UpdateScheduledSearchV2 is used to input data for updating a scheduled search.

Table: UpdateScheduledSearchV2

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Apr 9, 2025
actions[string]yes Long-TermA list of ids or names for actions to fire on query result. Actions in packages can be referred to as packagescope/packagename:actionname.
backfillLimitinteger  Long-TermUser-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown.
descriptionstring  Long-TermDescription of the scheduled search.
enabledboolean  Long-TermFlag indicating whether the scheduled search is enabled. The default is true.
idstringyes Long-TermThe unique identifier of the scheduled search.
labels[string]yes Long-TermLabels attached to the scheduled search.
maxWaitTimeSecondslong  Long-TermThe maximum number of seconds to wait for ingest delay and query warnings. Only allowed when queryTimestamp is IngestTimestamp where it's mandatory.
namestringyes Long-TermName of the scheduled search.
queryOwnershipTypeQueryOwnershipTypeyes Long-TermOwnership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStringstringyes Long-TermLogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-TermThe timestamp type to use for the query. Running on @ingesttimestamp is only available with feature flag, ScheduledSearchIngestTimestamp. See QueryTimestampType.
runAsUserIdstring  Long-TermThe scheduled search will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. It requires the 'ChangeTriggersToRunAsOtherUsers' permission to set this field to a user id different from the calling user.
schedulestringyes Long-TermCron pattern describing the schedule to execute the query on.
searchIntervalOffsetSecondslong  Long-TermThe offset of the search interval in seconds. Only allowed when queryTimestampType is EventTimestamp where it's mandatory.
searchIntervalSecondslong  Long-TermThe search interval in seconds.
timeZonestringyes Long-TermTime zone of the schedule. Currently this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
viewNamestringyes Long-TermName of the view of the scheduled search.