diff --git a/docs/alerts/scheduled-searches/schedule-search.md b/docs/alerts/scheduled-searches/schedule-search.md index 0844f607eb0..2c1cd068faf 100644 --- a/docs/alerts/scheduled-searches/schedule-search.md +++ b/docs/alerts/scheduled-searches/schedule-search.md @@ -6,7 +6,7 @@ description: Save and schedule Sumo Logic log searches to run at specified inter import useBaseUrl from '@docusaurus/useBaseUrl'; -This article outlines the process of creating a Scheduled Search, which is essentially a saved [Log Search](/docs/search) that you set to run at specified intervals and configure with [alerts](#step-6-choose-a-scheduled-search-alert-type). +This article outlines the process of creating a Scheduled Search, which is essentially a saved [Log Search](/docs/search) that you set to run at specified intervals and configure with [alerts](#step-6-add-scheduled-search-alert-types). To run a Scheduled Search using receipt time, save the search with receipt time enabled. @@ -101,9 +101,11 @@ The date and time format used for timestamps in your notification payloads is se In the next section, we'll walk you through the available Scheduled Search alert types. -### Step 6. Choose a Scheduled Search alert type +### Step 6. Add Scheduled Search alert types -When creating a Scheduled Search, you can configure various alert types, including: +Under **Notifications**, choose an **Alert Type** for your first alert. To add another, click **Add Notification**. You can add up to 10 alert types to a single Scheduled Search, mixing and matching any combination of the types below instead of choosing just one. For example, add an Email alert and a Webhook alert to the same Scheduled Search, or add multiple Email alerts with different recipients. + +Each alert you add gets its own **Alert Type** dropdown with the same options, and collapses into a summary row once you move on to the next one, for example **Notification 1: Email (jane@example.com)**. Click a row to expand it again, or click its trash icon to remove that alert.
First notification collapsed into a summary row, with a second Alert Type block added below it * [Email](create-email-alert.md). You can create a Scheduled Search to alert you via email when a set of conditions are satisfied. A maximum of 120 emails are sent per day per Scheduled Search. * [Script Action](/docs/send-data/installed-collectors/sources/script-action). Trigger actions based on search results, such as firing SNMP traps. @@ -113,6 +115,10 @@ When creating a Scheduled Search, you can configure various alert types, includi * [Save to Lookup](save-to-lookup.md). Save results to a [Lookup Table](../../search/lookup-tables/create-lookup-table.md) and use the [`lookup`](/docs/search/search-query-language/search-operators/lookup) operator for data enrichment. * [Cloud SIEM Signal](generate-cse-signals.md). Trigger the creation of a Cloud SIEM Signal, which are otherwise generated when the conditions of a Cloud SIEM rule are satisfied by a Record. +All alerts you add share the trigger condition from [Step 5](#step-5-notification-settings) and fire from the same search execution, but each alert's own configuration, such as email recipients or webhook payload, is set independently. The following example combines Email, Webhook, and ServiceNow Connection alerts on one Scheduled Search.
Edit Scheduled Search dialog listing four configured notifications of different alert types + +Scheduled Searches created before multi-alert support was added keep working exactly as configured, with their single alert type unchanged. + ## Troubleshooting Learn how to address common issues with Scheduled Searches: diff --git a/static/img/alerts/schedule-search-add-notification.png b/static/img/alerts/schedule-search-add-notification.png new file mode 100644 index 00000000000..2109e5b963d Binary files /dev/null and b/static/img/alerts/schedule-search-add-notification.png differ diff --git a/static/img/alerts/schedule-search-notifications-list.png b/static/img/alerts/schedule-search-notifications-list.png new file mode 100644 index 00000000000..09099c67fc3 Binary files /dev/null and b/static/img/alerts/schedule-search-notifications-list.png differ