UnsavedScheduledSearch is a datatype for an unsaved scheduled search. It's used by the generateScheduledSearchFromTemplate() and generateScheduledSearchFromPackageTemplate() query fields.

Table: UnsavedScheduledSearch

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Mar 27, 2026
actions[Action]yes Long-TermA list of unique identifiers for actions to fire on query result. See Action.
backfillLimitV2integer  Long-TermUser-defined limit, which caps the number of missed searches to backfill when queryTimestampType is EventTimestamp.
descriptionstring  Long-TermA description of the scheduled search.
enabledbooleanyes Long-TermWhether the scheduled search is enabled.
labels[string]yes Long-TermLabels attached to the scheduled search.
maxWaitTimeSecondslong  Long-TermThe maximum wait time in seconds when queryTimestampType is IngestTimestamp.
namestringyes Long-TermThe name of the scheduled search.
queryStringstringyes Long-TermThe LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-TermThe timestamp type to use for the query. Running on @ingesttimestamp is only available with feature flag ScheduledSearchIngestTimestamp. See QueryTimestampType.
schedulestringyes Long-TermThe cron pattern describing the schedule on which to execute the query.
searchIntervalOffsetSecondslong  Long-TermThe search interval offset in seconds when queryTimestampType is EventTimestamp.
searchIntervalSecondslongyes Long-TermThe search interval in seconds.
timeZonestringyes Long-TermThe time zone of the schedule. Currently, this field supports only UTC offsets (e.g., 'UTC', 'UTC-01' or 'UTC+12:45').
triggerOnEmptyResultbooleanyes Long-TermWhether the scheduled search should be triggered when there are no events.