The CreateScheduledSearch input includes various settings.

Table: CreateScheduledSearch

ParameterTypeRequiredDefaultDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 17, 2024
actions[string]yes List of Ids for actions to fire on query result.
backfillLimitintegeryes User-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown.
descriptionstringyes Description of the scheduled search.
enabledboolean  Flag indicating whether the scheduled search is enabled.
labels[string]yes Labels attached to the scheduled search.
namestringyes Name of the scheduled search.
queryEndbooleanyes End of the relative time interval for the query.
queryOwnershipTypeQueryOwnershipType  Ownership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStartstringyes Start of the relative time interval for the query.
queryStringstringyes LogScale query to execute.
runAsUserIdstring  The scheduled search will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. It requires the 'ChangeTriggersToRunAsOtherUsers' permission to set this field to a user id different from the calling user.
schedulestringyes Cron pattern describing the schedule to execute the query on.
timeZonestringyes Time zone of the schedule. Currently this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
viewNamestringyes Name of the view of the scheduled search.