CreateScheduledSearchV2 is an input datatype for creating a scheduled search. It's used by the createScheduledSearchV2 mutation field.

Table: CreateScheduledSearchV2

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionIdsOrNamesStringyes Long-Term A list of identifiers or names for actions to fire on query result. No more than ten actions can be added. Actions in packages can be referred to as packagescope/packagename:actionname.
backfillLimitInt  Long-Term User-defined limit, which caps the number of missed searches to backfill (e.g., in the event of a shutdown). This is only allowed when queryTimestampType is set to EventTimestamp, where it's mandatory.
descriptionString  Long-Term Description of the scheduled search.
enabledBoolean  Long-Term Flag indicating whether the scheduled search is enabled.
labelsStringyes Long-Term Labels attached to the scheduled search.
maxWaitTimeSecondsLong  Long-Term The maximum number of seconds to wait for ingest delay and query warnings. Only allowed when queryTimestamp is IngestTimestamp where it's mandatory.
nameStringyes Long-Term The name of the scheduled search.
queryOwnershipTypeQueryOwnershipTypeyes Long-Term The ownership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStringStringyes Long-Term The LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-Term The timestamp type to use for the query. QueryTimestampType.
runAsUserIdString  Long-Term The scheduled search will run with the permissions of the user corresponding to this unique identifier if the queryOwnershipType field is set to User. If it's set to Organization, while runAsUserId is set, it will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. The ChangeTriggersToRunAsOtherUsers permission is required to set this field to a different user other than the calling user.
scheduleStringyes Long-Term Cron pattern describing the schedule on which to execute the query.
searchIntervalOffsetSecondsLong  Long-Term The offset of the search interval in seconds. This is only allowed when queryTimestampType is set to EventTimestamp, where it's mandatory.
searchIntervalSecondsLongyes Long-Term The search interval in seconds.
timeZoneStringyes Long-Term Time zone of the schedule. Currently, this field only supports UTC offsets (i.e., 'UTC', 'UTC-01' or 'UTC+12:45').
triggerOnEmptyResultBoolean  Long-Term Whether the scheduled search should trigger when it finds en empty result (i.e., no events).
viewNameStringyes Long-Term The name of the view of the scheduled search.