---
title: "Create a search job."
method: POST
path: "/v2/search/jobs"
tags: ["searchJobManagement"]
---

# Create a search job.

`POST /v2/search/jobs`

Create a new search job.

## Request body

- CreateJobRequest
  - `query` string, required — The actual search expression. Ensure your query follows [RFC 8259](https://datatracker.ietf.org/doc/html/rfc8259) and is valid JSON format, you may need to escape certain characters to follow the [RFC 8259](https://datatracker.ietf.org/doc/html/rfc8259).
  - `from` string, required — The start date and time of the search. This follows the [ISO 8601](https://www.w3.org/TR/NOTE-datetime) date and time format.
  - `to` string, required — The end date and time of the search. This follows the [ISO 8601](https://www.w3.org/TR/NOTE-datetime) date and time format.
  - `timezone` string, required — The time zone if from/to is not in milliseconds. See this [Wikipedia article](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) for a list of time zone codes.
  - `autoParsingMode` string — Define the parsing mode to scan the JSON format log messages. Possible values are: AutoParse - System automatically figures out the fields to parse based on the search query. Manual - No fields are parsed out automatically. For more information, refer to the [Dynamic Parsing](https://help.sumologic.com/docs/manage/field-extractions/create-field-extraction-rule/).
  - `requiresRawMessages` string — On enabling this field, the log messages applicable to the search are returned. Maximum value is 100,000. This is only applicable for aggregate queries.
  - `maxRawRecords` string — Maximum number of raw records to finish the search.
  - `intervalTimeType` string — This parameter defines whether you want to run the search by messageTime, receiptTime or searchableTime.
  - `childOrgIds` string[] — List of child organization ids to run the search on.
  - `includeAllChildOrgs` boolean — When true, automatically resolves all child orgs of the authenticated parent and fans the search out across all of them. If this is set, it takes precedence over childOrgIds field. Default value is false.
  - `emulateSearch` EmulateSearch
    - `userId` string — The user ID to emulate the search as.
    - `roleIds` string[] — List of role IDs to apply for the emulated search.

## Response `202`

The search job has been created.

- CreateJobResponse
  - `warning` string — Warnings value contains the detailed information about the warning while creating the search job.
  - `id` string — The search job identifier.
  - `link` Link
    - `rel` string — Relation.
    - `href` string — URL of the search job.
  - `isAggregation` boolean — Whether the query has aggregation operators.
  - `isSummary` boolean — Whether the query is a summary query.
  - `isSortable` boolean — Whether the results are sortable.
  - `runnableQuery` string — The final query string after parameterized variables are substituted, macros are expanded.
  - `userReferencedFieldsSortable` boolean — Whether the user's explicitly referenced fields can be re-sorted by clicking column headers.
  - `operators` string[] — List of special operators present in the query.
  - `tiersInQuery` string[] — Analytics tiers referenced in the query.

## Other responses

- `default` — Operation failed with an error.

---

[API](https://skmtc.net/sumologic/apis/sumo-logic-api.md) · [All operations](https://skmtc.net/sumologic/apis/sumo-logic-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sumologic/sumo-logic-api/revisions/c9986f3d589b/schema)