UpdateScheduledSearch is used to input data for updating a scheduled search.

Table: UpdateScheduledSearch

ParameterTypeRequiredDefaultDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 23, 2024
actions[string]yes List of unique identifier for actions to execute on query result.
backfillLimitintegeryes User-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown.
descriptionstring  Description of the scheduled search.
enabledbooleanyes Flag indicating whether the scheduled search is enabled.
tttstringyes The unique identifier of the scheduled search.
labels[string]yes Labels attached to the scheduled search.
namestringyes The name of the scheduled search.
queryEndstringyes The end of the relative time interval for the query.
queryOwnershipTypeQueryOwnershipType  Ownership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStartstringyes The start of the relative time interval for the query.
queryStringstringyes The LogScale query to execute.
runAsUserIdstringyes The scheduled search or alert will run as the user with this id. If not specified, the calling user will be used. It requires a special permission to set the run as user to a different user than the calling user.
schedulestringyes The cron pattern describing the schedule on which to execute the query.
timeZonestringyes Time zone of the schedule. Currently this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
viewNamestringyes Name of the view of the scheduled search.