updateSavedQuery()

The updateSavedQuery() GraphQL mutation is used to update a saved query in LogScale.

Related to this mutation, there are the mutations, createSavedQuery(), copySavedQuery(), and deleteSavedQueryV2() for creating, copying, and deleting saved queries. There are also the createSavedQueryFromTemplate() mutation for creating a saved query using a YAML template, and createSavedQueryFromPackageTemplate() to create one from a template in a package. There is also setDefaultSavedQuery() for marking a saved query as the default.

For more information on saved queries, see the Saved Searches (User Functions) reference page where saved queries are discussed. Also, look at the Search Data documentation page as it relates to recent queries and saving queries.

Hide Query Example

Show Saved Queries Query

To get a list of saved queries, you could use the repositories() query like this:

graphql

query {
     repositories
      { id, name, 
        savedQueries { id, name, query { isLive } } }
   }

API Stability Long-Term

Syntax

graphql

updateSavedQuery(
     input: UpdateSavedQueryInput!
   ): UpdateSavedQueryPayload!

For the input, you'll have to give the name of the view, the saved query's identifier, and whatever you want to change (e.g., the query used). Click on Show Query above to find the identifier. See the Given Datatype section for details on the input parameters.

For the results, you can get a yaml template of the saved query, and related data. See the Returned Datatype section for more.

Example

Raw

graphql

mutation {
  updateSavedQuery( input:
     { id: "abc123",
       viewName: "humio",
       isLive: false
     } 
  )
  { savedQuery { id } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateSavedQuery( input:
     { id: \"abc123\",
       viewName: \"humio\",
       isLive: false
     } 
  )
  { savedQuery { id } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateSavedQuery( input:
     { id: \"abc123\",
       viewName: \"humio\",
       isLive: false
     } 
  )
  { savedQuery { id } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateSavedQuery( input: ^
     { id: \"abc123\", ^
       viewName: \"humio\", ^
       isLive: false ^
     }  ^
  ) ^
  { savedQuery { id } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateSavedQuery( input:
     { id: \"abc123\",
       viewName: \"humio\",
       isLive: false
     } 
  )
  { savedQuery { id } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateSavedQuery( input:
     { id: \"abc123\",
       viewName: \"humio\",
       isLive: false
     } 
  )
  { savedQuery { id } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateSavedQuery( input:
     { id: \"abc123\",
       viewName: \"humio\",
       isLive: false
     } 
  )
  { savedQuery { id } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateSavedQuery( input:
     { id: \"abc123\",
       viewName: \"humio\",
       isLive: false
     } 
  )
  { savedQuery { id } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "updateSavedQuery": {
      "savedQuery": {
        "id": "abc123"
      }
    }
  }
}

Given Datatype

For the input datatype, you'll have to give the name of the view and the unique identifier of the saved query you want to update. After that, you can change many parameters, such as the query used by it. Click on the Show Query link above the Syntax section for an example of how to find the identifier.

Table: UpdateSavedQueryInput

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 23, 2024
customLinkInteractions	[CustomLinkInteractionInput]	yes	`Long-Term`	The custom links for interactions. See CustomLinkInteractionInput.
dashboardLinkInteractions	[DashboardLinkInteractionInput]	yes	`Long-Term`	The dashboard links for interactions. See DashboardLinkInteractionInput.
end	string		`Long-Term`	The ending point of the saved query.
id	string	yes	`Long-Term`	The unique identifier of the saved query to update.
isLive	boolean		`Long-Term`	Whether the saved query is executed continuously on live, streaming data.
name	string		`Long-Term`	The name of the saved query to update.
options	string		`Long-Term`	Any options related to the saved query.
queryString	string		`Long-Term`	The new query.
searchLinkInteractions	[SearchLinkInteractionInput]	yes	`Long-Term`	The search links for interactions. See SearchLinkInteractionInput.
start	string		`Long-Term`	The starting point of the saved query.
updateParametersInteractions	[UpdateParametersInteractionInput]	yes	`Long-Term`	The parameters to update for interactions. See UpdateParametersInteractionInput.
viewName	string	yes	`Long-Term`	The name of the view associated with the saved query.
widgetType	string		`Long-Term`	The type of widget for displaying the results of the saved query.

Returned Datatype

With the returned datatype, by way of sub-parameters, you can get a yaml template of the saved query, when and who created it, and other related data. The table below contains a link to another table with the sub-parameters:

Table: UpdateSavedQueryPayload

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 4, 2024
savedQuery	SavedQuery	yes	`Long-Term`	The saved query to update. See SavedQuery.

The datatype above uses another datatype for information on the saved query. For your convenience, the table for that sub-datatype is included here:

Table: SavedQuery

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Apr 13, 2026
allowedActions	[AssetAction]	yes	`Short-Term`	The allowed asset actions. See AssetAction . This is a preview and subject to change.
createdInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the creation of the saved query. See AssetCommitMetadata.
description	string		`Long-Term`	A description of the saved query.
displayName	string	yes	`Long-Term`	The display name of the saved query.
id	string	yes	`Long-Term`	The unique identifier for the saved query.
interactions	[QueryBasedWidgetInteraction]	yes	`Long-Term`	The interactions of the saved query. See QueryBasedWidgetInteraction.
isStarred	boolean	yes	`Long-Term`	Whether the saved query has been marked with a star.
labels	[string]	yes	`Long-Term`	The labels associated with this saved query.
modifiedInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the latest modification of the saved query. See AssetCommitMetadata.
name	string	yes	`Long-Term`	The name of the saved query.
options	JSON	yes	`Long-Term`	Options related to the saved query, in JSON form. JSON is a scalar.
package	PackageInstallation		`Long-Term`	The package, if there is one, in which the saved query is included. See PackageInstallation.
packageId	VersionedPackageSpecifier		`Long-Term`	The unique identifier of the package. VersionedPackageSpecifier is a scalar value.
qualifiedName	string	yes	`Preview`	The fully qualified reference format, including the view.
query	HumioQuery	yes	`Long-Term`	The saved query itself. See HumioQuery.
resource	string	yes	`Short-Term`	The resource identifier for this saved query.
widgetType	string	yes	`Long-Term`	The type of widget used with the saved query.
yamlTemplate	YAML	yes	`Long-Term`	A yaml formatted string that describes the saved query. YAML is a scalar. This replaced templateYaml starting in LogScale version 1.225.

Versions of this Page

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes