Skip to main content
Sumo Logic

Edit or Cancel the Schedule for a Search

In the Library, you can edit or cancel a scheduled search at any time. If you cancel a scheduled search, the search reverts to a saved search.

Cancel a Scheduled Search

  1. From the Library, find the scheduled search you want to cancel. For information about finding an item in the Library, see Search the Library
  2. Click the more options menu to the right of the scheduled search and select  Edit
    Library scheduled search edit
  3. In the Edit Search dialog, click Edit this search's schedule.
    Screen Shot 2018-05-06 at 7.58.07 PM.png
  4. From the Run Frequency menu, choose Never to cancel the scheduled search.
  5. Click Update.

Edit a Scheduled Search

  1. From the Library, find the scheduled search you want to cancel. For information about finding an item in the Library, see Search the Library
  2. Click the more options menu to the right of the scheduled search and select  Edit
  3. In the Edit Search dialog, click Edit this search's schedule.
  4. Make the changes, and then click Update.

Edit Permissions

By default, a scheduled search runs in the context of the search creator. In other words, when the search is shared with other users, the creator's role access filter governs what data is returned by the search. 

When you try to edit a scheduled search query, add a schedule to a saved search, or edit a saved search's schedule, Sumo compares your search filter to the search filter currently associated with the scheduled search.

If the search filters match, you can perform the edit. Otherwise, a "Cannot Edit Scheduled Search" message is presented:

connot-edit-scheduled-search.png

You can either:

  • Change the Data Access Level. You can set the data access level to your own. As a result the scheduled search will run with your role search filter applied.  

  • Duplicate. You can make a copy of the scheduled search, and then edit as desired.