Stability Level Long-Term

After you have prepared LogScale to rerun a scheduled search, if you decide you want to cancel it, you'll need to execute the cancelScheduledSearchRerun() GraphQL mutation.

To set a scheduled search to rerun again, you would use the rerunScheduledSearch() mutation.

Hide Query Example

Show Scheduled Searches Query

Syntax

graphql
cancelScheduledSearchRerun(
      input: CancelScheduledSearchRerun!
    ): ScheduledSearch!

For the input, you'll have to give the name of the repository or view for the scheduled search. You'll also have to provide the unique identifier of the scheduled search. And you'll have to give the time when the scheduled search was to be rerun, since you could queue it for multiple reruns. Click on the Show Query link above for examples as to how to get the identifier and the scheduled rerun time. See the Given Datatype section for the parameters.

For the results, you can get details on the scheduled search. See the Returned Datatype section farther down this page.

Example

Raw
graphql
mutation {
  cancelScheduledSearchRerun(
    input: { viewName: "humio",
             id: "abc123",
             rerunTimeToCancel: "1774618413" }
  ) { id, name, lastExecuted }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  cancelScheduledSearchRerun(
    input: { viewName: \"humio\",
             id: \"abc123\",
             rerunTimeToCancel: \"1774618413\" }
  ) { id, name, lastExecuted }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  cancelScheduledSearchRerun(
    input: { viewName: \"humio\",
             id: \"abc123\",
             rerunTimeToCancel: \"1774618413\" }
  ) { id, name, lastExecuted }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  cancelScheduledSearchRerun( ^
    input: { viewName: \"humio\", ^
             id: \"abc123\", ^
             rerunTimeToCancel: \"1774618413\" } ^
  ) { id, name, lastExecuted } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  cancelScheduledSearchRerun(
    input: { viewName: \"humio\",
             id: \"abc123\",
             rerunTimeToCancel: \"1774618413\" }
  ) { id, name, lastExecuted }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  cancelScheduledSearchRerun(
    input: { viewName: \"humio\",
             id: \"abc123\",
             rerunTimeToCancel: \"1774618413\" }
  ) { id, name, lastExecuted }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  cancelScheduledSearchRerun(
    input: { viewName: \"humio\",
             id: \"abc123\",
             rerunTimeToCancel: \"1774618413\" }
  ) { id, name, lastExecuted }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  cancelScheduledSearchRerun(
    input: { viewName: \"humio\",
             id: \"abc123\",
             rerunTimeToCancel: \"1774618413\" }
  ) { id, name, lastExecuted }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "cancelScheduledSearchRerun": {
      "id": "abc123",
      "name": "run-one",
      "lastExecuted": "1774483200"
    }
  }
}

Given Datatype

For the input datatype, you'll need to name the repository or view, identify the scheduled search to cancel rerunning, and give the Unix time in milliseconds when it's supposed rerun. Click on the Show Query link above the Syntax section for an example of how to get a list of schedule searches, their identifiers, and rerun times.

Table: CancelScheduledSearchRerun

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Mar 27, 2026
idstringyes Long-TermThe unique identifier of the scheduled search.
rerunTimeToCancelstringyes Long-TermThe Unix time in milliseconds when the scheduled search was to be rerun, but is now being canceled.
viewNameRepoOrViewNameyes Long-TermThe name of the view or repository of the scheduled search. RepoOrViewName is a scalar.

Returned Datatype

With the returned datatype, you can get the query string used by the scheduled search, and what actions are triggered. You may also be interested in when it was last executed and any errors or warnings that were returned, as well as when is the next time it's supposed to run and maybe rerun. These and other parameters are listed in the table below:

Table: ScheduledSearch

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Mar 27, 2026
actions[string]yes Long-TermList of unique identifiers for actions to fire on query result.
actionsV2[Action]yes Long-TermList of actions to fire on query result. See Action.
allowedActions[AssetAction]yes Short-TermThe allowed asset actions. See AssetAction .
backfillLimitV2integer  Long-TermUser-defined limit, which caps the number of missed searches to backfill when queryTimestampType is EventTimestamp.
createdInfoAssetCommitMetadata  Long-TermMetadata related to the creation of the scheduled search. See AssetCommitMetadata.
descriptionstring  Long-TermA description of the scheduled search.
enabledbooleanyes Long-TermWhether the scheduled search is enabled.
executionTimesToRerun[long]yes Long-TermExecution times of the scheduled search runs to rerun as Unix timestamp in milliseconds.
idstringyes Long-TermThe unique identifier of the scheduled search.
labels[string]yes Long-TermThe labels added to the scheduled search.
lastErrorstring  Long-TermThe last error encountered while running the search.
lastExecutedlong  DeprecatedUnix timestamp for end of search interval for last query execution. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastExecution parameter.
lastTriggeredlong  DeprecatedUnix timestamp for end of search interval for last query execution that triggered. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastTrigger parameter.
lastWarnings[string]yes Long-TermThe Last warnings encountered while running the scheduled search.
maxWaitTimeSecondslong  Long-TermThe maximum wait time in seconds when queryTimestampType is IngestTimestamp.
modifiedInfoModifiedInfoyes PreviewUser or token used to modify the asset. See ModifiedInfo.
namestringyes Long-TermThe name of the scheduled search.
packagePackageInstallation  Long-TermThe related package. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-TermThe unique identifier for the related package. VersionedPackageSpecifier is a scalar.
queryOwnershipQueryOwnershipyes Long-TermOwnership of the query run by this scheduled search. See QueryOwnership.
queryStringstringyes Long-TermThe LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-TermThe timestamp type to use for the query. Running on @ingesttimestamp is only available with feature flag ScheduledSearchIngestTimestamp. See QueryTimestampType .
resourcestringyes Short-TermThe resource identifier for the scheduled search.
runAsUserUser  Long-TermThe unique identifier of the user as which the scheduled search is running. See User.
schedulestringyes Long-TermThe cron pattern describing the schedule to execute the query on.
searchIntervalOffsetSecondslong  Long-TermThe search interval offset in seconds when queryTimestampType is EventTimestamp.
searchIntervalSecondslongyes Long-TermThe search interval in seconds.
timeOfLastExecutionlong  Long-TermUnix timestamp for when the scheduled search was last executed.
timeOfLastTriggerlong  Long-TermUnix timestamp for when the scheduled search was last triggered.
timeOfNextPlannedExecutionlong  Long-TermThe UNIX timestamp for next planned search.
timeZonestringyes Long-TermTime zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
triggerOnEmptyResultbooleanyes Long-TermFlag indicating whether the scheduled search should trigger when it finds an empty result (i.e., no events).
yamlTemplateYAMLyes Long-TermA template that can be used to recreate the scheduled search. YAML is a scalar.