ScheduledSearch is a datatype for information about a scheduled search.

This datatype is used primarily directly by several mutation fields related to scheduled searches: createScheduledSearchV2(); disableScheduledSearchV2(); and enableScheduledSearchV2(). Use deleteScheduledSearchV2() to remove a scheduled search. There's also the clearErrorOnScheduledSearch() mutation for clearing errors.

This datatype is also used for labels related to scheduled searches: addScheduledSearchLabel(); addScheduledSearchLabels(); updateScheduledSearchV3(); removeScheduledSearchLabel(); and removeScheduledSearchLabels().

Table: ScheduledSearch

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
actionsStringyes Long-Term List of unique identifiers for actions to fire on query result.
actionsV2Actionyes Long-Term List of actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term The allowed asset actions. See AssetAction .
backfillLimitV2Int  Long-Term User-defined limit, which caps the number of missed searches to backfill when queryTimestampType is EventTimestamp.
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the scheduled search. See AssetCommitMetadata.
descriptionString  Long-Term A description of the scheduled search.
enabledBooleanyes Long-Term Whether the scheduled search is enabled.
executionTimesToRerunLongyes Long-Term Execution times of the scheduled search runs to rerun as Unix timestamp in milliseconds.
idStringyes Long-Term The unique identifier of the scheduled search.
labelsStringyes Long-Term The labels added to the scheduled search.
lastErrorString  Long-Term The last error encountered while running the search.
lastExecutedLong  Deprecateddeprecated in 1.282Unix timestamp for end of search interval for last query execution. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastExecution parameter.
lastTriggeredLong  Deprecateddeprecated in 1.282Unix timestamp for end of search interval for last query execution that triggered. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastTrigger parameter.
lastWarningsStringyes Long-Term The Last warnings encountered while running the scheduled search.
maxWaitTimeSecondsLong  Long-Term The maximum wait time in seconds when queryTimestampType is IngestTimestamp.
modifiedInfoModifiedInfoyes Long-Term User or token used to modify the asset. See ModifiedInfo.
nameStringyes Long-Term The name of the scheduled search.
packagePackageInstallation  Long-Term The related package. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The unique identifier for the related package. VersionedPackageSpecifier is a scalar.
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this scheduled search. See QueryOwnership.
queryStringStringyes Long-Term The LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-Term The timestamp type to use for the query. Running on @ingesttimestamp is only available with feature flag ScheduledSearchIngestTimestamp. See QueryTimestampType .
resourceStringyes Short-Term The resource identifier for the scheduled search.
runAsUserUser  Long-Term The unique identifier of the user as which the scheduled search is running. See User.
scheduleStringyes Long-Term The cron pattern describing the schedule to execute the query on.
searchIntervalOffsetSecondsLong  Long-Term The search interval offset in seconds when queryTimestampType is EventTimestamp.
searchIntervalSecondsLongyes Long-Term The search interval in seconds.
timeOfLastExecutionLong  Long-Term Unix timestamp for when the scheduled search was last executed.
timeOfLastTriggerLong  Long-Term Unix timestamp for when the scheduled search was last triggered.
timeOfNextPlannedExecutionLong  Long-Term The UNIX timestamp for next planned search.
timeZoneStringyes Long-Term Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
triggerOnEmptyResultBooleanyes Long-Term Flag indicating whether the scheduled search should trigger when it finds an empty result (i.e., no events).
yamlTemplateYAMLyes Long-Term A template that can be used to recreate the scheduled search. YAML is a scalar.