# Scheduled views

Scheduled views are pre-aggregated datasets that Kloudfuse generates at scheduled intervals to improve query performance and efficiency. Instead of expensive real-time queries on raw data, scheduled views store advance results, enabling faster access to summarized information.

Consider the following benefits of using scheduled views instead of regular queries:

- Scheduled views have a significantly smaller footprint, and use much less storage than complete logs.
- Scheduled views update every minute for near real-time data availability.
- When you store precomputed results, the system processes the query and saves the aggregated results separately from the log data.
- When you access scheduled view results through FuseQL (instead of running raw data queries), it ensures faster performance with current insights.
- You can design your retention policies to optimize both storage and accessibility to older data by only the relevant data that is both **_abbreviated_** and **_aggregated_**. This enables better reporting without significant overhead.

## Rules

- You must use an **aggregate** operator when defining a scheduled view.
- Always run an aggregation by a **timeslice** operator. If you do not, evaluation time will be used.
- You cannot create a scheduled view from another scheduled view.
- You cannot use **cat** operator as part of a scheduled view query.
- View names must start with a letter and can only contain letters, numbers, `$`, and `_` characters. Spaces are not allowed.

To begin working with scheduled views, follow these steps:

1. Select the **Logs** tab, and then the **Scheduled Views** option in the dropdown menu.

2. The **Scheduled Views** report appears.

## Using Scheduled Views

The **Scheduled Views** page contains the following:

- The **Search** feature enables you to search across all existing scheduled views.
- Make a new scheduled view by clicking the **[Create scheduled view](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/scheduled-views/#create)** button.
- Use the **List** of scheduled views to review what views are already available, and to manage them.

### Table Columns

The scheduled views table displays the following information:

| Column | Description |
| --- | --- |
| **View name** | A unique name you assign to the view when you create it. Used as `_view=<name>` when querying. |
| **Folder** | The folder where the scheduled view is organized. Use folders to manage access permissions and organize related views together. |
| **Status** | The current state of the scheduled view. Possible values:<br>\* **Running** \- The view is actively evaluating queries and writing results<br>\* **Catching Up** \- The view is processing historical data to catch up to the current time<br>\* **Paused** \- The view is temporarily paused and not processing new data |
| **Start time** | The timestamp from which the scheduled view begins processing data. You can configure this when creating a view to backfill historical data. |
| **Last evaluated** | The timestamp of the most recent query evaluation. This column is hidden by default; use the column options to display it. |
| **Next evaluation** | The timestamp when the next query evaluation is scheduled. This column is hidden by default. |
| **Lag (s)** | How far behind the scheduled view is from the current time, measured in seconds. A lower lag indicates the view is more current. |
| **FuseQL** | The query that gets evaluated at each interval (default: every minute). |
| **Created at** | The timestamp of when the view was created. This column is hidden by default. |

### Row Actions

When you hover the cursor over one of the rows that represent a scheduled view, Kloudfuse displays action options:

- **Copy query** \- Copy the FuseQL query to your clipboard
- **[View Logs](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/scheduled-views/#view)** \- Open the view results in the Logs Explorer
- **Change folder** \- Move the scheduled view to a different folder
- **[Pause](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/scheduled-views/#pause)** or **[Resume](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/scheduled-views/#pause)** \- Temporarily stop or restart collecting data
- **[Delete](https://docs.kloudfuse.com/platform/4.0.2/query-languages/fuseql/scheduled-views/#delete)** \- Permanently remove the scheduled view

### Bulk Actions

Select multiple scheduled views using the checkboxes to perform bulk operations:

- **Pause** \- Pause all selected active views
- **Resume** \- Resume all selected paused views
- **Move to folder** \- Move all selected views to a specific folder
- **Delete** \- Delete all selected views

## Create a scheduled view

To create a scheduled view:

1. In the default **Logs > Scheduled Views** interface, click **Create scheduled view**.

2. The **Create scheduled view** page appears.

3. In the interface, specify:

**View Name**  
Choose a meaningful name. The name must start with a letter and can only contain letters, numbers, `$`, and `_`. Do not use spaces.

**Folder (optional)**  
Select a folder to organize the scheduled view. Folders help manage access permissions when RBAC is enabled. You can also create a new folder using the folder icon.

**Start Time**  
Select the date and time from which the scheduled view should begin processing data. This allows you to backfill historical data. The start time cannot be in the future.

**FuseQL Query**  
Specify the query that defines the view, including filters and aggregation. For example:

```none
* | timeslice 1m | count by _timeslice, source
```

4. Click **Create**.
5. The new view appears in the list of views and begins processing data from the specified start time.

