Skip to content

Test 2 [Do not merge] Add comprehensive documentation for scheduled searches feature #21772

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Test 2 [Do not merge] Add comprehensive documentation for scheduled searches feature #21772

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
224 changes: 224 additions & 0 deletions src/content/docs/data-insights/scheduled-searches.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,224 @@
---
title: Schedule search for logs
tags:
- Data insights
- Scheduled searches
- Log monitoring
- Automation
- Query scheduling
- Email notifications
metaDescription: "Automate your log queries with scheduled searches. Set up recurring queries, customize schedules, and receive results via email without manual intervention."
freshnessValidatedDate: never
---

As a New Relic user, you may find yourself running the same log queries repeatedly to monitor systems, track trends, or identify recurring issues. This manual process is time-consuming and prone to oversight, especially when you need consistent monitoring of critical log data.

Scheduled searches solve this problem by automating your log queries. You can set up recurring searches directly from the logs UI, so you'll receive query results automatically via email without manual intervention.

<Callout title="preview">
We're still working on this feature, but we'd love for you to try it out!
This feature is currently provided as part of a preview program pursuant to our [pre-release policies](/docs/licenses/license-information/referenced-policies/new-relic-pre-release-policy).
</Callout>

## What you can do

Scheduled searches transform repetitive, manual queries into proactive, automated workflows. You can:

- **Schedule any NRQL query**: While you access scheduled searches through the logs UI, you can schedule queries for logs, metrics, events, or any other data type
- **Set flexible schedules**: Use cron expressions to define custom recurring schedules that fit your monitoring needs
- **Receive automated results**: Get query results delivered directly to your email as CSV or JSON attachments
- **Manage searches centrally**: View, edit, delete, and duplicate all your scheduled searches from a single administration page
- **Control delivery conditions**: Choose to receive emails every time the query runs or only when results are found

## Pricing

<DNT>Scheduled searches</DNT> are an Advanced Compute Product feature offered as an [add-on](/docs/accounts/accounts-billing/new-relic-one-pricing-billing/add-on-billing) or as part of the Compute pricing model. Advanced [CCUs](/docs/licenses/license-information/product-definitions/new-relic-one-pricing-definitions/#compute-capacity-unit) are consumed when scheduled queries execute and process results.

## Prerequisites

Before you can create scheduled searches, you need:

- **User permissions**: Access to workflow automation capabilities in your New Relic account
- **Account access**: Pro or Enterprise subscription (scheduled searches aren't available on Basic or Free plans)
- **Data access**: Permission to query the specific data types you want to schedule (for example, access to relevant log partitions for log queries)

## Access scheduled searches

You can access scheduled searches from two locations:

### From the logs UI

<Steps>
<Step>
Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Logs**.
</Step>
<Step>
In the logs UI, click the <Icon name="fe-more-horizontal"/> menu next to any log query and select **Schedule search**.
</Step>
</Steps>

### From administration

<Steps>
<Step>
Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Administration**.
</Step>
<Step>
In the left sidebar, select **Scheduled searches**.
</Step>
<Step>
Click **Schedule a search** to create a new scheduled search.
</Step>
</Steps>

## Schedule a search

<Steps>
<Step>
## Define your query

In the **Query and settings** section:

1. **Name your search**: Enter a descriptive name to easily identify your scheduled search later
2. **Write your query**: Enter your NRQL query in the query builder. You'll see the same autocomplete functionality available in other New Relic query interfaces
3. **Test your query**: Click **Run query** to preview your results and verify the query works as expected

The query isn't limited to log data - you can query metrics, events, or any other data type using NRQL.
</Step>

<Step>
## Configure notifications

Set up how and when you want to receive your query results:

1. **Choose destination**: Select an existing email destination from your alerts setup, or create a new destination by entering email addresses
2. **Customize email content**:
- **Subject**: The default subject uses your search name and date, but you can customize it
- **Body**: Add custom text to include in the email body
3. **Select output format**: Choose to include results as:
- **CSV**: Query results as a downloadable CSV attachment
- **JSON**: Query results in JSON format
</Step>

<Step>
## Set your schedule

Configure when your search will run:

**Cron expression**: Enter a cron expression to define your schedule. The interface shows you what your cron expression means in plain text. For example, `0 0 * * 2` displays as "Every Tuesday at 12am".

Common cron patterns:
- `0 9 * * 1-5`: Every weekday at 9 AM
- `0 */6 * * *`: Every 6 hours
- `0 0 1 * *`: First day of every month at midnight

**Delivery conditions**: Choose when to send notifications:
- **Send every time**: Receive an email every time the scheduled search runs
- **Send only with results**: Only receive emails when the query returns results (more than zero rows)
</Step>

<Step>
## Review and create

Review your scheduled search configuration, including the query, notification settings, and schedule. Click **Create scheduled search** to activate it.

You'll see a confirmation message, and your scheduled search will begin running according to your specified schedule.
</Step>
</Steps>

## Manage scheduled searches

<CollapserGroup>
<Collapser id="view-searches" title="View all scheduled searches">

Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Administration > Scheduled searches** to see all your scheduled searches. The list shows:

- Search name and description
- Query details
- Schedule frequency
- Destination type (email)
- Last run timestamp
- Current status (active, paused, draft)

</Collapser>

<Collapser id="edit-searches" title="Edit a scheduled search">

1. In the scheduled searches list, click the <Icon name="fe-more-horizontal"/> menu next to any search
2. Select **Edit** to modify any part of your scheduled search:
- Query and settings
- Notification preferences
- Schedule configuration
3. Save your changes to update the scheduled search

</Collapser>

<Collapser id="pause-searches" title="Pause or resume a scheduled search">

To temporarily stop a scheduled search without deleting it:

1. Click the <Icon name="fe-more-horizontal"/> menu next to your search
2. Select **Pause** to stop the search from running
3. Select **Resume** to reactivate a paused search

</Collapser>

<Collapser id="run-searches" title="Run a scheduled search manually">

To test a scheduled search or get immediate results:

1. Click the <Icon name="fe-more-horizontal"/> menu next to your search
2. Select **Run now** to execute the search immediately
3. The results will be delivered to your configured email destination

</Collapser>

<Collapser id="duplicate-searches" title="Duplicate a scheduled search">

To create a similar scheduled search based on an existing one:

1. Click the <Icon name="fe-more-horizontal"/> menu next to your search
2. Select **Duplicate** to create a copy
3. Modify the duplicated search as needed and save

</Collapser>

<Collapser id="delete-searches" title="Delete a scheduled search">

To permanently remove a scheduled search:

1. Click the <Icon name="fe-more-horizontal"/> menu next to your search
2. Select **Delete**
3. Confirm the deletion - this action can't be undone

</Collapser>
</CollapserGroup>

## Related topics

<DocTiles>
<DocTile
title="Query your logs"
path="/docs/logs/ui-data/query-syntax-logs"
>
Learn how to build effective log queries using NRQL syntax and log-specific functions.
</DocTile>
<DocTile
title="Create alerts for logs"
path="/docs/logs/ui-data/use-logs-ui"
>
Set up alerts to get notified immediately when specific log conditions are met.
</DocTile>
<DocTile
title="Workflow automation"
path="/docs/alerts-applied-intelligence/applied-intelligence/incident-workflows/incident-workflows"
>
Explore more automation options with New Relic's workflow automation platform.
</DocTile>
<DocTile
title="Email destinations"
path="/docs/alerts-applied-intelligence/notifications/destinations"
>
Learn how to configure and manage email destinations for notifications.
</DocTile>
</DocTiles>
Loading