API Stability Long-Term

The runningQueries() GraphQL query is used to get a list of running queries. You can filter the results with a search term.

Related to this query, there is the mutation, killQuery() to kill a running query. You might find useful the addRecentQuery() mutation to add a query to the recent queries list, and the mutation, createSavedQuery() to create a saved query.

For more information on saved queries, see the Saved Searches (User Functions) reference page where saved queries are discussed. Also, look at the Search Data documentation page as it relates to recent queries and saving queries.

Syntax

graphql
runningQueries(
     searchTerm: string,
     sortField: SortField,
     sortOrder: SortOrder,
     global: boolean
   ): RunningQueries!

For searchTerm, you can provide a string on which to search, text that may be in the query. For sortField you would enter the field on which to sort (e.g., Status). Use sortOrder to indicate whether to sort in ascending or descending order.

Last, use global to say whether to return global results. It requires system level access, though. The default is false.

For the results, you can get a list of queries that are running, and many totals for them. See the Returned Datatype section further down this page for more information on this.

Example

Below is an example of how this query field might be used:

Raw
graphql
query {
  runningQueries(searchTerm:"host", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  runningQueries(searchTerm:\"host\", global: true,  ^
                 sortField: Status, sortOrder: Ascending) ^
   {totalNumberOfQueries, queries { ^
    id, initiatedBy, view} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "runningQueries": {
      "totalNumberOfQueries": 1,
      "queries": [
        {
          "id": "IQ-ZAVBkI4t4XtriaV1cHWmtBaD",
          "initiatedBy": "Bob Newhart (bob@company.com)",
          "view": "humio"
        }
      ]
    }
  }
}

Given Datatypes

For the first given datatype, you can indicate on which field to sort the results (e.g., Status). The table below gives you an enumerated list from which to choose:

Table: SortField

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: May 9, 2025
Age   Long-TermSort by age of events.
DeltaLiveCost   Long-TermSort by change of live cost.
DeltaLiveCPU   Long-TermSort by change of live CPU.
DeltaStaticCost   Long-TermSort by change of static cost.
DeltaStaticCPU   Long-TermSort by change of static CPU.
DeltaTotalCost   Long-TermSort by change of total cost.
DeltaTotalMemoryAllocation   Long-TermSort by change in total memory allocation.
InitiatedBy   Long-TermSort by which user or entity initiated.
LiveCost   Long-TermSort by live cost.
StaticCost   Long-TermSort by static cost.
Status   Long-TermSort by event status.
TotalCost   Long-TermSort by total cost.
TotalLiveCPU   Long-TermSort by total live CPU.
TotalMemoryAllocation   Long-TermSort by total memory allocation.
TotalStaticCPU   Long-TermSort by total static CPU.
View   Long-TermSort by view.

For the second given datatype, you can indicate whether to sort the results in ascending or descending order. The table below gives you an enumerated list from which to choose:

Table: SortOrder

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: May 9, 2025
Ascending   Long-TermSort queries in ascending order.
Descending   Long-TermSort queries in descending order.

Returned Datatype

The returned datatype a list of queries that are running, and many totals for them. Below is a list of parameters you can requests along with descriptions of each:

Table: RunningQueries

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 3, 2024
queries[RunningQuery]yes Long-TermQueries being executed, at most 1000 queries are returned. See RunningQuery.
totalIncludedByteslongyes Long-TermTotal size of included bytes for all queries being executed.
totalNumberOfClientsintegeryes Long-TermTotal number of clients querying.
totalNumberOfLiveQueriesintegeryes Long-TermTotal number of live queries being executed.
totalNumberOfQueriesintegeryes Long-TermTotal number of queries being executed.
totalQueuedByteslongyes Long-TermTotal size of remaining bytes to be processed for all queries being executed.
totalSkippedByteslongyes Long-TermTotal size of skipped bytes for all queries being executed.
updateAvailableInlongyes Long-TermNumber of milliseconds until next update is available.