createSavedQueryFromTemplate()

🎯API Stability

PreviewThis API is under active development and may change significantly. Not recommended for production use.

Summary

The createSavedQueryFromTemplate() mutation creates a saved query in a view from a YAML-formatted template string. Saved queries store reusable query definitions that you can reference from dashboards, alerts, and the search interface. Use this mutation when you have a YAML template defining a saved query — for example, one exported from another view or environment — and want to instantiate it in a target view. To copy an existing saved query by its identifier, use copySavedQuery(). To create a saved query from a template stored in an installed package, use createSavedQueryFromPackageTemplate().

Use createSavedQueryFromPackageTemplate() to create a saved query from a template stored in an installed package rather than a raw YAML string. Use copySavedQuery() to duplicate an existing saved query into another view. Use createSavedQuery() to create a saved query by specifying query fields directly rather than through a template. Use updateSavedQuery() to modify an existing saved query after creation. Use deleteSavedQueryV2() to remove a saved query. Use setDefaultSavedQuery() to mark a saved query as the default for a view.

Hide Saved Queries Example

Show Saved Queries Example

To list saved queries in a view, use the repositories() query:

graphql

query {
  repositories {
    id
    name
    savedQueries {
      id
      name
      query { isLive }
    }
  }
}

Syntax

graphql

createSavedQueryFromTemplate(
      input: CreateSavedQueryFromTemplateInput!
   ): SavedQuery!

The mutation accepts a single required input argument of type CreateSavedQueryFromTemplateInput. The viewName field accepts a RepoOrViewName scalar — the name of the repository or view where the saved query will be created. The yamlTemplate field accepts a YAML scalar containing the full template definition. The mutation returns a non-null SavedQuery object.

Request id on the returned object to obtain the identifier of the created saved query. Use that identifier with setDefaultSavedQuery() to mark the query as the default for its view, or with updateSavedQuery() to modify it after creation.

Example

Raw

graphql

mutation {
  createSavedQueryFromTemplate( input:
    { viewName: "humio",
      name: "abc123",
      yamlTemplate: "name: Seeker\n
                     queryString: host=localhost\n
                     backfillLimit: 0\n
                     schedule: 15 1 * * *\n
                     queryEnd: now\n
                     $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                     timeZone: UTC+00:00\n
                     queryStart: 12h\n"
    }
  )
 { id }

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSavedQueryFromTemplate( input:
    { viewName: \"humio\",
      name: \"abc123\",
      yamlTemplate: \"name: Seeker\n
                     queryString: host=localhost\n
                     backfillLimit: 0\n
                     schedule: 15 1 * * *\n
                     queryEnd: now\n
                     $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                     timeZone: UTC+00:00\n
                     queryStart: 12h\n\"
    }
  )
 { id }"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSavedQueryFromTemplate( input:
    { viewName: \"humio\",
      name: \"abc123\",
      yamlTemplate: \"name: Seeker\n
                     queryString: host=localhost\n
                     backfillLimit: 0\n
                     schedule: 15 1 * * *\n
                     queryEnd: now\n
                     $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                     timeZone: UTC+00:00\n
                     queryStart: 12h\n\"
    }
  )
 { id }"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createSavedQueryFromTemplate( input: ^
    { viewName: \"humio\", ^
      name: \"abc123\", ^
      yamlTemplate: \"name: Seeker\n ^
                     queryString: host=localhost\n ^
                     backfillLimit: 0\n ^
                     schedule: 15 1 * * *\n ^
                     queryEnd: now\n ^
                     $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n ^
                     timeZone: UTC+00:00\n ^
                     queryStart: 12h\n\" ^
    } ^
  ) ^
 { id }" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createSavedQueryFromTemplate( input:
    { viewName: \"humio\",
      name: \"abc123\",
      yamlTemplate: \"name: Seeker\n
                     queryString: host=localhost\n
                     backfillLimit: 0\n
                     schedule: 15 1 * * *\n
                     queryEnd: now\n
                     $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                     timeZone: UTC+00:00\n
                     queryStart: 12h\n\"
    }
  )
 { id }"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createSavedQueryFromTemplate( input:
    { viewName: \"humio\",
      name: \"abc123\",
      yamlTemplate: \"name: Seeker\n
                     queryString: host=localhost\n
                     backfillLimit: 0\n
                     schedule: 15 1 * * *\n
                     queryEnd: now\n
                     $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                     timeZone: UTC+00:00\n
                     queryStart: 12h\n\"
    }
  )
 { id }";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createSavedQueryFromTemplate( input:
    { viewName: \"humio\",
      name: \"abc123\",
      yamlTemplate: \"name: Seeker\n
                     queryString: host=localhost\n
                     backfillLimit: 0\n
                     schedule: 15 1 * * *\n
                     queryEnd: now\n
                     $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                     timeZone: UTC+00:00\n
                     queryStart: 12h\n\"
    }
  )
 { id }"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createSavedQueryFromTemplate( input:
    { viewName: \"humio\",
      name: \"abc123\",
      yamlTemplate: \"name: Seeker\n
                     queryString: host=localhost\n
                     backfillLimit: 0\n
                     schedule: 15 1 * * *\n
                     queryEnd: now\n
                     $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                     timeZone: UTC+00:00\n
                     queryStart: 12h\n\"
    }
  )
 { id }"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "createSavedQueryFromTemplate": {
      "id": "123abc"
    }
  }
}

