To call a saved search as a function, use the syntax $"SAVED_QUERY_NAME"(). If the name does not contain whitespace or special characters, you can omit the quotes and use $savedQueryName().

For example, if you have a saved search named falcon/investigate:process_execution in a package, you can call it with:

$"falcon/investigate:process_execution"(FileName=cmd.exe)

This executes the saved search with the argument FileName set to cmd.exe.

You can call the same saved search multiple times with different arguments. For example, if you have a saved search named HumanTime that converts timestamps to human-readable format, you can use it to convert multiple fields:

#event_simpleName="ProcessRollup2"
| $"HumanTime"(field=ProcessStartTime)
| $HumanTime(field=@timestamp)

This example shows both syntax forms: with quotes for the first call and without quotes for the second call, since the name contains no special characters.

You can embed saved searches as subqueries within your existing query. The saved search processes independently, then feeds that processed data to the main query. This pattern is useful when you want to filter or transform data before applying additional logic.

For example, you can use a saved search to filter out false positives before performing further analysis:

$"My Saved Query"()
| $filterOutFalsePositive()
| groupBy(field=host)

In this example, the first saved search executes, then its output is piped to the second saved search, and finally the results are grouped by the host field.

When you call a saved search as a function, it processes independently from the main query. The saved search:

This independent processing model means the saved search operates on its own pipeline before returning results. You can chain multiple saved searches together, and each one processes sequentially.

You can execute subqueries on different time-ranges than the main query. This capability is useful when you need to compare current data against historical patterns or retrieve reference data from a different time window.

To specify a time-range for a subquery, use the time-range syntax within the subquery block. The subquery processes data from its specified time window independently from the main query time-range.

For example, you can compare current process executions against a baseline from the previous week, or look up configuration data that was valid at a specific point in time.

For more information about saved searches, see: