UpdateScheduledSearchV3 is an input for updating a scheduled search.

Table: UpdateScheduledSearchV3

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Jun 23, 2025
actionIdsOrNames[string]yes Long-TermList of ids or names for actions to fire on query result. Actions in packages can be referred to as packagescope/packagename:actionname.
backfillLimitinteger  Long-TermUser-defined limit, which caps the number of missed searches to backfill, such as in the event of a shutdown. Only allowed when queryTimestampType is EventTimestamp where it is mandatory.
descriptionstring  Long-TermDescription of the scheduled search.
enabledbooleanyes Long-TermWhether the scheduled search is enabled.
idstringyes Long-TermThe unique identifier of the scheduled search.
labels[string]yes Long-TermLabels attached to the scheduled search.
maxWaitTimeSecondslong  Long-TermMaximum number of seconds to wait for ingest delay and query warnings. Only allowed when queryTimestamp is IngestTimestamp where it is mandatory.
namestringyes Long-TermThe name of the scheduled search.
queryOwnershipTypeQueryOwnershipTypeyes Long-TermOwnership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
querystringstringyes Long-TermLogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-TermTimestamp type to use for the query. See QueryTimestampType.
runAsUserIdstring  Long-TermThe scheduled search will run with the permissions of the user corresponding to this ID if queryOwnershipType is set to User. If queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. It requires the ChangeTriggersToRunAsOtherUsers permission to set this field to a different user ID than that of the calling user.
schedulestringyes Long-TermCron pattern describing the schedule on which to execute the query.
searchIntervalOffsetSecondslong  Long-TermOffset of the search interval in seconds. Only allowed when queryTimestampType is EventTimestamp where it is mandatory.
searchIntervalSecondslongyes Long-TermThe search interval in seconds.
timeZonestringyes Long-TermTime zone of the schedule. Currently, this field only supports UTC offsets (e.g., 'UTC', 'UTC-01' or 'UTC+12:45').
triggerOnEmptyResultbooleanyes Long-TermWhether the scheduled search should trigger when it finds en empty result (i.e., no events).
viewNamestringyes Long-TermThe name of the view of the scheduled search.