The CreateScheduledSearch
input includes various settings.
Table: CreateScheduledSearch
Parameter | Type | Required | Default | Stability | Description |
---|---|---|---|---|---|
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column. | |||||
Table last updated: Mar 28, 2025 | |||||
actions | [string] | yes | Deprecated | List of Ids for actions to fire on query result. | |
backfillLimit | integer | yes | Deprecated | User-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown. | |
description | string | yes | Deprecated | Description of the scheduled search. | |
enabled | boolean | true | Deprecated | Flag indicating whether the scheduled search is enabled. | |
labels | [string] | yes | [ ] | Deprecated | Labels attached to the scheduled search. |
Name | string | yes | Deprecated | Name of the scheduled search. | |
queryEnd | boolean | yes | Deprecated | End of the relative time interval for the query. Value must be in whole seconds. | |
queryOwnershipType | QueryOwnershipType | User | Deprecated | Ownership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType . | |
queryStart | string | yes | Deprecated | Start of the relative time interval for the query. Value must be in whole seconds. | |
queryString | string | yes | Deprecated | LogScale query to execute. | |
runAsUserId | string | Deprecated | The scheduled search will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. It requires the 'ChangeTriggersToRunAsOtherUsers' permission to set this field to a user id different from the calling user. | ||
schedule | string | yes | Deprecated | Cron pattern describing the schedule to execute the query on. | |
timeZone | string | yes | Deprecated | Time zone of the schedule. Currently this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'. | |
viewName | string | yes | Deprecated | Name of the view of the scheduled search. |