clearErrorOnScheduledSearch()

API Stability	`Long-Term`

The clearErrorOnScheduledSearch() GraphQL mutation field is used to clear the error status on a scheduled search. The status will be updated, though, if the error reoccurs.

For more information on scheduled searches, see the Scheduled searches documentation page.

Syntax

Below is the syntax for the clearErrorOnScheduledSearch() mutation field:

graphql

clearErrorOnScheduledSearch(
      input: ClearErrorOnScheduledSearchInput!
   ): ScheduledSearch!

Below is an example of how this mutation field might be used:

Show:

graphql

mutation {
  clearErrorOnScheduledSearch(input:
       { viewName: "humio", 
         id: "uwsVwYlFWGqzD9bIgKeciwmiS1hCVMyn" } )
  {name, schedule}
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  clearErrorOnScheduledSearch(input:
       { viewName: \"humio\", 
         id: \"uwsVwYlFWGqzD9bIgKeciwmiS1hCVMyn\" } )
  {name, schedule}
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  clearErrorOnScheduledSearch(input:
       { viewName: \"humio\", 
         id: \"uwsVwYlFWGqzD9bIgKeciwmiS1hCVMyn\" } )
  {name, schedule}
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  clearErrorOnScheduledSearch(input: ^
       { viewName: \"humio\",  ^
         id: \"uwsVwYlFWGqzD9bIgKeciwmiS1hCVMyn\" } ) ^
  {name, schedule} ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  clearErrorOnScheduledSearch(input:
       { viewName: \"humio\", 
         id: \"uwsVwYlFWGqzD9bIgKeciwmiS1hCVMyn\" } )
  {name, schedule}
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  clearErrorOnScheduledSearch(input:
       { viewName: \"humio\", 
         id: \"uwsVwYlFWGqzD9bIgKeciwmiS1hCVMyn\" } )
  {name, schedule}
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  clearErrorOnScheduledSearch(input:
       { viewName: \"humio\", 
         id: \"uwsVwYlFWGqzD9bIgKeciwmiS1hCVMyn\" } )
  {name, schedule}
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  clearErrorOnScheduledSearch(input:
       { viewName: \"humio\", 
         id: \"uwsVwYlFWGqzD9bIgKeciwmiS1hCVMyn\" } )
  {name, schedule}
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "clearErrorOnScheduledSearch": {
      "name": "Seeker",
      "schedule": "15 1 * * *"
    }
  }
}

Given Datatypes

For ClearErrorOnScheduledSearchInput, there are a couple of parameters that may be given. Below is a list of them along with descriptions of each:

Table: ClearErrorOnScheduledSearchInput

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 17, 2024
`id`	string	yes	`Long-Term`	Unique identifier of the alert.
`viewName`	string	yes	`Long-Term`	Name of the view of the alert.

Returned Datatypes

The returned datatype scheduledSearch has its own parameters. Below is a list of them along with descriptions of each:

Table: ScheduledSearch

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 27, 2025
`actions`	[string]	yes	`Long-Term`	List of unique identifiers for actions to fire on query result.
`actionsV2`	[`Action`]	yes	`Long-Term`	List of actions to fire on query result. See `Action`.
`allowedActions`	[`AssetAction`]	yes	`Preview`	The allowed asset actions. See `AssetAction`.
`backfillLimit`	integer		`Deprecated`	User-defined limit, which caps the number of missed searches to backfill (e.g., in the event of a shutdown). This option is deprecated and will be removed at the earliest in version 1.231. Use instead `backfillLimitV2`.
`backfillLimitV2`	integer		`Long-Term`	User-defined limit, which caps the number of missed searches to backfill when `queryTimestampType` is `EventTimestamp`.
`description`	string		`Long-Term`	A description of the scheduled search.
`enabled`	boolean	yes	`Long-Term`	Whether the scheduled search is enabled.
`end`	string	yes	`Deprecated`	The end of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead `searchIntervalOffsetSeconds`.
`id`	string	yes	`Long-Term`	The unique identifier of the scheduled search.
`isStarred`	boolean	yes	`Deprecated`	Whether the calling user has 'starred' the scheduled search. This has been deprecated and is no longer in use and has no effect. It will be removed in version 1.213.
`labels`	[string]	yes	`Long-Term`	The labels added to the scheduled search.
`lastError`	string		`Long-Term`	The last error encountered while running the search.
`lastExecuted`	long		`Long-Term`	Unix timestamp for end of search interval for last query execution.
`lastScheduledSearch`	long		`Deprecated`	The UNIX timestamp at which the last query result was processed. This is deprecated and replaced with lastExecuted and lastTriggered. It will be removed at the earliest in version 1.202.
`lastTriggered`	long		`Long-Term`	Unix timestamp for end of search interval for last query execution that triggered.
`lastWarnings`	[string]	yes	`Long-Term`	The Last warnings encountered while running the scheduled search.
`maxWaitTimeSeconds`	long		`Long-Term`	The maximum wait time in seconds when `queryTimestampType` is `IngestTimestamp`.
`modifiedInfo`	`ModifiedInfo`	yes	`Preview`	User or token used to modify the asset. See `ModifiedInfo`.
`name`	string	yes	`Long-Term`	The name of the scheduled search.
`package`	`PackageInstallation`		`Long-Term`	The related package. See `PackageInstallation`.
`packageId`	`VersionedPackageSpecifier`		`Long-Term`	The unique identifier for the related package. VersionedPackageSpecifier is a scalar.
`queryOwnership`	`QueryOwnership`	yes	`Long-Term`	Ownership of the query run by this scheduled search. See `QueryOwnership`.
`queryString`	string	yes	`Long-Term`	The LogScale query to execute.
`queryTimestampType`	`QueryTimestampType`	yes	`Long-Term`	The timestamp type to use for the query. Running on `@ingesttimestamp` is only available with feature flag `ScheduledSearchIngestTimestamp`. See `QueryTimestampType`.
`resource`	string	yes	`Short-Term`	The resource identifier for the scheduled search.
`runAsUser`	`User`		`Long-Term`	The unique identifier of the user as which the scheduled search is running. See `User`.
`schedule`	string	yes	`Long-Term`	The cron pattern describing the schedule to execute the query on.
`searchIntervalOffsetSeconds`	long		`Long-Term`	The search interval offset in seconds when `queryTimestampType` is `EventTimestamp`.
`searchIntervalSeconds`	long	yes	`Long-Term`	The search interval in seconds.
`start`	string	yes	`Deprecated`	The start of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead `searchIntervalSeconds`.
`timeOfNextPlannedExecution`	long		`Long-Term`	The UNIX timestamp for next planned search.
`timeZone`	string	yes	`Long-Term`	Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
`yamlTemplate`	`yaml`	yes	`Long-Term`	A template that can be used to recreate the scheduled search.

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes