API Stability Deprecated

The savedQuery() GraphQL query is used to retrieve a saved query. However, this is deprecated because it's no longer used internally and bad performance was found to be tied to its implementation. It will be removed at the earliest in version 1.225.

Use instead searchDomain() with the SavedQuery parameter.

For more information on saved queries, see the User Functions (Saved Searches) reference page where saved queries are discussed. Also, look at the Search Data documentation page as it relates to recent queries and saving queries.

Syntax

Below is the syntax for the savedQuery() query field:

graphql
savedQuery(
     id: string!
   ): SavedQuery!

Below is an example of how this query field might be used:

Raw
graphql
query {
  savedQuery(id:"1234")
     { name, displayName, isStarred, 
       query{arguments{key, value}} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  savedQuery(id:\"1234\")
     { name, displayName, isStarred, 
       query{arguments{key, value}} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  savedQuery(id:\"1234\")
     { name, displayName, isStarred, 
       query{arguments{key, value}} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  savedQuery(id:\"1234\") ^
     { name, displayName, isStarred,  ^
       query{arguments{key, value}} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  savedQuery(id:\"1234\")
     { name, displayName, isStarred, 
       query{arguments{key, value}} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "query {
  savedQuery(id:\"1234\")
     { name, displayName, isStarred, 
       query{arguments{key, value}} }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  savedQuery(id:\"1234\")
     { name, displayName, isStarred, 
       query{arguments{key, value}} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  savedQuery(id:\"1234\")
     { name, displayName, isStarred, 
       query{arguments{key, value}} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Returned Datatypes

The returned datatype SavedQuery has its own parameters. Below is a list of them along with their datatypes and a description of each:

Table: SavedQuery

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Aug 21, 2025
allowedActions[AssetAction]yes Short-TermThe allowed asset actions. See AssetAction. This is a preview and subject to change.
createdInfoAssetCommitMetadata  PreviewMetadata related to the creation of the saved query. See AssetCommitMetadata.
descriptionstring  Long-TermA description of the saved query.
displayNamestringyes Long-TermThe display name of the saved query.
idstringyes Long-TermThe unique identifier for the saved query.
interactions[QueryBasedWidgetInteraction]yes Long-TermThe interactions of the saved query. See QueryBasedWidgetInteraction.
isStarredbooleanyes Long-TermWhether the saved query has been marked with a star.
labels[string]yes Long-TermThe labels associated with this saved query.
modifiedInfoAssetCommitMetadata  PreviewMetadata related to the latest modification of the saved query. See AssetCommitMetadata.
namestringyes Long-TermThe name of the saved query.
optionsJSONyes Long-TermOptions related to the saved query, in JSON form.
packagePackageInstallation  Long-TermThe package, if there is one, in which the saved query is included. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-TermThe unique identifier of the package. VersionedPackageSpecifier is a scalar value.
queryHumioQueryyes Long-TermThe saved query itself. See HumioQuery.
resourcestringyes Short-TermThe resource identifier for this saved query.
widgetTypestringyes Long-TermThe type of widget used with the saved query.
yamlTemplateYAMLyes Long-TermA YAML formatted string that describes the saved query. This replaced templateYaml starting in LogScale version 1.225.