🔒Security Requirements and Controls
🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createScheduledSearchV2() mutation creates a scheduled search in a LogScale view. A scheduled search runs a query on a defined schedule and triggers configured actions when the results meet specified conditions. Use updateScheduledSearchV3() to modify an existing scheduled search after creation.

Syntax

graphql
createScheduledSearchV2(
      input: CreateScheduledSearchV2!
   ): ScheduledSearch!

The mutation accepts a single required argument, input, of type CreateScheduledSearchV2!. The input specifies the view name, query string, cron schedule, time zone, and the actions to execute when the scheduled search runs. See the Input Parameters section for all available fields.

On success, the mutation returns a ScheduledSearch! object representing the newly created scheduled search. The return type is non-null. See the Returned Values section for the available fields.

Example

Raw
graphql
mutation {
  createScheduledSearchV2( input:
    { viewName: "humio",
      name: "mySearch",
      queryString: "@host=localhost",
      searchIntervalSeconds: 10,
      schedule: "15 1 * * *",
      timeZone: "UTC+2",
      enabled: true,
      actionIdsOrNames: [],
      queryOwnershipType: User,
      queryTimestampType: EventTimestamp
    }
  )
 { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createScheduledSearchV2( input:
    { viewName: \"humio\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: true,
      actionIdsOrNames: [],
      queryOwnershipType: User,
      queryTimestampType: EventTimestamp
    }
  )
 { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createScheduledSearchV2( input:
    { viewName: \"humio\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: true,
      actionIdsOrNames: [],
      queryOwnershipType: User,
      queryTimestampType: EventTimestamp
    }
  )
 { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createScheduledSearchV2( input: ^
    { viewName: \"humio\", ^
      name: \"mySearch\", ^
      queryString: \"@host=localhost\", ^
      searchIntervalSeconds: 10, ^
      schedule: \"15 1 * * *\", ^
      timeZone: \"UTC+2\", ^
      enabled: true, ^
      actionIdsOrNames: [], ^
      queryOwnershipType: User, ^
      queryTimestampType: EventTimestamp ^
    } ^
  ) ^
 { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createScheduledSearchV2( input:
    { viewName: \"humio\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: true,
      actionIdsOrNames: [],
      queryOwnershipType: User,
      queryTimestampType: EventTimestamp
    }
  )
 { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createScheduledSearchV2( input:
    { viewName: \"humio\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: true,
      actionIdsOrNames: [],
      queryOwnershipType: User,
      queryTimestampType: EventTimestamp
    }
  )
 { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createScheduledSearchV2( input:
    { viewName: \"humio\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: true,
      actionIdsOrNames: [],
      queryOwnershipType: User,
      queryTimestampType: EventTimestamp
    }
  )
 { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createScheduledSearchV2( input:
    { viewName: \"humio\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: true,
      actionIdsOrNames: [],
      queryOwnershipType: User,
      queryTimestampType: EventTimestamp
    }
  )
 { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createScheduledSearchV2": {
      "id": "abc123"
    }
  }
}

Input Parameters

The input argument requires the name of the view associated with the scheduled search, the query string to execute, and the schedule on which to run it. The following table describes all fields of the CreateScheduledSearchV2 input type:

Table: CreateScheduledSearchV2 Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionIdsOrNamesStringyes Long-Term A list of identifiers or names for actions to fire on query result. No more than ten actions can be added. Actions in packages can be referred to as packagescope/packagename:actionname.
backfillLimitInt  Long-Term User-defined limit, which caps the number of missed searches to backfill (e.g., in the event of a shutdown). This is only allowed when queryTimestampType is set to EventTimestamp, where it's mandatory.
descriptionString  Long-Term Description of the scheduled search.
enabledBoolean  Long-Term Flag indicating whether the scheduled search is enabled.
labelsStringyes Long-Term Labels attached to the scheduled search.
maxWaitTimeSecondsLong  Long-Term The maximum number of seconds to wait for ingest delay and query warnings. Only allowed when queryTimestamp is IngestTimestamp where it's mandatory.
nameStringyes Long-Term The name of the scheduled search.
queryOwnershipTypeQueryOwnershipTypeyes Long-Term The ownership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStringStringyes Long-Term The LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-Term The timestamp type to use for the query. QueryTimestampType.
runAsUserIdString  Long-Term The scheduled search will run with the permissions of the user corresponding to this unique identifier if the queryOwnershipType field is set to User. If it's set to Organization, while runAsUserId is set, it will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. The ChangeTriggersToRunAsOtherUsers permission is required to set this field to a different user other than the calling user.
scheduleStringyes Long-Term Cron pattern describing the schedule on which to execute the query.
searchIntervalOffsetSecondsLong  Long-Term The offset of the search interval in seconds. This is only allowed when queryTimestampType is set to EventTimestamp, where it's mandatory.
searchIntervalSecondsLongyes Long-Term The search interval in seconds.
timeZoneStringyes Long-Term Time zone of the schedule. Currently, this field only supports UTC offsets (i.e., 'UTC', 'UTC-01' or 'UTC+12:45').
triggerOnEmptyResultBoolean  Long-Term Whether the scheduled search should trigger when it finds en empty result (i.e., no events).
viewNameStringyes Long-Term The name of the view of the scheduled search.

Returned Values

The mutation returns a ScheduledSearch object representing the newly created scheduled search. The returned fields include the unique identifier, name, query string, cron schedule, time zone, and enabled status. Use the returned identifier to reference the scheduled search in subsequent updateScheduledSearchV3(), enableScheduledSearchV2(), disableScheduledSearchV2(), or deleteScheduledSearchV2() calls.

Table: ScheduledSearch Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsStringyes Long-Term List of unique identifiers for actions to fire on query result.
actionsV2Actionyes Long-Term List of actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term The allowed asset actions. See AssetAction .
backfillLimitV2Int  Long-Term User-defined limit, which caps the number of missed searches to backfill when queryTimestampType is EventTimestamp.
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the scheduled search. See AssetCommitMetadata.
descriptionString  Long-Term A description of the scheduled search.
enabledBooleanyes Long-Term Whether the scheduled search is enabled.
executionTimesToRerunLongyes Long-Term Execution times of the scheduled search runs to rerun as Unix timestamp in milliseconds.
idStringyes Long-Term The unique identifier of the scheduled search.
labelsStringyes Long-Term The labels added to the scheduled search.
lastErrorString  Long-Term The last error encountered while running the search.
lastExecutedLong  Deprecateddeprecated in 1.282Unix timestamp for end of search interval for last query execution. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastExecution parameter.
lastTriggeredLong  Deprecateddeprecated in 1.282Unix timestamp for end of search interval for last query execution that triggered. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastTrigger parameter.
lastWarningsStringyes Long-Term The Last warnings encountered while running the scheduled search.
maxWaitTimeSecondsLong  Long-Term The maximum wait time in seconds when queryTimestampType is IngestTimestamp.
modifiedInfoModifiedInfoyes Long-Term User or token used to modify the asset. See ModifiedInfo.
nameStringyes Long-Term The name of the scheduled search.
packagePackageInstallation  Long-Term The related package. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The unique identifier for the related package. VersionedPackageSpecifier is a scalar.
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this scheduled search. See QueryOwnership.
queryStringStringyes Long-Term The LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-Term The timestamp type to use for the query. Running on @ingesttimestamp is only available with feature flag ScheduledSearchIngestTimestamp. See QueryTimestampType .
resourceStringyes Short-Term The resource identifier for the scheduled search.
runAsUserUser  Long-Term The unique identifier of the user as which the scheduled search is running. See User.
scheduleStringyes Long-Term The cron pattern describing the schedule to execute the query on.
searchIntervalOffsetSecondsLong  Long-Term The search interval offset in seconds when queryTimestampType is EventTimestamp.
searchIntervalSecondsLongyes Long-Term The search interval in seconds.
timeOfLastExecutionLong  Long-Term Unix timestamp for when the scheduled search was last executed.
timeOfLastTriggerLong  Long-Term Unix timestamp for when the scheduled search was last triggered.
timeOfNextPlannedExecutionLong  Long-Term The UNIX timestamp for next planned search.
timeZoneStringyes Long-Term Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
triggerOnEmptyResultBooleanyes Long-Term Flag indicating whether the scheduled search should trigger when it finds an empty result (i.e., no events).
yamlTemplateYAMLyes Long-Term A template that can be used to recreate the scheduled search. YAML is a scalar.