# Saved Searches

Saved Searches store your queries so you don't need to rebuild them each time. You can attach notification targets (email, Slack, PagerDuty, webhook) to a saved search and receive alerts whenever new matching records appear. You can also enable SIEM Forwarding to route matching events to your SIEM.

## Create a saved search

The Saved Searches panel is accessible from **Search** in the side panel.

### Example: monitor new cron jobs

1. **Run a query** — Enter a query, such as `metadata.name ~= "*"` for cron jobs. Click **Search** to confirm it returns results.

   <figure><img src="https://4237643999-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBmf9RZ2wNSc4znG5gBc1%2Fuploads%2Fgit-blob-8fb95233ace8ed3ad50cfa63f45c4d5c4fbfc705%2F21%20(1).png?alt=media" alt="Search bar with a cron job query entered"><figcaption><p>Run the query to verify it returns results before saving.</p></figcaption></figure>
2. **Save the query** — Click **Save Search**.

   <figure><img src="https://4237643999-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBmf9RZ2wNSc4znG5gBc1%2Fuploads%2Fgit-blob-6e98e3fd7f147350ee0e4a89ff8f95757d079210%2F21%20(2).png?alt=media" alt="Save Search button in the search toolbar"><figcaption><p>Click Save Search to open the saved search configuration dialog.</p></figcaption></figure>
3. **Configure notifications** — In the dialog that appears:

   * Edit the auto-generated name if needed (e.g., "New Cron Jobs").
   * Add an optional description.
   * Toggle **Notification Status** to enabled if you want alerts immediately.
   * Click **Add Target** to configure notification channels. You can add multiple targets.

   <figure><img src="https://4237643999-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBmf9RZ2wNSc4znG5gBc1%2Fuploads%2Fgit-blob-94691ae665615a209e405b5a0754c0e083856107%2F21%20(3).png?alt=media" alt="Saved search configuration dialog showing name, description, and notification status fields"><figcaption><p>Configure the name, description, and notification status for the saved search.</p></figcaption></figure>

   Supported notification channels: Email, Slack, PagerDuty, Webhook.

   <figure><img src="https://4237643999-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBmf9RZ2wNSc4znG5gBc1%2Fuploads%2Fgit-blob-4270398f4f55b00696257d4e6fd70638384b1b17%2F21%20(4).png?alt=media" alt="Notification target type selection showing Email, Slack, PagerDuty, and Webhook options"><figcaption><p>Select a notification channel and configure its destination.</p></figcaption></figure>
4. **Save** — Click **Save** to finish.

After saving, you can manage the query from the Saved Searches page: edit the query, run it manually, toggle it on or off, or delete it.

***

## SIEM Forwarding

Beyond notifications, saved searches can also forward matching events to your SIEM. Enable the **SIEM Forwarding** toggle in **Additional Settings** when editing a saved search — this requires the `org:ManageSiemForwarding` permission. Once enabled, Spyderbat routes records matching the query to the SIEM forwarding API, where the Event Forwarder picks them up and delivers them to your destination. Changes take effect immediately for new matching records — forwarding is not applied retroactively to records that existed before you enabled it.

See [SIEM Forwarding](https://docs.spyderbat.com/concepts/integrations/siem-forwarding) for the full setup guide.

***

## Manage saved searches with spyctl

The spyctl CLI uses `saved-query` as the resource name (for example, `spyctl get saved-queries`). This refers to the same thing as a saved search in the console UI — the terms are interchangeable.

### Retrieve saved searches

```bash
spyctl get saved-queries
```

### Create a saved search

```bash
spyctl create saved-query --help
```

```
Options:
  -o, --output [yaml|json|ndjson|default]
  -a, --apply                     Apply the saved query during creation.
  -n, --name TEXT                 The name of the saved query.
  -q, --query TEXT                The query to be saved.
  -d, --description TEXT          A description of the saved query.
  -s, --schema TEXT               The schema of the saved query.
  -y, --yes                       Automatically answer yes to all prompts.

Usage:
  spyctl create saved-query [OPTIONS]
```

Example:

```bash
spyctl create saved-query \
  -n "Monitor Deployment with Replicas more than 5" \
  -q "spec.replicas > 5" \
  -s "Deployment"
```

To list all available schemas:

```bash
spyctl search --list-schemas
```

### Edit a saved search

```bash
spyctl edit saved-query <NAME_OR_ID>
```

Replace `<NAME_OR_ID>` with the ID or name of the saved search you want to edit. After editing the YAML and applying the change, you'll see a confirmation: `Successfully edited Saved Query 'query:id'`.