createScheduledSearchFromTemplate()

API Stability LongTerm

The createScheduledSearchFromTemplate() GraphQL mutation field may be used to create a scheduled search from a yaml specification.

For more information on scheduled searches, see the Scheduled Searches documentation page. Also, look at the Searching Data documentation page as it relates to saving queries.

Syntax

Below is the syntax for the createScheduledSearchFromTemplate() mutation field:

graphql

createScheduledSearchFromTemplate(
      input: CreateScheduledSearchFromTemplateInput!
   ): ScheduledSearch!

Below is an example of how this mutation field might be used:

Raw

graphql

mutation {
  createScheduledSearchFromTemplate( input:
     { viewName: "humio",
       name: "my-big-scheduled-search",
       yamlTemplate: "name: Seeker\n
                      queryString: host=localhost\n
                      backfillLimit: 0\n
                      schedule: 15 1 * * *\n
                      queryEnd: now\n
                      $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                      timeZone: UTC+00:00\n
                      queryStart: 12h\n"
    } )
  { id }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createScheduledSearchFromTemplate( input:
     { viewName: \"humio\",
       name: \"my-big-scheduled-search\",
       yamlTemplate: \"name: Seeker\n
                      queryString: host=localhost\n
                      backfillLimit: 0\n
                      schedule: 15 1 * * *\n
                      queryEnd: now\n
                      $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                      timeZone: UTC+00:00\n
                      queryStart: 12h\n\"
    } )
  { id }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createScheduledSearchFromTemplate( input:
     { viewName: \"humio\",
       name: \"my-big-scheduled-search\",
       yamlTemplate: \"name: Seeker\n
                      queryString: host=localhost\n
                      backfillLimit: 0\n
                      schedule: 15 1 * * *\n
                      queryEnd: now\n
                      $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                      timeZone: UTC+00:00\n
                      queryStart: 12h\n\"
    } )
  { id }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createScheduledSearchFromTemplate( input: ^
     { viewName: \"humio\", ^
       name: \"my-big-scheduled-search\", ^
       yamlTemplate: \"name: Seeker\n ^
                      queryString: host=localhost\n ^
                      backfillLimit: 0\n ^
                      schedule: 15 1 * * *\n ^
                      queryEnd: now\n ^
                      $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n ^
                      timeZone: UTC+00:00\n ^
                      queryStart: 12h\n\" ^
    } ) ^
  { id } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createScheduledSearchFromTemplate( input:
     { viewName: \"humio\",
       name: \"my-big-scheduled-search\",
       yamlTemplate: \"name: Seeker\n
                      queryString: host=localhost\n
                      backfillLimit: 0\n
                      schedule: 15 1 * * *\n
                      queryEnd: now\n
                      $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                      timeZone: UTC+00:00\n
                      queryStart: 12h\n\"
    } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  createScheduledSearchFromTemplate( input:
     { viewName: \"humio\",
       name: \"my-big-scheduled-search\",
       yamlTemplate: \"name: Seeker\n
                      queryString: host=localhost\n
                      backfillLimit: 0\n
                      schedule: 15 1 * * *\n
                      queryEnd: now\n
                      $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                      timeZone: UTC+00:00\n
                      queryStart: 12h\n\"
    } )
  { id }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createScheduledSearchFromTemplate( input:
     { viewName: \"humio\",
       name: \"my-big-scheduled-search\",
       yamlTemplate: \"name: Seeker\n
                      queryString: host=localhost\n
                      backfillLimit: 0\n
                      schedule: 15 1 * * *\n
                      queryEnd: now\n
                      $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                      timeZone: UTC+00:00\n
                      queryStart: 12h\n\"
    } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createScheduledSearchFromTemplate( input:
     { viewName: \"humio\",
       name: \"my-big-scheduled-search\",
       yamlTemplate: \"name: Seeker\n
                      queryString: host=localhost\n
                      backfillLimit: 0\n
                      schedule: 15 1 * * *\n
                      queryEnd: now\n
                      $schema: https://schemas.humio.com/scheduledsearch/v0.1.0\n
                      timeZone: UTC+00:00\n
                      queryStart: 12h\n\"
    } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "createScheduledSearchFromTemplate": {
      "id": "yAooQbjm1uubbfCwRrEo35v7R33YglHn"
    }
  }
}

Given Datatypes

For the given datatype, CreateScheduledSearchFromTemplateInput, there are several parameters that may be given. Below is a list of them along with their datatypes and a description of each:

Table: CreateScheduledSearchFromTemplateInput

Parameter	Type	Required	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 17, 2024
`name`	string	yes	Name of the scheduled search.
`viewName`	`RepoOrViewName`	yes	Name of the view of the scheduled search. RepoOrViewName is a scalar.
`yamlTemplate`	`yaml`	yes	YAML specification of the scheduled search.

Returned Datatypes

The returned datatype ScheduledSearch has its own parameters. Below is a list of them along with their datatypes and a description of each:

Table: ScheduledSearch

Parameter	Type	Required	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Oct 3, 2024
`actions`	[string]	yes	List of unique identifiers for actions to fire on query result.
`actionsV2`	[`Action`]	yes	List of actions to fire on query result. See `Action`.
`allowedActions`	[`AssetAction`]	yes	The allowed asset actions. See `AssetAction`.
`backfillLimit`	integer	yes	User-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown.
`description`	string		A description of the scheduled search.
`enabled`	boolean	yes	Whether the scheduled search is enabled.
`end`	string	yes	The end of the relative time interval for the query.
`id`	string	yes	The unique identifier of the scheduled search.
`isStarred`	boolean	yes	Whether the calling user has 'starred' the scheduled search. This has been deprecated and is no longer in use and has no effect. It will be removed in version 1.213.
`labels`	[string]	yes	The labels added to the scheduled search.
`lastError`	string		The last error encountered while running the search.
`lastExecuted`	long		Unix timestamp for end of search interval for last query execution.
`lastScheduledSearch`	long		The UNIX timestamp at which the last query result was processed. This is deprecated and replaced with lastExecuted and lastTriggered.
`lastTriggered`	long		Unix timestamp for end of search interval for last query execution that triggered.
`lastWarnings`	[string]	yes	The Last warnings encountered while running the scheduled search.
`modifiedInfo`	`ModifiedInfo`	yes	User or token used to modify the asset. See `ModifiedInfo`.
`name`	string	yes	The name of the scheduled search.
`package`	`PackageInstallation`	yes	The related package. See `PackageInstallation`.
`packageId`	`VersionedPackageSpecifier`	yes	The unique identifier for the related package. VersionedPackageSpecifier is a scalar.
`queryOwnership`	`QueryOwnership`	yes	Ownership of the query run by this scheduled search. See `QueryOwnership`.
`queryString`	string	yes	The LogScale query to execute.
`runAsUser`	`User`	yes	The unique identifier of the user as which the scheduled search is running. See `User`.
`schedule`	string	yes	The cron pattern describing the schedule to execute the query on.
`start`	string	yes	The start of the relative time interval for the query.
`timeOfNextPlannedExecution`	long		The UNIX timestamp for next planned search.
`timeZone`	string	yes	Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
`yamlTemplate`	`yaml`	yes	A template that can be used to recreate the scheduled search.

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes