Skip to main content
Sumo Logic

Schedule a Search

When you save a search, you can add a schedule to run it at a regularly scheduled time, and even add alerts. For alert types, see Scheduled Searches

You can create a scheduled search at the same time you are creating a saved search. 

Schedule a search

  1. Save a search
  2. To set a schedule for this search, or to set the search to run periodically with an optional alert, click Schedule this search
  3. Select a run frequency. When you make a selection, the additional settings are displayed.
    scheduled search custom email
    1. Run Frequency. Select the frequency you would like your search to run and the time it should start. 
      • Never. Choose this option to temporarily turn off a scheduled search.
      • Real Time. Sumo Logic Trial, Professional, and Enterprise customers can use this option to set up a Real Time Alert.
      • Every 15 minutes. The search will run every 15 minutes, but not exactly at :00, :15, :30, and :45.
      • Hourly. The search will run every hour.
      • Every 2, 4, 6, 8, or 12 Hours. The search will run for the first time at the top of the hour you choose.
      • Daily. You may also select that your search runs every Day, every Weekday (Mon-Fri) or Weekend (Sat-Sun) and the time. A Daily search will cover exactly 24 hours of activity. You can change the schedule whenever you'd like. (Be aware that a scheduled search will run according to the time zone set on your computer at the time you configure the search. For example, if you are in San Francisco and set a search to run at 7:00 AM, it will run at 7:00 AM PST. If you then fly to New York, and your computer resets to EST, when you schedule a new search at 7:00 AM, it will run at 7:00 AM EST. These two searches will run at different times.)
      • Weekly. The search will run every week. You may also select the day of the week that it runs and the time. 
      • Custom Cron. Enter a custom CRON expression. The run frequency for a CRON expression must be at least every 15 minutes. For details, see Cron Examples and Reference
      • For users in timezones that are +/- 30 minutes, the minute is based on UTC. So for customers in the IST timezone, there will be a 30-minute offset. So instead of starting at :00, it will be :30.
    2. Time range for scheduled search. Select the Last 24 Hours, to get a daily alert. Otherwise, select the time range you want the scheduled search to be run on. Alternately type a time range; for example, -15m to run the search against data generated in the past 15 minutes.
    3. Timezone for scheduled search. Select the timezone you would like your scheduled search to use. If you don't make a selection, the scheduled search will use the timezone from your browser, which is the default selection.  
    4. Alert condition. Select this option to Send Notification. For more details see create an email alert.