enableScheduledSearch()

Summary

The enableScheduledSearch() mutation enables execution of a previously disabled scheduled search, restoring automated query execution on its configured schedule.

This mutation is deprecated and will be removed at the earliest in version 1.273. Use enableScheduledSearchV2() instead.

Use disableScheduledSearchV2() to disable a scheduled search. Use createScheduledSearchV2() to create a new scheduled search. Use updateScheduledSearchV3() to modify an existing scheduled search's configuration. Use deleteScheduledSearchV2() to remove a scheduled search permanently.

Hide Scheduled Searches Query

Show Scheduled Searches Query

To get a list of scheduled searches, use the repositories() query:

graphql

query {
     repositories
      { id, name, 
        scheduledSearches { id, name, 
                            timeOfLastExecution,
                            queryString } 
        }
   }

For more information on scheduled searches, see Scheduled Searches.

Syntax

graphql

enableScheduledSearch(
      input: EnableStarScheduledSearch!
   ): ScheduledSearch!

The mutation takes a single required input argument of type EnableStarScheduledSearch!, which identifies the scheduled search by its unique id and the viewName of the associated view or repository. See the Input Parameters section for details.

The mutation returns a non-null ScheduledSearch! object containing the query string, configured actions, and any errors or warnings from the last execution. See the Returned Values section for details.

Example

Raw

graphql

mutation {
  enableScheduledSearch( input:
    {
      viewName: "humio"
      id: "abc123"
    } ) 
  { name }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  enableScheduledSearch( input:
    {
      viewName: \"humio\"
      id: \"abc123\"
    } ) 
  { name }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  enableScheduledSearch( input:
    {
      viewName: \"humio\"
      id: \"abc123\"
    } ) 
  { name }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  enableScheduledSearch( input: ^
    { ^
      viewName: \"humio\" ^
      id: \"abc123\" ^
    } )  ^
  { name } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  enableScheduledSearch( input:
    {
      viewName: \"humio\"
      id: \"abc123\"
    } ) 
  { name }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  enableScheduledSearch( input:
    {
      viewName: \"humio\"
      id: \"abc123\"
    } ) 
  { name }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  enableScheduledSearch( input:
    {
      viewName: \"humio\"
      id: \"abc123\"
    } ) 
  { name }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  enableScheduledSearch( input:
    {
      viewName: \"humio\"
      id: \"abc123\"
    } ) 
  { name }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "enableScheduledSearch": {
      "name": "Seeker"
    }
  }
}

Input Parameters

Provide the id of the scheduled search to enable and the viewName of the associated view or repository. To retrieve a scheduled search identifier, use the Show Scheduled Searches Query in the Related section.

Table: EnableStarScheduledSearch Input Datatype

Parameter	Type	Required	Default	Stability	Availability	Description
id	String	yes		`Long-Term`		The unique identifier of the scheduled search.
viewName	String	yes		`Long-Term`		The name of the view associated with the scheduled search.

Returned Values

The mutation returns a non-null ScheduledSearch object. Check the enabled field to confirm the scheduled search is now active. The object also includes the query string, configured actions, and any errors or warnings from the last execution. The following table lists all available fields.

Table: ScheduledSearch Datatype

Parameter	Type	Required	Stability	Availability	Description
actions	String	yes	`Long-Term`		List of unique identifiers for actions to fire on query result.
actionsV2	Action	yes	`Long-Term`		List of actions to fire on query result. See Action.
allowedActions	AssetAction	yes	`Short-Term`		The allowed asset actions. See AssetAction .
backfillLimitV2	Int		`Long-Term`		User-defined limit, which caps the number of missed searches to backfill when queryTimestampType is `EventTimestamp`.
createdInfo	AssetCommitMetadata		`Long-Term`		Metadata related to the creation of the scheduled search. See AssetCommitMetadata.
description	String		`Long-Term`		A description of the scheduled search.
enabled	Boolean	yes	`Long-Term`		Whether the scheduled search is enabled.
executionTimesToRerun	Long	yes	`Long-Term`		Execution times of the scheduled search runs to rerun as Unix timestamp in milliseconds.
id	String	yes	`Long-Term`		The unique identifier of the scheduled search.
labels	String	yes	`Long-Term`		The labels added to the scheduled search.
lastError	String		`Long-Term`		The last error encountered while running the search.
lastExecuted	Long		`Deprecated`	deprecated in 1.282	Unix timestamp for end of search interval for last query execution. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastExecution parameter.
lastTriggered	Long		`Deprecated`	deprecated in 1.282	Unix timestamp for end of search interval for last query execution that triggered. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastTrigger parameter.
lastWarnings	String	yes	`Long-Term`		The Last warnings encountered while running the scheduled search.
maxWaitTimeSeconds	Long		`Long-Term`		The maximum wait time in seconds when queryTimestampType is `IngestTimestamp`.
modifiedInfo	ModifiedInfo	yes	`Long-Term`		User or token used to modify the asset. See ModifiedInfo.
name	String	yes	`Long-Term`		The name of the scheduled search.
package	PackageInstallation		`Long-Term`		The related package. See PackageInstallation.
packageId	VersionedPackageSpecifier		`Long-Term`		The unique identifier for the related package. VersionedPackageSpecifier is a scalar.
queryOwnership	QueryOwnership	yes	`Long-Term`		Ownership of the query run by this scheduled search. See QueryOwnership.
queryString	String	yes	`Long-Term`		The LogScale query to execute.
queryTimestampType	QueryTimestampType	yes	`Long-Term`		The timestamp type to use for the query. Running on `@ingesttimestamp` is only available with feature flag `ScheduledSearchIngestTimestamp`. See QueryTimestampType .
resource	String	yes	`Short-Term`		The resource identifier for the scheduled search.
runAsUser	User		`Long-Term`		The unique identifier of the user as which the scheduled search is running. See User.
schedule	String	yes	`Long-Term`		The cron pattern describing the schedule to execute the query on.
searchIntervalOffsetSeconds	Long		`Long-Term`		The search interval offset in seconds when queryTimestampType is `EventTimestamp`.
searchIntervalSeconds	Long	yes	`Long-Term`		The search interval in seconds.
timeOfLastExecution	Long		`Long-Term`		Unix timestamp for when the scheduled search was last executed.
timeOfLastTrigger	Long		`Long-Term`		Unix timestamp for when the scheduled search was last triggered.
timeOfNextPlannedExecution	Long		`Long-Term`		The UNIX timestamp for next planned search.
timeZone	String	yes	`Long-Term`		Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
triggerOnEmptyResult	Boolean	yes	`Long-Term`		Flag indicating whether the scheduled search should trigger when it finds an empty result (i.e., no events).
yamlTemplate	YAML	yes	`Long-Term`		A template that can be used to recreate the scheduled search. YAML is a scalar.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes