addScheduledSearchLabels()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The addScheduledSearchLabels() mutation adds one or more labels to an existing scheduled search. Use it to organize or categorize scheduled searches after creation. Each scheduled search supports at most ten labels, with a maximum of sixty characters per label. To remove labels, use removeScheduledSearchLabels().

To remove labels from a scheduled search, use removeScheduledSearchLabels(). To retrieve existing labels before modifying them, include scheduledSearches { labels } when querying repositories() or repository().

Hide Query Example

Show Scheduled Search Labels Query

To get a list of scheduled search labels, execute the repositories() query as follows:

graphql

query {
     repositories
      { id, name, 
        scheduledSearches { labels } }
   }

For more information on scheduled searches, see the Scheduled Searches documentation page. To manage labels through the UI, see the Triggers and Manage Triggers pages of the main documentation.

Syntax

graphql

addScheduledSearchLabels(
      input: AddScheduledSearchLabels!
   ): ScheduledSearch

The mutation requires a single input argument of type AddScheduledSearchLabels! (required). It returns a nullable ScheduledSearch object — null if the operation fails.

Provide the view or repository name and the unique identifier of the scheduled search. Include the list of labels to add as an array. Use the query in the following example to retrieve scheduled search identifiers.

Hide Query Example

Show Scheduled Search Identifiers Query

To get a list of all scheduled searches for a repository, use the repository() query as follows:

graphql

query {
     repository(name: "humio")
        { scheduledSearches { name, id } }
   }

With these results you can use a scheduled search's unique identifier to add labels to it.

Example

Raw

graphql

mutation {
  addScheduledSearchLabels(input: 
       { viewName: "humio", 
         id: "abc123", 
         labels: [ "find-them-1",
                   "admin-focus" ] 
        } 
    )
  { name, description, enabled, runAsUser { id, username } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\",
                   \"admin-focus\" ] 
        } 
    )
  { name, description, enabled, runAsUser { id, username } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\",
                   \"admin-focus\" ] 
        } 
    )
  { name, description, enabled, runAsUser { id, username } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addScheduledSearchLabels(input:  ^
       { viewName: \"humio\",  ^
         id: \"abc123\",  ^
         labels: [ \"find-them-1\", ^
                   \"admin-focus\" ]  ^
        }  ^
    ) ^
  { name, description, enabled, runAsUser { id, username } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\",
                   \"admin-focus\" ] 
        } 
    )
  { name, description, enabled, runAsUser { id, username } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\",
                   \"admin-focus\" ] 
        } 
    )
  { name, description, enabled, runAsUser { id, username } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\",
                   \"admin-focus\" ] 
        } 
    )
  { name, description, enabled, runAsUser { id, username } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\",
                   \"admin-focus\" ] 
        } 
    )
  { name, description, enabled, runAsUser { id, username } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addScheduledSearchLabels": {
      "name": "Seeker",
      "description": "Searching for locals.",
      "enabled": true,
      "runAsUser": {
        "id": "def456",
        "username": "bob@company.com"
      }
    }
  }
}

Input Parameters

Provide the repository or view name, the unique identifier of the scheduled search, and an array of labels to add. Each label can be at most sixty characters. A scheduled search supports at most ten labels total. To find scheduled search identifiers, select Show Scheduled Search Identifiers Query in the Syntax section.

Returned Values

The mutation returns a ScheduledSearch object on success, or null if the operation fails. Use labels to retrieve the complete updated label list, including labels already associated with the search. The object also includes the query string, configured actions, and any errors or warnings from the last execution.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes