ScheduledSearch is a
datatype for information about a scheduled search.
Table: ScheduledSearch
| Parameter | Type | Required | Default | Stability | Description |
|---|---|---|---|---|---|
| Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column. | |||||
| Table last updated: Mar 27, 2025 | |||||
actions | [string] | yes | Long-Term | List of unique identifiers for actions to fire on query result. | |
actionsV2 | [Action] | yes | Long-Term | List of actions to fire on query result. See Action. | |
allowedActions | [AssetAction] | yes | Preview | The allowed asset actions. See AssetAction. | |
backfillLimit | integer | Deprecated | User-defined limit, which caps the number of missed searches to backfill (e.g., in the event of a shutdown). This option is deprecated and will be removed at the earliest in version 1.231. Use instead backfillLimitV2. | ||
backfillLimitV2 | integer | Long-Term | User-defined limit, which caps the number of missed searches to backfill when queryTimestampType is EventTimestamp. | ||
description | string | Long-Term | A description of the scheduled search. | ||
enabled | boolean | yes | Long-Term | Whether the scheduled search is enabled. | |
end | string | yes | Deprecated | The end of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead searchIntervalOffsetSeconds. | |
id | string | yes | Long-Term | The unique identifier of the scheduled search. | |
isStarred | boolean | yes | Deprecated | Whether the calling user has 'starred' the scheduled search. This has been deprecated and is no longer in use and has no effect. It will be removed in version 1.213. | |
labels | [string] | yes | Long-Term | The labels added to the scheduled search. | |
lastError | string | Long-Term | The last error encountered while running the search. | ||
lastExecuted | long | Long-Term | Unix timestamp for end of search interval for last query execution. | ||
lastScheduledSearch | long | Deprecated | The UNIX timestamp at which the last query result was processed. This is deprecated and replaced with lastExecuted and lastTriggered. It will be removed at the earliest in version 1.202. | ||
lastTriggered | long | Long-Term | Unix timestamp for end of search interval for last query execution that triggered. | ||
lastWarnings | [string] | yes | Long-Term | The Last warnings encountered while running the scheduled search. | |
maxWaitTimeSeconds | long | Long-Term | The maximum wait time in seconds when queryTimestampType is IngestTimestamp. | ||
modifiedInfo | ModifiedInfo | yes | Preview | User or token used to modify the asset. See ModifiedInfo. | |
Name | string | yes | Long-Term | The name of the scheduled search. | |
package | PackageInstallation | Long-Term | The related package. See PackageInstallation. | ||
packageId | VersionedPackageSpecifier | Long-Term | The unique identifier for the related package. VersionedPackageSpecifier is a scalar. | ||
queryOwnership | QueryOwnership | yes | Long-Term | Ownership of the query run by this scheduled search. See QueryOwnership. | |
queryString | string | yes | Long-Term | The LogScale query to execute. | |
queryTimestampType | QueryTimestampType | yes | Long-Term | The timestamp type to use for the query. Running on @ingesttimestamp is only available with feature flag ScheduledSearchIngestTimestamp. See QueryTimestampType. | |
resource | string | yes | Short-Term | The resource identifier for the scheduled search. | |
runAsUser | User | Long-Term | The unique identifier of the user as which the scheduled search is running. See User. | ||
schedule | string | yes | Long-Term | The cron pattern describing the schedule to execute the query on. | |
searchIntervalOffsetSeconds | long | Long-Term | The search interval offset in seconds when queryTimestampType is EventTimestamp. | ||
searchIntervalSeconds | long | yes | Long-Term | The search interval in seconds. | |
start | string | yes | Deprecated | The start of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead searchIntervalSeconds. | |
timeOfNextPlannedExecution | long | Long-Term | The UNIX timestamp for next planned search. | ||
timeZone | string | yes | Long-Term | Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'. | |
yamlTemplate | yaml | yes | Long-Term | A template that can be used to recreate the scheduled search. | |