createScheduledSearch()

API Stability	`Deprecated`

The createScheduledSearch() GraphQL mutation may be used to create a scheduled search in LogScale.

This mutation field is deprecated because LogScale does not support scheduled searches on @ingesttimestamp. It will be removed at the earliest in version 1.237. Use instead createScheduledSearchV2.

For more information on scheduled searches, see the Scheduled searches documentation page. Also, look at the Searching Data documentation page as it relates to saving queries.

Syntax

Below is the syntax for the createScheduledSearch() mutation field:

graphql

createScheduledSearch(
      input: CreateScheduledSearch!
   ): ScheduledSearch!

Below is an example of how this mutation field might be used:

Show:

graphql

mutation {
  createScheduledSearch( input:
    { name: "my-scheduled-search",
      viewName: "humio",
      queryString: "#type=humio #kind=metrics | name=/^data-ingester-errors\\/([^/]+\\/)?(?<repo>\\S+)/ | sum(_avg)",
      queryStart: "12h",
      queryEnd: "now",
      schedule: "*/15 * * * *",
      timeZone: "UTC+2",
      backfillLimit: 5,
      enabled: false,
      actions: [],
      labels: [],
      queryOwnershipType: User
    } )
  { id }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createScheduledSearch( input:
    { name: \"my-scheduled-search\",
      viewName: \"humio\",
      queryString: \"#type=humio #kind=metrics | name=/^data-ingester-errors\\/([^/]+\\/)?(?<repo>\\S+)/ | sum(_avg)\",
      queryStart: \"12h\",
      queryEnd: \"now\",
      schedule: \"*/15 * * * *\",
      timeZone: \"UTC+2\",
      backfillLimit: 5,
      enabled: false,
      actions: [],
      labels: [],
      queryOwnershipType: User
    } )
  { id }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createScheduledSearch( input:
    { name: \"my-scheduled-search\",
      viewName: \"humio\",
      queryString: \"#type=humio #kind=metrics | name=/^data-ingester-errors\\/([^/]+\\/)?(?<repo>\\S+)/ | sum(_avg)\",
      queryStart: \"12h\",
      queryEnd: \"now\",
      schedule: \"*/15 * * * *\",
      timeZone: \"UTC+2\",
      backfillLimit: 5,
      enabled: false,
      actions: [],
      labels: [],
      queryOwnershipType: User
    } )
  { id }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createScheduledSearch( input: ^
    { name: \"my-scheduled-search\", ^
      viewName: \"humio\", ^
      queryString: \"#type=humio #kind=metrics | name=/^data-ingester-errors\\/([^/]+\\/)?(?<repo>\\S+)/ | sum(_avg)\", ^
      queryStart: \"12h\", ^
      queryEnd: \"now\", ^
      schedule: \"*/15 * * * *\", ^
      timeZone: \"UTC+2\", ^
      backfillLimit: 5, ^
      enabled: false, ^
      actions: [], ^
      labels: [], ^
      queryOwnershipType: User ^
    } ) ^
  { id } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createScheduledSearch( input:
    { name: \"my-scheduled-search\",
      viewName: \"humio\",
      queryString: \"#type=humio #kind=metrics | name=/^data-ingester-errors\\/([^/]+\\/)?(?<repo>\\S+)/ | sum(_avg)\",
      queryStart: \"12h\",
      queryEnd: \"now\",
      schedule: \"*/15 * * * *\",
      timeZone: \"UTC+2\",
      backfillLimit: 5,
      enabled: false,
      actions: [],
      labels: [],
      queryOwnershipType: User
    } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  createScheduledSearch( input:
    { name: \"my-scheduled-search\",
      viewName: \"humio\",
      queryString: \"#type=humio #kind=metrics | name=/^data-ingester-errors\\/([^/]+\\/)?(?<repo>\\S+)/ | sum(_avg)\",
      queryStart: \"12h\",
      queryEnd: \"now\",
      schedule: \"*/15 * * * *\",
      timeZone: \"UTC+2\",
      backfillLimit: 5,
      enabled: false,
      actions: [],
      labels: [],
      queryOwnershipType: User
    } )
  { id }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createScheduledSearch( input:
    { name: \"my-scheduled-search\",
      viewName: \"humio\",
      queryString: \"#type=humio #kind=metrics | name=/^data-ingester-errors\\/([^/]+\\/)?(?<repo>\\S+)/ | sum(_avg)\",
      queryStart: \"12h\",
      queryEnd: \"now\",
      schedule: \"*/15 * * * *\",
      timeZone: \"UTC+2\",
      backfillLimit: 5,
      enabled: false,
      actions: [],
      labels: [],
      queryOwnershipType: User
    } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createScheduledSearch( input:
    { name: \"my-scheduled-search\",
      viewName: \"humio\",
      queryString: \"#type=humio #kind=metrics | name=/^data-ingester-errors\\/([^/]+\\/)?(?<repo>\\S+)/ | sum(_avg)\",
      queryStart: \"12h\",
      queryEnd: \"now\",
      schedule: \"*/15 * * * *\",
      timeZone: \"UTC+2\",
      backfillLimit: 5,
      enabled: false,
      actions: [],
      labels: [],
      queryOwnershipType: User
    } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "createScheduledSearch": {
      "id": "F8XbE9eYUlJB0JgaWQLfkGwWiHrLpyID"
    }
  }
}

Given Datatypes

For createScheduledSearch, there are several parameters that may be given. Below is a list of them along with descriptions of each:

