Adding Scheduled Queries

You can add a query and then configure schedules to execute the query. You can configure multiple schedules per query.

Note: Only SQL and EQL queries are supported.

Procedure

  1. Navigate to any of the following locations:
    • On the Advanced Search page, type your query and then click > Save as Scheduled Query. The Add Scheduled Query dialog box opens, in which your query is already available in the Query field.
    • Navigate to Management > Advanced Features > Queries > Scheduled tab and click . The Add Scheduled Query dialog box includes the following sections:
      • Query - Displays the name, description, and query text.
      • Schedules - displays a list of schedules for the query. For information on how to add or modify schedules, see Configuring Query Schedules.
  2. Type the name, description, and query.
    The following options are available:
    • Click Validate to check whether the query syntax is correct.
    • Click Format to format the query keywords.
    When saving an infrastructure query as a scheduled query, if you include a time filter in the query, the query is saved successfully. However, after the report is saved in the system, an error is displayed in the Query Scheduled > View Executions section.
  3. Click Save.

Result

The query is added to the list of queries on the Scheduled Queries page.