removeScheduledSearchLabels()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The removeScheduledSearchLabels() mutation removes one or more labels from a scheduled search. You can remove up to 100 labels in a single call. Each scheduled search supports at most ten labels, with a maximum of sixty characters per label. To add labels, use addScheduledSearchLabels().

To add labels to a scheduled search, use addScheduledSearchLabels(). No mutation replaces labels in a single operation. Remove the old label with this mutation, then add the new one with addScheduledSearchLabels(). Include scheduledSearches { labels } in a repositories() or repository() query to retrieve existing labels.

Hide Query Example

Show Scheduled Search Labels Query

To get a list of scheduled search labels, execute the repositories() query like this:

graphql

query {
     repositories
      { id, name,
        scheduledSearches { labels } }
   }

For more information on scheduled searches, see Scheduled Searches. To manage labels through the UI, see Manage Triggers.

Syntax

graphql

removeScheduledSearchLabels(
      input: RemoveScheduledSearchLabels!
   ): ScheduledSearch

The mutation requires a single input argument of type RemoveScheduledSearchLabels!.

Provide the repository or view name, scheduled search ID, and an array of labels to remove. Use the query in the following example to retrieve scheduled search identifiers.

Hide Query Example

Show Scheduled Search Identifiers Query

To get a list of all scheduled searches for a repository, use the repository() query as follows:

graphql

query {
     repository(name: "humio")
        { scheduledSearches { name, id } }
   }

With these results you can use a scheduled search's unique identifier to remove labels from it.

Input parameters

Provide the repository or view name, scheduled search ID, and an array of labels to remove. A scheduled search supports at most ten labels total. To find scheduled search identifiers, select the query in the Syntax section.

Example

Raw

graphql

mutation {
  removeScheduledSearchLabels(input: 
       { viewName: "humio", 
         id: "abc123", 
         labels: [ "find-them-1" ] 
        } 
    )
  {enabled, labels }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\" ] 
        } 
    )
  {enabled, labels }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\" ] 
        } 
    )
  {enabled, labels }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeScheduledSearchLabels(input:  ^
       { viewName: \"humio\",  ^
         id: \"abc123\",  ^
         labels: [ \"find-them-1\" ]  ^
        }  ^
    ) ^
  {enabled, labels } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\" ] 
        } 
    )
  {enabled, labels }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\" ] 
        } 
    )
  {enabled, labels }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\" ] 
        } 
    )
  {enabled, labels }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeScheduledSearchLabels(input: 
       { viewName: \"humio\", 
         id: \"abc123\", 
         labels: [ \"find-them-1\" ] 
        } 
    )
  {enabled, labels }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeScheduledSearchLabels": {
      "enabled": true,
      "labels": [ "admin-focus" ]
    }
  }
}

Returned values

The mutation returns a ScheduledSearch object on success, or null if the operation fails. Use labels to confirm which labels remain after the removal. It also includes the query string, configured actions, and any errors from the last execution.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes