The runningQueries() GraphQL query is used to get a list of running queries.

For more information on saved queries, see the User Functions (Saved Searches) reference page where saved queries are discussed. Also, look at the Searching Data documentation page as it relates to recent queries and saving queries.

Syntax

Below is the syntax for the runningQueries() query field:

graphql
runningQueries(
     searchTerm: string
     sortField: SortField
     sortOrder: SortOrder
   ): RunningQueries!

Below is an example of how this query field might be used:

Raw
graphql
query {
  runningQueries(searchTerm:"host", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  runningQueries(searchTerm:\"host\", global: true,  ^
                 sortField: Status, sortOrder: Ascending) ^
   {totalNumberOfQueries, queries { ^
    id, initiatedBy, view} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'
"$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "runningQueries": {
      "totalNumberOfQueries": 1,
      "queries": [
        {
          "id": "IQ-ZAVBkI4t4XtriaV1cHWmtBaD",
          "initiatedBy": "Bob Newhart (bob@company.com)",
          "view": "humio"
        }
      ]
    }
  }
}

Given Datatypes

For the given datatype, SortField, there are several parameters that may be given. Below is a list of them along with their datatypes and a description of each:

Table: SortField

ParameterTypeRequiredDefaultDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 16, 2024
Agebooleanyes Whether to sort by age of events.
DeltaLiveCostbooleanyes Whether to sort by change of live cost.
DeltaLiveCPUbooleanyes Whether to sort by change of live CPU.
DeltaStaticCostbooleanyes Whether to sort by change of static cost.
DeltaStaticCPUbooleanyes Whether to sort by change of static CPU.
DeltaTotalCostbooleanyes Whether to sort by change of total cost.
DeltaTotalMemoryAllocationbooleanyes Whether to sort by change in total memory allocation.
InitiatedBybooleanyes Whether to sort by which user or entity initiated.
LiveCostbooleanyes Whether to sort by live cost.
StaticCostbooleanyes Whether to sort by change of total cost.
Statusbooleanyes Whether to sort by event status.
TotalCostbooleanyes Whether to sort by total cost.
TotalLiveCPUbooleanyes Whether to sort by total live CPU.
TotalMemoryAllocationbooleanyes Whether to sort by total memory allocation.
TotalStaticCPUbooleanyes Whether to sort by total static CPU.
Viewbooleanyes Whether to sort by view.

The given datatype, SortOrder is also an enumerated list, but with only two choices: Ascending, or Descending.

Returned Datatypes

The returned datatype runningQueries() has its own parameters. Below is a list of them along with their datatypes and a description of each:

Table: RunningQueries

ParameterTypeRequiredDefaultDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Oct 3, 2024
queries[RunningQuery]yes Queries being executed, at most 1000 queries are returned. See RunningQuery.
totalIncludedByteslongyes Total size of included bytes for all queries being executed.
totalNumberOfClientsintegeryes Total number of clients querying.
totalNumberOfLiveQueriesintegeryes Total number of live queries being executed.
totalNumberOfQueriesintegeryes Total number of queries being executed.
totalQueuedByteslongyes Total size of remaining bytes to be processed for all queries being executed.
totalSkippedByteslongyes Total size of skipped bytes for all queries being executed.
updateAvailableInlongyes Number of milliseconds until next update is available.