Skip to main content

Difference between Monitors and Scheduled Searches

To understand the difference between Monitors and Scheduled Searches, you'll first need to know the use cases that each solution solves today. 

Scheduled searches solve two main use cases:

  • Alerting you about specific issues happening in your application. For example, you can create scheduled searches to get notified about a spike in the error rate for a service or a stopped process. 
  • Reporting on specific insights from searches on a periodic schedule. For example, you can create a schedule to run daily to notify you about the Daily Active users on your platform.

Monitors are designed to solve the first use case, alerting. It provides additional capabilities like Auto-resolution and support for multiple notification channels. Any scheduled searches that were created to solve the alerting use case can be moved to Monitors. This includes Real-Time Scheduled Searches. 

Apart from the differences in the use cases, there are some feature differences between Scheduled Searches and Monitors for logs.

FeatureScheduled SearchesMonitors (Logs)
Support for Slack, PagerDuty, OpsGenie and other IntegrationsYesYes
Customization of NotificationYesYes
Auto Resolution of IncidentsNoYes
Send Notification to multiple channelsNoYes
Disable AlertsNoYes*
(Disable is a manual operation. We do not support scheduled disabling of alerts.)
API SupportPartial* (Supported via content sync API)Yes
Terraform SupportNo*
The Content API resource allows you to manage Schedule Searches (learn more)
All Log Operators supportedYes*
(Some operators are not supported for Real time alerts)
Outlier based alertsYesYes
Access ControlObject Level Access ControlObject Level Access Control (Per request - limited availability)
Audit Logs for CRUD and System Events (e.g., Notifications Sent, Failures)YesYes
Control Over Schedule of alert/When alert is evaluatedYesNo
One Notification per Log LineYesYes
*Supported via Alert grouping
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.