UpdateScheduledSearch is used to input data for updating a scheduled search.

Table: UpdateScheduledSearch

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 28, 2025
actions[string]yes DeprecatedList of unique identifier for actions to execute on query result.
backfillLimitintegeryes DeprecatedUser-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown.
descriptionstring  DeprecatedDescription of the scheduled search.
enabledbooleanyes DeprecatedFlag indicating whether the scheduled search is enabled.
tttstringyes DeprecatedThe unique identifier of the scheduled search.
labels[string]yes DeprecatedLabels attached to the scheduled search.
Namestringyes DeprecatedThe name of the scheduled search.
queryEndstringyes DeprecatedThe end of the relative time interval for the query. Value must be in whole seconds.
queryOwnershipTypeQueryOwnershipType UserDeprecatedOwnership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStartstringyes DeprecatedThe start of the relative time interval for the query. Value must be in whole seconds.
queryStringstringyes DeprecatedThe LogScale query to execute.
runAsUserIdstringyes DeprecatedThe scheduled search or alert will run as the user with this id. If not specified, the calling user will be used. It requires a special permission to set the run as user to a different user than the calling user.
schedulestringyes DeprecatedThe cron pattern describing the schedule on which to execute the query.
timeZonestringyes DeprecatedTime zone of the schedule. Currently this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
viewNamestringyes DeprecatedName of the view of the scheduled search.