🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createSavedQuery() mutation creates a named, reusable saved query in a LogScale view. Provide the view name, query string, and optional time range, display settings, and labels. To create a saved query from a YAML template, use createSavedQueryFromTemplate() instead. To create one from a package template, use createSavedQueryFromPackageTemplate().

Syntax

graphql
createSavedQuery(
      input: CreateSavedQueryInput!
   ): CreateSavedQueryPayload!

The mutation accepts a single required input argument of type CreateSavedQueryInput!. Supply the view name, query string, and any optional display or interaction settings. The mutation returns a non-null CreateSavedQueryPayload! containing the created saved query. See the following sections for input parameters and returned values.

Example

Raw
graphql
mutation {
  createSavedQuery( input:
   { name: "my-saved-query",
     viewName: "humio",
     queryString: "@host=localhost"
  }  )
  { savedQuery {id, allowedActions}  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createSavedQuery( input: ^
   { name: \"my-saved-query\", ^
     viewName: \"humio\", ^
     queryString: \"@host=localhost\" ^
  }  ) ^
  { savedQuery {id, allowedActions}  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createSavedQuery": {
      "savedQuery": {
        "id": "abc123",
        "allowedActions": [
          "Read",
          "Update"
        ]
      }
    }
  }
}

Input Parameters

Provide the name of the view associated with the saved query, the query string, and any optional parameters such as time range, display type, labels, and link interactions. The following table describes all available input parameters:

Table: CreateSavedQueryInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
customLinkInteractionsCustomLinkInteractionInputyes Long-Term The custom links for interactions. See CustomLinkInteractionInput.
dashboardLinkInteractionsDashboardLinkInteractionInputyes Long-Term The dashboard links for interactions. See DashboardLinkInteractionInput.
descriptionString     
endString  Long-Term The end point for events processed by the saved query.
isLiveBoolean  Long-Term Whether the saved query uses live, streaming data.
labelsStringyes    
nameStringyes Long-Term The name of the saved query to create.
optionsString  Long-Term Any options related to the saved query.
queryStringStringyes Long-Term The query to be used, to be saved.
searchLinkInteractionsSearchLinkInteractionInputyes Long-Term The search links for interactions. See SearchLinkInteractionInput.
startString  Long-Term The start point for events processed by the saved query.
updateParametersInteractionsUpdateParametersInteractionInputyes Long-Term The parameters to update for interactions. See UpdateParametersInteractionInput.
viewNameStringyes Long-Term The name of the view associated with the saved query.
widgetTypeString  Long-Term The type of widget to use for display the results for the saved query.

Returned Values

The mutation returns a CreateSavedQueryPayload! containing the newly created SavedQuery object. The saved query object includes its ID, name, query string, time range, creation metadata, and associated view. The following tables describe all available fields:

Table: CreateSavedQueryPayload Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
savedQuerySavedQueryyes Long-Term The saved query to create from payload. See SavedQuery.

The payload references the SavedQuery datatype for full details on the saved query object. The following table describes that datatype:

Table: SavedQuery Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
allowedActionsAssetActionyes Short-Term The allowed asset actions. See AssetAction . This is a preview and subject to change.
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the saved query. See AssetCommitMetadata.
descriptionString  Long-Term A description of the saved query.
displayNameStringyes Long-Term The display name of the saved query.
idStringyes Long-Term The unique identifier for the saved query.
interactionsQueryBasedWidgetInteractionyes Long-Term The interactions of the saved query. See QueryBasedWidgetInteraction.
isStarredBooleanyes Long-Term Whether the saved query has been marked with a star.
labelsStringyes Long-Term The labels associated with this saved query.
modifiedInfoAssetCommitMetadata  Long-Term Metadata related to the latest modification of the saved query. See AssetCommitMetadata.
nameStringyes Long-Term The name of the saved query.
optionsJSONyes Long-Term Options related to the saved query, in JSON form. JSON is a scalar.
packagePackageInstallation  Long-Term The package, if there is one, in which the saved query is included. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The unique identifier of the package. VersionedPackageSpecifier is a scalar value.
qualifiedNameStringyes Preview The fully qualified reference format, including the view.
queryHumioQueryyes Long-Term The saved query itself. See HumioQuery.
resourceStringyes Short-Term The resource identifier for this saved query.
templateYamlStringyes  deprecated in 1.225A YAML formatted string that describes the saved query.
widgetTypeStringyes Long-Term The type of widget used with the saved query.
yamlTemplateYAMLyes Long-Term A yaml formatted string that describes the saved query. YAML is a scalar. This replaced templateYaml starting in LogScale version 1.225.