CreateScheduledSearchV2 is an input datatype for creating a scheduled search. It's used by the createScheduledSearchV2 mutation field.

Table: CreateScheduledSearchV2

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Dec 23, 2025
actionIdsOrNames[string]yes Long-TermA list of identifiers or names for actions to fire on query result. No more than ten actions can be added. Actions in packages can be referred to as packagescope/packagename:actionname.
backfillLimitintegeryes Long-TermUser-defined limit, which caps the number of missed searches to backfill (e.g., in the event of a shutdown). This is only allowed when queryTimestampType is set to EventTimestamp, where it's mandatory.
descriptionstring  Long-TermDescription of the scheduled search.
enabledboolean trueLong-TermFlag indicating whether the scheduled search is enabled.
labels[string] [ ]Long-TermLabels attached to the scheduled search.
maxWaitTimeSecondslong  Long-TermThe maximum number of seconds to wait for ingest delay and query warnings. Only allowed when queryTimestamp is IngestTimestamp where it's mandatory.
namestringyes Long-TermThe name of the scheduled search.
queryOwnershipTypeQueryOwnershipTypeyes Long-TermThe ownership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStringstringyes Long-TermThe LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-TermThe timestamp type to use for the query. QueryTimestampType.
runAsUserIdstring  Long-TermThe scheduled search will run with the permissions of the user corresponding to this unique identifier if the queryOwnershipType field is set to User. If it's set to Organization, while runAsUserId is set, it will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. The ChangeTriggersToRunAsOtherUsers permission is required to set this field to a different user other than the calling user.
schedulestringyes Long-TermCron pattern describing the schedule on which to execute the query.
searchIntervalOffsetSecondslong  Long-TermThe offset of the search interval in seconds. This is only allowed when queryTimestampType is set to EventTimestamp, where it's mandatory.
searchIntervalSecondslongyes Long-TermThe search interval in seconds.
timeZonestringyes Long-TermTime zone of the schedule. Currently, this field only supports UTC offsets (i.e., 'UTC', 'UTC-01' or 'UTC+12:45').
triggerOnEmptyResultboolean falseLong-TermWhether the scheduled search should trigger when it finds en empty result (i.e., no events).
viewNamestringyes Long-TermThe name of the view of the scheduled search.