Table: CreateScheduledSearch

Parameter	Type	Required	Default	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 28, 2025
`actions`	[string]	yes		`Deprecated`	List of Ids for actions to fire on query result.
`backfillLimit`	integer	yes		`Deprecated`	User-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown.
`description`	string	yes		`Deprecated`	Description of the scheduled search.
`enabled`	boolean		true	`Deprecated`	Flag indicating whether the scheduled search is enabled.
`labels`	[string]	yes	[ ]	`Deprecated`	Labels attached to the scheduled search.
`name`	string	yes		`Deprecated`	Name of the scheduled search.
`queryEnd`	boolean	yes		`Deprecated`	End of the relative time interval for the query. Value must be in whole seconds.
`queryOwnershipType`	`QueryOwnershipType`		User	`Deprecated`	Ownership of the query run by this scheduled search. If value is User, ownership will be based on the `runAsUserId` field. See `QueryOwnershipType`.
`queryStart`	string	yes		`Deprecated`	Start of the relative time interval for the query. Value must be in whole seconds.
`queryString`	string	yes		`Deprecated`	LogScale query to execute.
`runAsUserId`	string			`Deprecated`	The scheduled search will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. It requires the 'ChangeTriggersToRunAsOtherUsers' permission to set this field to a user id different from the calling user.
`schedule`	string	yes		`Deprecated`	Cron pattern describing the schedule to execute the query on.
`timeZone`	string	yes		`Deprecated`	Time zone of the schedule. Currently this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
`viewName`	string	yes		`Deprecated`	Name of the view of the scheduled search.

Returned Datatypes

For scheduledSearch there are a few parameters. Below is a list of them:

Table: ScheduledSearch

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 27, 2025
`actions`	[string]	yes	`Long-Term`	List of unique identifiers for actions to fire on query result.
`actionsV2`	[`Action`]	yes	`Long-Term`	List of actions to fire on query result. See `Action`.
`allowedActions`	[`AssetAction`]	yes	`Preview`	The allowed asset actions. See `AssetAction`.
`backfillLimit`	integer		`Deprecated`	User-defined limit, which caps the number of missed searches to backfill (e.g., in the event of a shutdown). This option is deprecated and will be removed at the earliest in version 1.231. Use instead `backfillLimitV2`.
`backfillLimitV2`	integer		`Long-Term`	User-defined limit, which caps the number of missed searches to backfill when `queryTimestampType` is `EventTimestamp`.
`description`	string		`Long-Term`	A description of the scheduled search.
`enabled`	boolean	yes	`Long-Term`	Whether the scheduled search is enabled.
`end`	string	yes	`Deprecated`	The end of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead `searchIntervalOffsetSeconds`.
`id`	string	yes	`Long-Term`	The unique identifier of the scheduled search.
`isStarred`	boolean	yes	`Deprecated`	Whether the calling user has 'starred' the scheduled search. This has been deprecated and is no longer in use and has no effect. It will be removed in version 1.213.
`labels`	[string]	yes	`Long-Term`	The labels added to the scheduled search.
`lastError`	string		`Long-Term`	The last error encountered while running the search.
`lastExecuted`	long		`Long-Term`	Unix timestamp for end of search interval for last query execution.
`lastScheduledSearch`	long		`Deprecated`	The UNIX timestamp at which the last query result was processed. This is deprecated and replaced with lastExecuted and lastTriggered. It will be removed at the earliest in version 1.202.
`lastTriggered`	long		`Long-Term`	Unix timestamp for end of search interval for last query execution that triggered.
`lastWarnings`	[string]	yes	`Long-Term`	The Last warnings encountered while running the scheduled search.
`maxWaitTimeSeconds`	long		`Long-Term`	The maximum wait time in seconds when `queryTimestampType` is `IngestTimestamp`.
`modifiedInfo`	`ModifiedInfo`	yes	`Preview`	User or token used to modify the asset. See `ModifiedInfo`.
`name`	string	yes	`Long-Term`	The name of the scheduled search.
`package`	`PackageInstallation`		`Long-Term`	The related package. See `PackageInstallation`.
`packageId`	`VersionedPackageSpecifier`		`Long-Term`	The unique identifier for the related package. VersionedPackageSpecifier is a scalar.
`queryOwnership`	`QueryOwnership`	yes	`Long-Term`	Ownership of the query run by this scheduled search. See `QueryOwnership`.
`queryString`	string	yes	`Long-Term`	The LogScale query to execute.
`queryTimestampType`	`QueryTimestampType`	yes	`Long-Term`	The timestamp type to use for the query. Running on `@ingesttimestamp` is only available with feature flag `ScheduledSearchIngestTimestamp`. See `QueryTimestampType`.
`resource`	string	yes	`Short-Term`	The resource identifier for the scheduled search.
`runAsUser`	`User`		`Long-Term`	The unique identifier of the user as which the scheduled search is running. See `User`.
`schedule`	string	yes	`Long-Term`	The cron pattern describing the schedule to execute the query on.
`searchIntervalOffsetSeconds`	long		`Long-Term`	The search interval offset in seconds when `queryTimestampType` is `EventTimestamp`.
`searchIntervalSeconds`	long	yes	`Long-Term`	The search interval in seconds.
`start`	string	yes	`Deprecated`	The start of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead `searchIntervalSeconds`.
`timeOfNextPlannedExecution`	long		`Long-Term`	The UNIX timestamp for next planned search.
`timeZone`	string	yes	`Long-Term`	Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
`yamlTemplate`	`yaml`	yes	`Long-Term`	A template that can be used to recreate the scheduled search.

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes