Summary

The analyzeQuery() GraphQL query validates a query string, reports errors and warnings, and suggests appropriate alert types. When a viewName is defined, it validates saved queries.

API Stability Short-Term

Syntax

graphql
analyzeQuery(
     input: AnalyzeQueryArguments!
   ): AnalyzeQueryInfo!

For the input, a special datatype contains a few parameters. One in particular requires the query string you want analyzed. See Input Parameters for more details.

For the results, specify what you want from the query analysis (for example, whether the query is valid or any suggestions for improving it). See Returned Values for more.

Example

Raw
graphql
query {
   analyzeQuery(
     input:{
        queryString: "groupBy([#type,actor.type])",
        arguments:[{name: "groupBy([#type,actor.type])", value: ""}],
        version:{name: "legacy"},
        viewName: "humio-audit"
    }
  ) {validateQuery {isValid} , suggestedAlertType {alertType}}
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
   analyzeQuery(
     input:{
        queryString: \"groupBy([#type,actor.type])\",
        arguments:[{name: \"groupBy([#type,actor.type])\", value: \"\"}],
        version:{name: \"legacy\"},
        viewName: \"humio-audit\"
    }
  ) {validateQuery {isValid} , suggestedAlertType {alertType}}
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
   analyzeQuery(
     input:{
        queryString: \"groupBy([#type,actor.type])\",
        arguments:[{name: \"groupBy([#type,actor.type])\", value: \"\"}],
        version:{name: \"legacy\"},
        viewName: \"humio-audit\"
    }
  ) {validateQuery {isValid} , suggestedAlertType {alertType}}
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
   analyzeQuery( ^
     input:{ ^
        queryString: \"groupBy([#type,actor.type])\", ^
        arguments:[{name: \"groupBy([#type,actor.type])\", value: \"\"}], ^
        version:{name: \"legacy\"}, ^
        viewName: \"humio-audit\" ^
    } ^
  ) {validateQuery {isValid} , suggestedAlertType {alertType}} ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
   analyzeQuery(
     input:{
        queryString: \"groupBy([#type,actor.type])\",
        arguments:[{name: \"groupBy([#type,actor.type])\", value: \"\"}],
        version:{name: \"legacy\"},
        viewName: \"humio-audit\"
    }
  ) {validateQuery {isValid} , suggestedAlertType {alertType}}
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
   analyzeQuery(
     input:{
        queryString: \"groupBy([#type,actor.type])\",
        arguments:[{name: \"groupBy([#type,actor.type])\", value: \"\"}],
        version:{name: \"legacy\"},
        viewName: \"humio-audit\"
    }
  ) {validateQuery {isValid} , suggestedAlertType {alertType}}
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
   analyzeQuery(
     input:{
        queryString: \"groupBy([#type,actor.type])\",
        arguments:[{name: \"groupBy([#type,actor.type])\", value: \"\"}],
        version:{name: \"legacy\"},
        viewName: \"humio-audit\"
    }
  ) {validateQuery {isValid} , suggestedAlertType {alertType}}
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
   analyzeQuery(
     input:{
        queryString: \"groupBy([#type,actor.type])\",
        arguments:[{name: \"groupBy([#type,actor.type])\", value: \"\"}],
        version:{name: \"legacy\"},
        viewName: \"humio-audit\"
    }
  ) {validateQuery {isValid} , suggestedAlertType {alertType}}
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "analyzeQuery": {
      "validateQuery": {
        "isValid": true
      },
      "suggestedAlertType": {
        "alertType": "AggregateAlert"
      }
    }
  }
}

The results here show that the query is valid. From that, it suggests that an aggregate alert might be created with the query.

Input Parameters

For the input, provide the query to analyze and related parameters (for example, view name or the time range for events). These parameters are listed here:

Table: AnalyzeQueryArguments Input Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Aug 18, 2025
arguments[QueryArgumentInputType]  Short-TermThe arguments for analyzeQuery. See QueryArgumentInputType.
isLiveboolean  Short-TermWhether query is for live or static data.
queryKindQueryKindInputType  Short-TermThe arguments for analyzeQuery. See QueryKindInputType.
queryStringstringyes Short-TermThe query string for analyzeQuery.
rejectFunctions[string]  Short-TermA list of function names which are disallowed when validating the query.
strictboolean trueShort-TermWhether query analysis is performed in strict mode. When true, missing query arguments are reported as validation errors, and saved query uses are validated. When false, missing query arguments and all saved query uses are not reported as errors.
timeIntervalQueryTimeInterval  Short-TermA time range for which the query is intended to be run. The interval will be validated syntactically and certain query functions can be further validated. Allows for partial time intervals with analyzeQuery() — default time interval set in line with query jobs. See QueryTimeInterval.
versionLanguageVersionInputTypeyes Short-TermThe version used. See LanguageVersionInputType.
viewNameRepoOrViewName  Short-TermThe name of the view. RepoOrViewName is a scalar.

Returned Values

For the results, you can get validation output from the query analysis and any suggestions for improving the query. Your choices are listed here:

Table: AnalyzeQueryInfo Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Aug 19, 2025
analysisResultQueryAnalysisResultyes PreviewThe results from statically analyzing the query. See QueryAnalysisResult.
suggestedAlertTypeSuggestedAlertTypeInfo  Short-TermSuggested type of alert to use for a given query. Returns null if no suitable alert type could be suggested. The given query isn't guaranteed to be valid for the suggested alert type. See SuggestedAlertTypeInfo.
validateQueryQueryValidationInfoyes Short-TermCheck if the given query contains any errors or warnings when used in a standard search context. See QueryValidationInfo.