Skip to main content
Sumo Logic

Save a Search

Whether you are running ad hoc searches during a forensic investigation or running standard searches for health checks, you can save any search to run again later.

When you create a search that you would like to reuse, you can save it to the Library. From there you can run it again, share with others, edit the search, or create a Scheduled Search to run at a regularly scheduled time, and set up alerts

The saved search will also include any charts you have created in the Aggregates tab. 

To save a search:

  1. Run a search you'd like to save.
  2. (Optional) After the search results are complete, in the Aggregates tab, select a chart type to display the data visually. 
  3. Click the save icon on the top right of the search page,

    save search icon feb 2022.png

    or click the three-dot icon and select Save As.

    save as from menu.png

    The Save option is for searches that have already been saved to your Library. Save allows you to quickly update the existing saved search. The Save as option is for a new saved search and requires you to provide it a name. A saved search will provide a shortcut for both options:

    save as option.png

  4. In the Save Item dialog appears.

    save search dec2020.png

  5. Name. Enter a name for your saved search.
  6. Description. (Optional). Enter a description for the search. 
  7. Query. You can edit your query if desired.
  8. Choose a Time Range that will be the default range when you run the saved search.
  9. Search By. Select if you want to save the search using message or receipt time. For more information, see Use Receipt Time.
  10. Search Mode. Select Manual or Auto Parse Mode. For more information, see Dynamic Parsing.
  11. Location to save to. Select a folder location for the saved search 
  12. Click Save to save the search without scheduling.  If you want to schedule the search and optionally configure an alert, click Schedule this search and follow the instructions on Schedule a Search