updateScheduledSearchV2()

API Stability	`Preview`

The updateScheduledSearchV2() GraphQL mutation field is used to update a scheduled search.

Syntax

Below is the syntax for the updateScheduledSearchV2() mutation field:

graphql

updateScheduledSearchV2(
       input: UpdateScheduledSearchV2!
    ): ScheduledSearch!

Below is an example of how this mutation field might be used:

Show:

graphql

mutation {
  updateScheduledSearchV2( input:
    { viewName: "humio",
      id: "abc123",
      name: "mySearch",
      queryString: "@host=localhost",
      searchIntervalSeconds: 10,
      schedule: "15 1 * * *",
      timeZone: "UTC+2",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User
    }
  )
 { id }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateScheduledSearchV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User
    }
  )
 { id }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateScheduledSearchV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User
    }
  )
 { id }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateScheduledSearchV2( input: ^
    { viewName: \"humio\", ^
      id: \"abc123\", ^
      name: \"mySearch\", ^
      queryString: \"@host=localhost\", ^
      searchIntervalSeconds: 10, ^
      schedule: \"15 1 * * *\", ^
      timeZone: \"UTC+2\", ^
      enabled: false, ^
      actionIdsOrNames: [], ^
      labels: [], ^
      queryOwnershipType: User ^
    } ^
  ) ^
 { id } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateScheduledSearchV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User
    }
  )
 { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  updateScheduledSearchV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User
    }
  )
 { id }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateScheduledSearchV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User
    }
  )
 { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateScheduledSearchV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User
    }
  )
 { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "updateScheduledSearchV2": {
      "id": "abc123"
    }
  }
}

Given Datatypes

For UpdateScheduledSearchV2, there are several parameters. Below is a list of them:

Table: UpdateScheduledSearchV2

Parameter	Type	Required	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Feb 24, 2025
`actions`	[string]	yes	A list of ids or names for actions to fire on query result. Actions in packages can be referred to as `packagescope/packagename:actionname`.
`backfillLimit`	integer		User-defined limit, which caps the number of missed searches to backfill, e.g. in the event of a shutdown.
`description`	string		Description of the scheduled search.
`enabled`	boolean		Flag indicating whether the scheduled search is enabled. The default is true.
`id`	string	yes	The unique identifier of the scheduled search.
`labels`	[string]	yes	Labels attached to the scheduled search.
`maxWaitTimeSeconds`	long		The maximum number of seconds to wait for ingest delay and query warnings. Only allowed when `queryTimestamp` is `IngestTimestamp` where it's mandatory.
`name`	string	yes	Name of the scheduled search.
`queryOwnershipType`	`QueryOwnershipType`	yes	Ownership of the query run by this scheduled search. If value is User, ownership will be based on the `runAsUserId` field. See `QueryOwnershipType`.
`queryString`	string	yes	LogScale query to execute.
`queryTimestampType`	`QueryTimestampType`	yes	The timestamp type to use for the query. Running on `@ingesttimestamp` is only available with feature flag, `ScheduledSearchIngestTimestamp`. See `QueryTimestampType`.
`runAsUserId`	string		The scheduled search will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. It requires the 'ChangeTriggersToRunAsOtherUsers' permission to set this field to a user id different from the calling user.
`schedule`	string	yes	Cron pattern describing the schedule to execute the query on.
`searchIntervalOffsetSeconds`	long		The offset of the search interval in seconds. Only allowed when `queryTimestampType` is `EventTimestamp` where it's mandatory.
`searchIntervalSeconds`	long		The search interval in seconds.
`timeZone`	string	yes	Time zone of the schedule. Currently this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
`viewName`	string	yes	Name of the view of the scheduled search.

