API Stability
Preview
The createScheduledSearchV2() GraphQL mutation field is used to create a scheduled search.
Syntax
Below is the syntax for the createScheduledSearchV2() mutation field:
graphql
createScheduledSearchV2(
input: CreateScheduledSearchV2!
): ScheduledSearch!
Below is an example of how this mutation field might be used:
graphql
mutation {
createScheduledSearchV2( input:
{ viewName: "humio",
name: "mySearch",
queryString: "@host=localhost",
searchIntervalSeconds: 10,
schedule: "15 1 * * *",
timeZone: "UTC+2",
enabled: true,
actionIdsOrNames: [],
queryOwnershipType: User,
queryTimestampType: EventTimestamp
}
)
{ id }
}
json
{
"data": {
"createScheduledSearchV2": {
"id": "abc123"
}
}
}
Given Datatypes
For
CreateScheduledSearchV2
,
there are several parameters. Below is a list of them:
Table: CreateScheduledSearchV2
Parameter | Type | Required | Default | Stability | Description |
---|---|---|---|---|---|
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column. | |||||
Table last updated: Mar 28, 2025 | |||||
actions | [string] | yes | A list of ids or names for actions to fire on query result. Actions in packages can be referred to as packagescope/packagename:actionname . | ||
backfillLimit | integer | User-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown. | |||
description | string | Description of the scheduled search. | |||
enabled | boolean | true | Flag indicating whether the scheduled search is enabled. The default is true. | ||
labels | [string] | yes | [ ] | Labels attached to the scheduled search. | |
maxWaitTimeSeconds | long | The maximum number of seconds to wait for ingest delay and query warnings. Only allowed when queryTimestamp is IngestTimestamp where it's mandatory. | |||
name | string | yes | Name of the scheduled search. | ||
queryOwnershipType | QueryOwnershipType | yes | Ownership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType . | ||
queryString | string | yes | LogScale query to execute. | ||
queryTimestampType | QueryTimestampType | yes | The timestamp type to use for the query. Running on @ingesttimestamp is only available with feature flag, ScheduledSearchIngestTimestamp . See QueryTimestampType . | ||
runAsUserId | string | The scheduled search will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. It requires the 'ChangeTriggersToRunAsOtherUsers' permission to set this field to a user id different from the calling user. | |||
schedule | string | yes | Cron pattern describing the schedule to execute the query on. | ||
searchIntervalOffsetSeconds | long | The offset of the search interval in seconds. Only allowed when queryTimestampType is EventTimestamp where it's mandatory. | |||
searchIntervalSeconds | long | The search interval in seconds. | |||
timeZone | string | yes | Time zone of the schedule. Currently this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'. | ||
viewName | string | yes | Name of the view of the scheduled search. |
Returned Datatypes
For ScheduledSearch
, there are also several
parameters. Below is a list of them:
Table: ScheduledSearch
Parameter | Type | Required | Default | Stability | Description |
---|---|---|---|---|---|
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column. | |||||
Table last updated: Mar 27, 2025 | |||||
actions | [string] | yes | Long-Term | List of unique identifiers for actions to fire on query result. | |
actionsV2 | [Action ] | yes | Long-Term | List of actions to fire on query result. See Action . | |
allowedActions | [AssetAction ] | yes | Preview | The allowed asset actions. See AssetAction . | |
backfillLimit | integer | Deprecated | User-defined limit, which caps the number of missed searches to backfill (e.g., in the event of a shutdown). This option is deprecated and will be removed at the earliest in version 1.231. Use instead backfillLimitV2 . | ||
backfillLimitV2 | integer | Long-Term | User-defined limit, which caps the number of missed searches to backfill when queryTimestampType is EventTimestamp . | ||
description | string | Long-Term | A description of the scheduled search. | ||
enabled | boolean | yes | Long-Term | Whether the scheduled search is enabled. | |
end | string | yes | Deprecated | The end of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead searchIntervalOffsetSeconds . | |
id | string | yes | Long-Term | The unique identifier of the scheduled search. | |
isStarred | boolean | yes | Deprecated | Whether the calling user has 'starred' the scheduled search. This has been deprecated and is no longer in use and has no effect. It will be removed in version 1.213. | |
labels | [string] | yes | Long-Term | The labels added to the scheduled search. | |
lastError | string | Long-Term | The last error encountered while running the search. | ||
lastExecuted | long | Long-Term | Unix timestamp for end of search interval for last query execution. | ||
lastScheduledSearch | long | Deprecated | The UNIX timestamp at which the last query result was processed. This is deprecated and replaced with lastExecuted and lastTriggered. It will be removed at the earliest in version 1.202. | ||
lastTriggered | long | Long-Term | Unix timestamp for end of search interval for last query execution that triggered. | ||
lastWarnings | [string] | yes | Long-Term | The Last warnings encountered while running the scheduled search. | |
maxWaitTimeSeconds | long | Long-Term | The maximum wait time in seconds when queryTimestampType is IngestTimestamp . | ||
modifiedInfo | ModifiedInfo | yes | Preview | User or token used to modify the asset. See ModifiedInfo . | |
name | string | yes | Long-Term | The name of the scheduled search. | |
package | PackageInstallation | Long-Term | The related package. See PackageInstallation . | ||
packageId | VersionedPackageSpecifier | Long-Term | The unique identifier for the related package. VersionedPackageSpecifier is a scalar. | ||
queryOwnership | QueryOwnership | yes | Long-Term | Ownership of the query run by this scheduled search. See QueryOwnership . | |
queryString | string | yes | Long-Term | The LogScale query to execute. | |
queryTimestampType | QueryTimestampType | yes | Long-Term | The timestamp type to use for the query. Running on @ingesttimestamp is only available with feature flag ScheduledSearchIngestTimestamp . See QueryTimestampType . | |
resource | string | yes | Short-Term | The resource identifier for the scheduled search. | |
runAsUser | User | Long-Term | The unique identifier of the user as which the scheduled search is running. See User . | ||
schedule | string | yes | Long-Term | The cron pattern describing the schedule to execute the query on. | |
searchIntervalOffsetSeconds | long | Long-Term | The search interval offset in seconds when queryTimestampType is EventTimestamp . | ||
searchIntervalSeconds | long | yes | Long-Term | The search interval in seconds. | |
start | string | yes | Deprecated | The start of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead searchIntervalSeconds . | |
timeOfNextPlannedExecution | long | Long-Term | The UNIX timestamp for next planned search. | ||
timeZone | string | yes | Long-Term | Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'. | |
yamlTemplate | yaml | yes | Long-Term | A template that can be used to recreate the scheduled search. |