---
title: "Get the saved log search."
method: GET
path: "/v1/logSearches/{id}"
tags: ["logSearchesManagement"]
---

# Get the saved log search.

`GET /v1/logSearches/{id}`

Get a saved log search from the content library by identifier.

## Path parameters

- `id` string, required

## Response `200`

Saved log search that was requested.

- LogSearch — Definition of log search parsing mode
  - `queryString` string, required — Query to perform.
  - `timeRange` ResolvableTimeRange, required
    - `type` string, required — Type of the time range. Value must be either `CompleteLiteralTimeRange` or `BeginBoundedTimeRange`.
  - `runByReceiptTime` boolean — This has the value `true` if the search is to be run by receipt time and `false` if it is to be run by message time.
  - `queryParameters` LogSearchQueryParameterSyncDefinitionBase[] — Values for search template used in the search query. Learn more about the search templates here : https://help.sumologic.com/docs/search/get-started-with-search/build-search/search-templates/
    - `autoComplete` AutoCompleteDefinition
      - `type` string, required — The autocomplete parameter type.
      - `autoCompleteKey` string — The autocomplete key to be used to fetch autocomplete values.
      - `autoCompleteValues` AutoCompleteValueSyncDefinition[] — The array of label-value pairs for autocomplete.
        - `label` string, required — The label of the autocomplete value.
        - `value` string, required — The value of the autocomplete value.
      - `lookupMetaData` AutoCompleteLookupMetaData
        - `fileName` string — The lookup file name to use as a source for autocomplete values.
        - `valueColumn` string — The column from the lookup file to use as the value.
        - `labelColumn` string — The column from the lookup file to use as the label.
    - `name` string, required — The name of the parameter.
    - `description` string — A description of the parameter.
    - `dataType` string, required — The data type of the parameter. Supported values are: 1. `NUMBER` 2. `STRING` 3. `ANY` 4. `KEYWORD`
    - `value` string, required — A value for the parameter. Should be compatible with the type set in dataType field.
  - `intervalTimeType` string — This parameter defines whether you want to run the search by messageTime, receiptTime, or searchableTime. By default, the search will run by messageTime. If both runByReceiptTime and intervalTimeType parameters are present then the preference will be given to the intervalTimeType.
  - `parsingMode` string — Define the parsing mode to scan the JSON format log messages. Possible values are: 1. `AutoParse` 2. `Manual` In AutoParse mode, the system automatically figures out fields to parse based on the search query. While in the Manual mode, no fields are parsed out automatically. For more information see [Dynamic Parsing](https://help.sumologic.com/?cid=0011).
  - `name` string, required — Name of the item in the content library.
  - `description` string — Item description in the content library.
  - `schedule` LogSearchScheduleSyncDefinition — Schedule definition for a log search. Exactly one of 'notification' (single notification) or 'notifications' (multiple notification actions) must be provided. Sending both or neither will result in a 400 error.
    - `cronExpression` string — Cron-like expression specifying the search's schedule. Field scheduleType must be set to "Custom", otherwise, scheduleType takes precedence over cronExpression.
    - `displayableTimeRange` string — A human-friendly text describing the query time range. For e.g. "-2h", "last three days", "team default time". This value can not be set via API.
    - `parseableTimeRange` ResolvableTimeRange, required
      - `type` string, required — Type of the time range. Value must be either `CompleteLiteralTimeRange` or `BeginBoundedTimeRange`.
    - `timeZone` string, required — Time zone identifier for time specification. Either an abbreviation such as "PST", a full name such as "America/Los_Angeles", or a custom ID such as "GMT-8:00". Note that the support of abbreviations is for JDK 1.1.x compatibility only and full names should be used. The GMT time zone is chosen if the given time zone cannot be identified.
    - `threshold` LogSearchNotificationThresholdSyncDefinition
      - `thresholdType` string — This property is deprecated. The system will automatically infer the value of this field from the query going forward, so the user-specified value will no longer be honored. Threshold type. Possible values are: 1. `message` 2. `group` Use `group` as threshold type if the search query is of aggregate type. For non-aggregate queries, set it to `message`.
      - `operator` string, required — Criterion to be applied when comparing actual result count with expected count. Possible values are: 1. `eq` 2. `gt` 3. `ge` 4. `lt` 5. `le`
      - `count` integer, required — Expected result count.
    - `notification` ScheduleNotificationSyncDefinition
      - `taskType` string, required — Delivery channel for notifications.
    - `scheduleType` string, required — Run schedule of the scheduled search. Set to "Custom" to specify the schedule with a CRON expression.Please note that with Custom, 1Day and 1Week schedule types you need to provide the corresponding cron expression to determine when to actually run the search. e.g. Sample Valid Cron for 1Day is "0 0 16 ? * 2-6 *". Possible schedule types are: - `RealTime` - `15Minutes` - `1Hour` - `2Hours` - `4Hours` - `6Hours` - `8Hours` - `12Hours` - `1Day` - `1Week` - `Custom`
    - `muteErrorEmails` boolean — If enabled, emails are not sent out in case of errors with the search.
    - `parameters` ScheduleSearchParameterSyncDefinition[] — A list of scheduled search template parameters to be used while executing the query. This is different from the queryParameters field in parent object as this field will be used for execution as per the schedule. The parent object field is for search itself, not part of execution. Learn more about the search templates here : https://help.sumologic.com/docs/search/get-started-with-search/build-search/search-templates/
      - `name` string, required — Name of scheduled search parameter.
      - `value` string, required — Value of scheduled search parameter.
    - `notifications` ScheduleNotificationSyncDefinition[] — List of notification actions for this schedule. Mutually exclusive with 'notification' — exactly one of these fields must be provided. Sending both or neither returns a 400 error. Supports multiple notification channels (e.g., email and webhook) for a single scheduled search execution.
      - `taskType` string, required — Delivery channel for notifications.
  - `properties` string — Aggregate Results Settings and View configurations, Legends settings, and different visualisation settings overrides. Leave this field empty to use the defaults. This property contains JSON object encoded as a string.
  - `createdAt` string, date-time, required — Creation timestamp in UTC in [RFC3339](https://tools.ietf.org/html/rfc3339) format.
  - `createdBy` string, required — Identifier of the user who created the resource.
  - `modifiedAt` string, date-time, required — Last modification timestamp in UTC.
  - `modifiedBy` string, required — Identifier of the user who last modified the resource.
  - `id` string, required — Identifier of the saved log search.
  - `parentId` string — Identifier of the parent element in the content library, such as folder.

## Other responses

- `default` — Operation failed with an error.

---

[API](https://skmtc.net/sumologic/apis/sumo-logic-api.md) · [All operations](https://skmtc.net/sumologic/apis/sumo-logic-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sumologic/sumo-logic-api/versions/18a824df1e78/schema)