Skip to main content

Difference between Monitors and Scheduled Searches

To understand the difference between Monitors and Scheduled Searches, it's essential to recognize the specific use cases each solution addresses.

Scheduled Searches

Scheduled Searches address two primary use cases:

  • Alerting about specific issues in your application. For example, you can create Scheduled Searches to notify you about a spike in the error rate for a service or a stopped process.
  • Reporting specific insights from searches on a periodic schedule. For instance, you can schedule a search to run daily, notifying you about the Daily Active Users on your platform.


Monitors are specifically designed for the first use case: alerting. They offer additional capabilities such as auto-resolution and support for multiple notification channels. Any Scheduled Searches created for alerting purposes can be moved to Monitors, including real-time Scheduled Searches.

Feature differences

Beyond the differences in use cases, there are distinct feature differences between Scheduled Searches and Monitors for logs.

FeatureScheduled SearchesMonitors (Logs)
Support for Slack, PagerDuty, OpsGenie, and other integrationsYesYes
Customizable notificationsYesYes
Incident auto-resolutionNoYes
Send notification to multiple channelsNoYes
Alert disablementNoYes*
(Disable is a manual operation. We do not support scheduled disabling of alerts.)
API supportPartial*
(Supported via content sync API)
Terraform supportNo*
(The Content API resource allows you to manage Schedule Searches)
Log Search operator supportYes*
(Some operators are not supported for real-time alerts)
Outlier-based alertsYesYes
Access controlObject-Level Access ControlObject-Level Access Control (Per request - limited availability)
Audit logs for CRUD and system events (e.g., notifications sent, failures)YesYes
Control over alert scheduling and evaluationYesNo
One notification per log lineYesYes*
(Supported via Alert grouping)
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.