UpdateAggregateAlertV2 is an input for updating an aggregate alert.

Table: UpdateAggregateAlertV2

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Feb 9, 2026
actionIdsOrNames[string]yes Long-TermList of unique identifiers or names of actions to execute on query result. Ten can be added at most. Actions in packages can be referred to as packagescope/packagename:actionname.
descriptionstring  Long-TermA description of the aggregate alert.
enabledbooleanyes Long-TermWhether the aggregate alert is enabled.
idstringyes Long-TermThe unique identifier of the aggregate alert.
labels[string]yes Long-TermThe labels attached to the aggregate alert.
namestringyes Long-TermThe name of the aggregate alert.
queryOwnershipTypeQueryOwnershipTypeyes Long-TermThe ownership of the query run by the aggregate alert. If set to User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStringstringyes Long-TermThe LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-TermThe type of time stamp to use for the query. See QueryTimestampType for a list of choices.
runAsUserIdstring  Long-TermThe aggregate alert will run with the permissions of the user given here queryOwnershipType is set to User. If it's set to Organization, along with this parameter, an error will occur. ChangeTriggersToRunAsOtherUsers permission is required to set this field.
searchIntervalSecondslongyes Long-TermThe search interval to use in seconds. Valid values are 1-80 minutes in seconds divisible by 60, 82-180 minutes in seconds divisible by 120 and 4-24 hours in seconds divisible by 3600.
throttleFields[string]yes Long-TermThe fields on which to throttle. This can be set only if throttleTimeSeconds is set. Ten throttle fields can be added at most.
throttleTimeSecondslongyes Long-TermThe throttle time in seconds.
triggerModeTriggerModeyes Long-TermThe mode used for triggering the alert. See TriggerMode.
viewNameRepoOrViewNameyes Long-TermThe name of the view of the aggregate alert. RepoOrViewName is a scalar.