Adding Scheduled Queries

You can add a query and then configure schedules for executing the query. You can add multiple schedules per query.

You can add a Scheduled Query from any of the following locations:

  • Navigate to Management > Advanced Features > Queries, click the Scheduled page, and then click . The Add Scheduled Query dialog box includes the following sections:
    • Query - Displays the name, description, and query text.
      Note: Only SQL and EQL queries are supported.
    • Schedules - displays a list of schedules for the query. For information on how to add or modify schedules, see Configuring Query Schedules.
    Click Query on the left panel, and type your query in the Query field.
  • On the Advanced Search page, type your query and then click > Save as Scheduled Query. The Add Scheduled Query dialog box opens, in which your query is already available in the Query field.

Procedure

  1. Type the name, description, and query text.
    The following features are available only from the Scheduled page (Management > Advanced Features > Queries menu):
    • Click Validate to check if the query syntax is correct.
    • Click Format to format the query keywords.
  2. Click Save.
    The query is added to the list of queries on the Scheduled Queries page.