Security Requirements and Controls

Summary

The runningQueries() GraphQL query returns a list of running queries. You can filter the results with a search term.

Hide Query Example

Show Recent Queries Query

For more information on saved queries, see the Saved Searches (User Functions) reference page. See also the Search Data documentation page for information on recent queries and saving queries.

API Stability Long-Term

Syntax

graphql
runningQueries(
      searchTerm: String,
      sortField: SortField,
      sortOrder: SortOrder,
      global: Boolean
   ): RunningQueries!

Optionally provide searchTerm to filter running queries by query string, global to return results across all organizations (requires root access), and sortField and sortOrder to control result ordering. See the Input Parameters section for details.

Returns a non-nullable RunningQueries object containing a list of running queries and aggregate totals. See the Returned Values section for available fields.

Example

Raw
graphql
query {
  runningQueries(searchTerm:"host", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  runningQueries(searchTerm:\"host\", global: true,  ^
                 sortField: Status, sortOrder: Ascending) ^
   {totalNumberOfQueries, queries { ^
    id, initiatedBy, view} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "runningQueries": {
      "totalNumberOfQueries": 1,
      "queries": [
        {
          "id": "abc123",
          "initiatedBy": "Bob Newhart (bob@company.com)",
          "view": "humio"
        }
      ]
    }
  }
}

Input Parameters

Optionally filter results by searchTerm (query string text) or set global to search across all organizations. Use sortField and sortOrder to control result ordering (see second and third tables below).

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this query. Since some of the parameters use special datatypes, additional tables for them are included below.
global Boolean   false Whether to return results across all organizations. Requires root access.
searchTerm String     Search term that is used to filter running queries based on query input.
sortField SortField     Which field to use when sorting. See table below.
sortOrder SortOrder     How to order results. See table below.

Use sortField to specify which field to sort results by (for example, Status). The table below lists the available enum values:

Use sortOrder to specify ascending or descending order. The table below lists the available enum values:

Returned Values

Returns a non-nullable RunningQueries object. The table below lists all fields:

Table: RunningQueries Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
queriesRunningQueryyes Long-Term Queries being executed, at most 1000 queries are returned. See RunningQuery.
totalIncludedBytesLongyes Long-Term Total size of included bytes for all queries being executed.
totalNumberOfClientsIntyes Long-Term Total number of clients querying.
totalNumberOfLiveQueriesIntyes Long-Term Total number of live queries being executed.
totalNumberOfQueriesIntyes Long-Term Total number of queries being executed.
totalQueuedBytesLongyes Long-Term Total size of remaining bytes to be processed for all queries being executed.
totalSkippedBytesLongyes Long-Term Total size of skipped bytes for all queries being executed.
updateAvailableInLongyes Long-Term Number of milliseconds until next update is available.