Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions docs/alerts/scheduled-searches/schedule-search.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ description: Save and schedule Sumo Logic log searches to run at specified inter

import useBaseUrl from '@docusaurus/useBaseUrl';

This article outlines the process of creating a Scheduled Search, which is essentially a saved [Log Search](/docs/search) that you set to run at specified intervals and configure with [alerts](#step-6-choose-a-scheduled-search-alert-type).
This article outlines the process of creating a Scheduled Search, which is essentially a saved [Log Search](/docs/search) that you set to run at specified intervals and configure with [alerts](#step-6-add-scheduled-search-alert-types).

To run a Scheduled Search using receipt time, save the search with receipt time enabled.

Expand Down Expand Up @@ -101,9 +101,11 @@ The date and time format used for timestamps in your notification payloads is se

In the next section, we'll walk you through the available Scheduled Search alert types.

### Step 6. Choose a Scheduled Search alert type
### Step 6. Add Scheduled Search alert types

When creating a Scheduled Search, you can configure various alert types, including:
Under **Notifications**, choose an **Alert Type** for your first alert. To add another, click **Add Notification**. You can add up to 10 alert types to a single Scheduled Search, mixing and matching any combination of the types below instead of choosing just one. For example, add an Email alert and a Webhook alert to the same Scheduled Search, or add multiple Email alerts with different recipients.

Each alert you add gets its own **Alert Type** dropdown with the same options, and collapses into a summary row once you move on to the next one, for example **Notification 1: Email (jane@example.com)**. Click a row to expand it again, or click its trash icon to remove that alert.<br/><img src={useBaseUrl('img/alerts/schedule-search-add-notification.png')} alt="First notification collapsed into a summary row, with a second Alert Type block added below it" style={{border:'1px solid gray'}} width="500"/>

* [Email](create-email-alert.md). You can create a Scheduled Search to alert you via email when a set of conditions are satisfied. A maximum of 120 emails are sent per day per Scheduled Search.
* [Script Action](/docs/send-data/installed-collectors/sources/script-action). Trigger actions based on search results, such as firing SNMP traps.
Expand All @@ -113,6 +115,10 @@ When creating a Scheduled Search, you can configure various alert types, includi
* [Save to Lookup](save-to-lookup.md). Save results to a [Lookup Table](../../search/lookup-tables/create-lookup-table.md) and use the [`lookup`](/docs/search/search-query-language/search-operators/lookup) operator for data enrichment.
* [Cloud SIEM Signal](generate-cse-signals.md). Trigger the creation of a Cloud SIEM Signal, which are otherwise generated when the conditions of a Cloud SIEM rule are satisfied by a Record.

All alerts you add share the trigger condition from [Step 5](#step-5-notification-settings) and fire from the same search execution, but each alert's own configuration, such as email recipients or webhook payload, is set independently. The following example combines Email, Webhook, and ServiceNow Connection alerts on one Scheduled Search.<br/><img src={useBaseUrl('img/alerts/schedule-search-notifications-list.png')} alt="Edit Scheduled Search dialog listing four configured notifications of different alert types" style={{border:'1px solid gray'}} width="500"/>

Scheduled Searches created before multi-alert support was added keep working exactly as configured, with their single alert type unchanged.

## Troubleshooting

Learn how to address common issues with Scheduled Searches:
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.