## View Logs

1. In the list of **Scheduled Views**, hover the pointer over the view you plan to examine.

In this example, we use `countBySource`, which is defined as `* | timeslice 1m | count by _timeslice, source`

2. Click the **View Logs** option.
3. The list of aggregated data for the view appears.

The **Search** parameters are, by default, for `_view=<view-name>`. In the following example, it is `_view=countBySource`.

The **default time interval** is for the preceding 5 minutes. You can adjust this by changing the time picker.

## Pause or Resume Scheduled view

Disable or pause the scheduled view to temporarily stop updates without deleting it, and then resume processing as necessary.

### Pause a Single View

1. Hover your pointer over the view you plan to pause, and click the **Pause** icon.

2. The status changes to **Paused**.

### Resume a Single View

1. To resume collecting data into a paused scheduled view, hover your pointer over the view and click the **Resume** icon.

2. The view resumes processing and automatically catches up from where it was paused. During catch-up, the status shows as **Catching Up**.

### Bulk Pause or Resume

1. Select multiple views using the checkboxes in the leftmost column.
2. Click the **Pause** button to pause all selected active views, or the **Resume** button to resume all selected paused views.
3. A confirmation dialog appears. Click **Confirm** to proceed.

## Delete Scheduled view

Delete a scheduled view to permanently stop collecting data.

### Delete a Single View

1. Hover your pointer over the view you plan to delete, and click the **Delete** icon.

2. Confirm the deletion when prompted.

3. The view is removed from the list.

### Bulk Delete

1. Select multiple views using the checkboxes in the leftmost column.
2. Click the **Delete** button in the toolbar.
3. A confirmation dialog appears listing all views to be deleted. Click **Confirm** to proceed.

## Organize with Folders

Scheduled views can be organized into folders for better management and access control.

### Move a Single View to a Folder

1. Hover your pointer over the view and click the **Change folder** icon.
2. Select the destination folder from the dropdown.
3. Click **Save** to move the view.

### Bulk Move to Folder

1. Select multiple views using the checkboxes.
2. Click the **Move to folder** button in the toolbar.
3. Select the destination folder and confirm.

## Query a Scheduled view

To query a view, prefix the FuseQL query by adding the view information. So, the first component of the query has the following form:

Query against a view

```none
| _view=<view_name>
```

Do not use quotes around the view name.

## Query multiple views

To query multiple views, prefix the query using the following form:

Query against multiple views

```none
_view=<view1> or _view=<view2> or _view=<view3> ...
```

## Examples

The following example shows how to track log volume by source over time using a scheduled view.

### Track log volume by source

**Use case:** You want to monitor the volume of logs from each source over time for capacity planning. Creating a scheduled view provides two key benefits:

- **Faster queries** \- Pre-aggregated data means queries run significantly faster than querying raw logs
- **Long-term storage** \- Retain aggregated metrics beyond the retention period of the original logs

**Original query on raw logs:**

```none
*
| timeslice 1h
| count by _timeslice, source
```

**Scheduled view definition:**

```none
*
| timeslice 1m
| count by _timeslice, source
```

**Query the scheduled view:**

```none
_view=logVolumeBySource
| timeslice 1h
| sum(_count) by _timeslice, source
```

## GraphQL API Reference

Scheduled views can be managed programmatically using the GraphQL API.

### Query

```graphql
query {
  getScheduledViews(limit: Int) {
    Name
    FuseQlQuery
    Created
    Active
    FolderUid
    StartTime
    Status {
      State
      EvalTime
      NextEvalTime
      LagTime
    }
  }
}
```

### Mutations

#### Create a Scheduled View

```graphql
mutation {
  createScheduledView(
    viewName: String!
    fuseQlQuery: String!
    folderUid: String
    startTime: Time
  )
}
```

#### Pause a Scheduled View

```graphql
mutation {
  pauseScheduledView(viewName: String!)
}
```

#### Resume a Scheduled View

```graphql
mutation {
  resumeScheduledView(viewName: String!)
}
```

#### Delete a Scheduled View

```graphql
mutation {
  deleteScheduledView(viewName: String!)
}
```

### Response Types

```graphql
type ScheduledView {
  Name: String!
  FuseQlQuery: String!
  StartTime: Time
  IntervalSeconds: Int
  RetentionTime: Int
  RetentionUnit: RetentionUnit
  Created: Time!
  Active: Boolean!
  FolderUid: String
  Status: ScheduledViewStatus
}

type ScheduledViewStatus {
  State: ViewState!
  EvalTime: Time
  NextEvalTime: Time
  LagTime: Int
}

enum ViewState {
  running
  catchingUp
  paused
}

enum RetentionUnit {
  days
  weeks
  months
}
```