Saving, Scheduling, and Alerting on Log Queries

Save the exact query currently in the search bar — including its filters — with the save icon at the right edge of the search bar. Name it and pick a folder in the Save Query dialog; if RBAC is enabled, you need permission on the folder you save into.

Click Logs in the top navigation, then Saved Queries, to see every query you or your team has saved:

A saved query runs when you click it. A Scheduled Search runs on a timer and delivers its results somewhere — a lookup table other queries can join against, or an email — without anyone opening the Explorer. You can make it stay quiet until the result row count crosses a threshold.

Click Logs in the top navigation, then Scheduled Searches, to see and manage every configured search. For step-by-step instructions, schedule and look-back limits, and SMTP setup for email delivery, see Scheduled Search.

A log-based alert rule evaluates a query on a short, regular evaluation interval and notifies you as soon as an evaluation crosses its threshold, rather than on a schedule you set — the right tool when you need to know immediately, not at the next scheduled tick.

Create one from Alerts → New Alert, choosing Logs as the alert type. To see log alerts specifically rather than configure a new one, click Logs in the top navigation, then Alerts — this opens the shared Alerts view pre-filtered so only the Logs option is active under its Type filter, alongside every other alert-management control (status, severity, mute) described in that shared view.