Returned Datatypes

For ScheduledSearch, there are also several parameters. Below is a list of them:

Table: ScheduledSearch

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 27, 2025
`actions`	[string]	yes	`Long-Term`	List of unique identifiers for actions to fire on query result.
`actionsV2`	[`Action`]	yes	`Long-Term`	List of actions to fire on query result. See `Action`.
`allowedActions`	[`AssetAction`]	yes	`Preview`	The allowed asset actions. See `AssetAction`.
`backfillLimit`	integer		`Deprecated`	User-defined limit, which caps the number of missed searches to backfill (e.g., in the event of a shutdown). This option is deprecated and will be removed at the earliest in version 1.231. Use instead `backfillLimitV2`.
`backfillLimitV2`	integer		`Long-Term`	User-defined limit, which caps the number of missed searches to backfill when `queryTimestampType` is `EventTimestamp`.
`description`	string		`Long-Term`	A description of the scheduled search.
`enabled`	boolean	yes	`Long-Term`	Whether the scheduled search is enabled.
`end`	string	yes	`Deprecated`	The end of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead `searchIntervalOffsetSeconds`.
`id`	string	yes	`Long-Term`	The unique identifier of the scheduled search.
`isStarred`	boolean	yes	`Deprecated`	Whether the calling user has 'starred' the scheduled search. This has been deprecated and is no longer in use and has no effect. It will be removed in version 1.213.
`labels`	[string]	yes	`Long-Term`	The labels added to the scheduled search.
`lastError`	string		`Long-Term`	The last error encountered while running the search.
`lastExecuted`	long		`Long-Term`	Unix timestamp for end of search interval for last query execution.
`lastScheduledSearch`	long		`Deprecated`	The UNIX timestamp at which the last query result was processed. This is deprecated and replaced with lastExecuted and lastTriggered. It will be removed at the earliest in version 1.202.
`lastTriggered`	long		`Long-Term`	Unix timestamp for end of search interval for last query execution that triggered.
`lastWarnings`	[string]	yes	`Long-Term`	The Last warnings encountered while running the scheduled search.
`maxWaitTimeSeconds`	long		`Long-Term`	The maximum wait time in seconds when `queryTimestampType` is `IngestTimestamp`.
`modifiedInfo`	`ModifiedInfo`	yes	`Preview`	User or token used to modify the asset. See `ModifiedInfo`.
`name`	string	yes	`Long-Term`	The name of the scheduled search.
`package`	`PackageInstallation`		`Long-Term`	The related package. See `PackageInstallation`.
`packageId`	`VersionedPackageSpecifier`		`Long-Term`	The unique identifier for the related package. VersionedPackageSpecifier is a scalar.
`queryOwnership`	`QueryOwnership`	yes	`Long-Term`	Ownership of the query run by this scheduled search. See `QueryOwnership`.
`queryString`	string	yes	`Long-Term`	The LogScale query to execute.
`queryTimestampType`	`QueryTimestampType`	yes	`Long-Term`	The timestamp type to use for the query. Running on `@ingesttimestamp` is only available with feature flag `ScheduledSearchIngestTimestamp`. See `QueryTimestampType`.
`resource`	string	yes	`Short-Term`	The resource identifier for the scheduled search.
`runAsUser`	`User`		`Long-Term`	The unique identifier of the user as which the scheduled search is running. See `User`.
`schedule`	string	yes	`Long-Term`	The cron pattern describing the schedule to execute the query on.
`searchIntervalOffsetSeconds`	long		`Long-Term`	The search interval offset in seconds when `queryTimestampType` is `EventTimestamp`.
`searchIntervalSeconds`	long	yes	`Long-Term`	The search interval in seconds.
`start`	string	yes	`Deprecated`	The start of the relative time interval for the query. This parameter is deprecated and will be removed at the earliest in version 1.231. Use instead `searchIntervalSeconds`.
`timeOfNextPlannedExecution`	long		`Long-Term`	The UNIX timestamp for next planned search.
`timeZone`	string	yes	`Long-Term`	Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
`yamlTemplate`	`yaml`	yes	`Long-Term`	A template that can be used to recreate the scheduled search.

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes

updateScheduledSearchV2()

Syntax

Given Datatypes

Returned Datatypes

Enter search term