Input Parameters

Provide the target view name and the YAML-formatted template that defines the saved query. Optionally, provide a name to override the name embedded in the template — useful when deploying the same template to multiple views with distinct names.

Table: CreateSavedQueryFromTemplateInput Input Datatype

Parameter	Type	Required	Stability	Description
name	String		`Preview`	The name for the saved query. If not provided, the template's name will be used.
viewName	RepoOrViewName	yes	`Preview`	The name of the view where the saved query will be created. See RepoOrViewName is a scalar.
yamlTemplate	YAML	yes	`Preview`	The yaml template from which to create the saved query.

Returned Values

The mutation returns the created SavedQuery object. Request id to uniquely identify the new saved query in subsequent API calls. Request yamlTemplate to verify the stored template, or query to access the structured HumioQuery definition. The createdInfo field returns commit metadata including the creation timestamp and author.

Table: SavedQuery Datatype

Parameter	Type	Required	Stability	Availability	Description
allowedActions	AssetAction	yes	`Short-Term`		The allowed asset actions. See AssetAction . This is a preview and subject to change.
createdInfo	AssetCommitMetadata		`Long-Term`		Metadata related to the creation of the saved query. See AssetCommitMetadata.
description	String		`Long-Term`		A description of the saved query.
displayName	String	yes	`Long-Term`		The display name of the saved query.
id	String	yes	`Long-Term`		The unique identifier for the saved query.
interactions	QueryBasedWidgetInteraction	yes	`Long-Term`		The interactions of the saved query. See QueryBasedWidgetInteraction.
isStarred	Boolean	yes	`Long-Term`		Whether the saved query has been marked with a star.
labels	String	yes	`Long-Term`		The labels associated with this saved query.
modifiedInfo	AssetCommitMetadata		`Long-Term`		Metadata related to the latest modification of the saved query. See AssetCommitMetadata.
name	String	yes	`Long-Term`		The name of the saved query.
options	JSON	yes	`Long-Term`		Options related to the saved query, in JSON form. JSON is a scalar.
package	PackageInstallation		`Long-Term`		The package, if there is one, in which the saved query is included. See PackageInstallation.
packageId	VersionedPackageSpecifier		`Long-Term`		The unique identifier of the package. VersionedPackageSpecifier is a scalar value.
qualifiedName	String	yes	`Preview`		The fully qualified reference format, including the view.
query	HumioQuery	yes	`Long-Term`		The saved query itself. See HumioQuery.
resource	String	yes	`Short-Term`		The resource identifier for this saved query.
templateYaml	String	yes		deprecated in 1.225	A YAML formatted string that describes the saved query.
widgetType	String	yes	`Long-Term`		The type of widget used with the saved query.
yamlTemplate	YAML	yes	`Long-Term`		A yaml formatted string that describes the saved query. YAML is a scalar. This replaced templateYaml starting in LogScale version 1.225.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes