Analyse raw event logs — counts by value, distinct visitors, sample rows, clicks without impressions"
type: reference
method: GET
path: /rest-api/analytics/raw-log-analyze.do
tag: "Analytics"
---

# Analyse raw event logs — counts by value, distinct visitors, sample rows, clicks without impressions

`GET https://YOUR-NETWORK-DOMAIN/rest-api/analytics/raw-log-analyze.do`

Reads the rows of the Impressions, Clicks, Conversions or Actions Log report for up to 3 days and summarises them instead of returning the log: the number of rows read, counts per value of one or two columns (groupBy) with the top ones and the rest folded into other, how many distinct IPs, users (uuid), user agents and domains they came from, and a few sample rows with the chosen columns. Answers where clicks or impressions come from (domain, IP, user agent, country, device), which IPs or users repeat, and what values arrived in the custom parameters (group by custom_param.<name>). With link=true, clicks are matched to the impressions and conversions or actions to the clicks of the same period by transaction id: how many have a match, how many do not (clicks without impressions, conversions without a click), and samples of the unmatched ones. At most 50000 rows are read from each log - capped says when there were more, and the counts then cover only the rows read. Dates are days in the server's time zone, as in the raw-log reports. Reads through the same cache as the reports; counts as one request against the daily analytics request limit. Needs the report's permission (RPT_TYPE_IMPRESSIONS_LOG, RPT_TYPE_CLICKS_LOG or RPT_TYPE_CONVERSIONS_LOG), a custom date range, and permission to view all inventory and all campaigns, like the raw-log reports.

## Query params

| Name | Type | Required | Example | Description |
|---|---|---|---|---|
| `logType` | string | yes | `CLICKS` | IMPRESSIONS, CLICKS, CONVERSIONS or ACTIONS |
| `from` | string | yes | `2026-10-05` | First day, yyyy-MM-dd, server time zone |
| `to` | string | no | `2026-10-07` | Last day, yyyy-MM-dd, inclusive; default from; at most 3 days from from |
| `advertiserIds` | array<integer> | no | `1001` | Advertiser ids to keep (ORed with campaigns and banners, as in the raw-log reports) |
| `campaignIds` | array<integer> | no | `2001` | Campaign ids to keep |
| `bannerIds` | array<integer> | no | `3001` | Banner ids to keep |
| `siteIds` | array<integer> | no | `5001` | Site ids to keep (ORed with zones and placements) |
| `zoneIds` | array<integer> | no | `6001` | Zone ids to keep |
| `placementIds` | array<integer> | no | `4001` | Placement ids to keep |
| `countries` | array<string> | no | `US` | Countries to keep, two-letter codes |
| `connectionTypes` | array<string> | no | `WIFI` | Connection types to keep (needs RPT_GRP_FILTER_CONNECTION_TYPE) |
| `languages` | array<string> | no | `en` | Browser languages to keep (needs RPT_GRP_FILTER_LANGUAGE) |
| `trafficSources` | array<string> | no | `WEB` | Traffic sources to keep (needs RPT_GRP_FILTER_TRAFFIC_SOURCE) |
| `incognito` | string | no | `true` | Incognito filter: true, false or unknown (needs RPT_GRP_FILTER_INCOGNITO_MODE) |
| `validation` | string | no | `VALID` | VALID (default), NOT_VALID or ALL records - only networks that write invalid records keep NOT_VALID ones |
| `groupBy` | array<string> | no | `domain` | One or two columns to count rows by: a raw-log column (domain, ip, uuid, user_agent, country, deviceFormat, os, browser, banner_id, placement_id...), day, hour, an entity name (banner_name...), or custom_param.<name> for one custom parameter's values |
| `top` | integer | no | `20` | Groups listed, most rows first; default 20, at most 100 |
| `sample` | integer | no | `10` | Sample rows returned; default 10, at most 50, 0 for none |
| `columns` | array<string> | no | `dt` | Columns of the sample rows; default dt, banner_id, placement_id, domain, ip, country, deviceFormat, user_agent, custom_param, transaction_id and the groupBy columns |
| `link` | boolean | no | `true` | Match clicks to impressions, or conversions and actions to clicks, by transaction id; reads the other log too (up to 50000 rows) |

## Responses

- `200` — {success, logType, from, to, rowsRead, matchingRows, capped, rowCap, groupBy, groups:[{<column>: value, count, share}], other:{groups, rows}|null, distinctGroups, distinct:{ip, uuid, user_agent, domain}, sampleColumns, sample:[{...}], linkedTo:{log, key, matched, unmatched, withoutId, linkedRowsRead, linkedCapped, unmatchedByAttribution?, unmatchedSample}|{log, skipped}, notes:[...]}
- `400` — An unknown log type, column or validation, a date that is not yyyy-MM-dd, to before from, more than 3 days, or more than 2 groupBy columns
- `401` — Authentication error
- `403` — The role lacks the log's report permission, a filter's permission, or view-all on inventory and campaigns; the message names it
- `429` — The network's daily analytics request limit is reached
- `503` — The raw logs could not be read from the analytics cluster

## Example request

```bash
curl --request GET \
  --url 'https://YOUR-NETWORK-DOMAIN/rest-api/analytics/raw-log-analyze.do?logType=CLICKS&from=2026-10-05&groupBy=domain&to=2026-10-07&advertiserIds=1001' \
  --header 'X-Api-Key: YOUR_API_KEY'
```

Source: https://epom.com/ad-server/docs/api/analytics/get-analytics-raw-log-analyze