The CreateScheduledSearch input includes various settings.

Table: CreateScheduledSearch

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 28, 2025
actions[string]yes DeprecatedList of Ids for actions to fire on query result.
backfillLimitintegeryes DeprecatedUser-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown.
descriptionstringyes DeprecatedDescription of the scheduled search.
enabledboolean trueDeprecatedFlag indicating whether the scheduled search is enabled.
labels[string]yes[ ]DeprecatedLabels attached to the scheduled search.
Namestringyes DeprecatedName of the scheduled search.
queryEndbooleanyes DeprecatedEnd of the relative time interval for the query. Value must be in whole seconds.
queryOwnershipTypeQueryOwnershipType UserDeprecatedOwnership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStartstringyes DeprecatedStart of the relative time interval for the query. Value must be in whole seconds.
queryStringstringyes DeprecatedLogScale query to execute.
runAsUserIdstring  DeprecatedThe scheduled search will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. It requires the 'ChangeTriggersToRunAsOtherUsers' permission to set this field to a user id different from the calling user.
schedulestringyes DeprecatedCron pattern describing the schedule to execute the query on.
timeZonestringyes DeprecatedTime zone of the schedule. Currently this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
viewNamestringyes DeprecatedName of the view of the scheduled search.