The createSavedQuery() GraphQL mutation may be used to create a saved query in LogScale.

Similar to this mutation, there is the createSavedQueryFromTemplate() creating a saved query using a YAML template, and createSavedQueryFromPackageTemplate() for creating one from a template in a package. There are also the copySavedQuery(), updateSavedQuery() and deleteSavedQueryV2() for copying, updating and deleting saved queries. There is also setDefaultSavedQuery() for marking a saved query as the default.

Hide Query Example

Show Saved Queries Query

For more information on saved queries, see the Saved Searches (User Functions) reference page where saved queries are discussed. Also, look at the Search Data documentation page as it relates to recent queries and saving queries.

API Stability Long-Term

Syntax

graphql
createSavedQuery(
      input: CreateSavedQueryInput!
   ): CreateSavedQueryPayload!

For the input, you'll have to give the name of the view, the query itself, etc. See the Given Datatype section for details.

For the results, you can get plenty on the saved query. See the Returned Datatype section for what's available.

Example

Raw
graphql
mutation {
  createSavedQuery( input:
   { name: "my-saved-query",
     viewName: "humio",
     queryString: "@host=localhost"
  }  )
  { savedQuery {id, allowedActions}  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createSavedQuery( input: ^
   { name: \"my-saved-query\", ^
     viewName: \"humio\", ^
     queryString: \"@host=localhost\" ^
  }  ) ^
  { savedQuery {id, allowedActions}  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createSavedQuery( input:
   { name: \"my-saved-query\",
     viewName: \"humio\",
     queryString: \"@host=localhost\"
  }  )
  { savedQuery {id, allowedActions}  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createSavedQuery": {
      "savedQuery": {
        "id": "abc123",
        "allowedActions": [
          "Read",
          "Update"
        ]
      }
    }
  }
}

Given Datatype

For this input datatype, you would provide the name of the view associated with the saved query to create, the query itself, and a few other factors. These are listed and explained, along with other parameters, in the table below:

Table: CreateSavedQueryInput

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 17, 2024
customLinkInteractions[CustomLinkInteractionInput]yes Long-TermThe custom links for interactions. See CustomLinkInteractionInput.
dashboardLinkInteractions[DashboardLinkInteractionInput]yes Long-TermThe dashboard links for interactions. See DashboardLinkInteractionInput.
endstring  Long-TermThe end point for events processed by the saved query.
isLiveboolean  Long-TermWhether the saved query uses live, streaming data.
namestringyes Long-TermThe name of the saved query to create.
optionsstring  Long-TermAny options related to the saved query.
queryStringstringyes Long-TermThe query to be used, to be saved.
searchLinkInteractions[SearchLinkInteractionInput]yes Long-TermThe search links for interactions. See SearchLinkInteractionInput.
startstring  Long-TermThe start point for events processed by the saved query.
updateParametersInteractions[UpdateParametersInteractionInput]yes Long-TermThe parameters to update for interactions. See UpdateParametersInteractionInput.
viewNamestringyes Long-TermThe name of the view associated with the saved query.
widgetTypestring  Long-TermThe type of widget to use for display the results for the saved query.

Returned Datatype

With the returned datatype, you can get a yaml template of the saved query, when and who created it, and other related data — some of which you will know since you will have just created it with this mutation. Still, below is a list of what's available, along with descriptions of them:

Table: CreateSavedQueryPayload

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 24, 2024
savedQuerySavedQueryyes Long-TermThe saved query to create from payload. See SavedQuery.

The datatype above uses another datatype for information on a saved query. For your convenience, the table for that sub-datatype is included here:

Table: SavedQuery

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Apr 13, 2026
allowedActions[AssetAction]yes Short-TermThe allowed asset actions. See AssetAction . This is a preview and subject to change.
createdInfoAssetCommitMetadata  Long-TermMetadata related to the creation of the saved query. See AssetCommitMetadata.
descriptionstring  Long-TermA description of the saved query.
displayNamestringyes Long-TermThe display name of the saved query.
idstringyes Long-TermThe unique identifier for the saved query.
interactions[QueryBasedWidgetInteraction]yes Long-TermThe interactions of the saved query. See QueryBasedWidgetInteraction.
isStarredbooleanyes Long-TermWhether the saved query has been marked with a star.
labels[string]yes Long-TermThe labels associated with this saved query.
modifiedInfoAssetCommitMetadata  Long-TermMetadata related to the latest modification of the saved query. See AssetCommitMetadata.
namestringyes Long-TermThe name of the saved query.
optionsJSONyes Long-TermOptions related to the saved query, in JSON form. JSON is a scalar.
packagePackageInstallation  Long-TermThe package, if there is one, in which the saved query is included. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-TermThe unique identifier of the package. VersionedPackageSpecifier is a scalar value.
qualifiedNamestringyes PreviewThe fully qualified reference format, including the view.
queryHumioQueryyes Long-TermThe saved query itself. See HumioQuery.
resourcestringyes Short-TermThe resource identifier for this saved query.
widgetTypestringyes Long-TermThe type of widget used with the saved query.
yamlTemplateYAMLyes Long-TermA yaml formatted string that describes the saved query. YAML is a scalar. This replaced templateYaml starting in LogScale version 1.225.