Summary

The runningQueries() GraphQL query is used to get a list of running queries. You can filter the results with a search term.

Hide Query Example

Show Recent Queries Query

For more information on saved queries, see the Saved Searches (User Functions) reference page where saved queries are discussed. Also, look at the Search Data documentation page as it relates to recent queries and saving queries.

API Stability Long-Term

Syntax

graphql
runningQueries(
     searchTerm: string,
     sortField: SortField,
     sortOrder: SortOrder,
     global: boolean
   ): RunningQueries!

For the input, you would give a search term by which queries will be searched, indicate whether to search globally, and how to order and sort the results. See the Input Parameters section for details.

For the results, you can get a list of queries that are running, and many totals for them. See the Returned Values section further down this page for more information on this.

Example

Raw
graphql
query {
  runningQueries(searchTerm:"host", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  runningQueries(searchTerm:\"host\", global: true,  ^
                 sortField: Status, sortOrder: Ascending) ^
   {totalNumberOfQueries, queries { ^
    id, initiatedBy, view} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "runningQueries": {
      "totalNumberOfQueries": 1,
      "queries": [
        {
          "id": "abc123",
          "initiatedBy": "Bob Newhart (bob@company.com)",
          "view": "humio"
        }
      ]
    }
  }
}

Input Parameters

For the input, you would provide a search term by which queries will be searched, indicate whether to search globally, and how to order and sort the results (see second and third table below).

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this query. Since some of the parameters use special datatypes, additional tables for them are included below.
global boolean   false Whether to return global results. Requires system level access.
searchTerm string     Search term that is used to filter running queries based on query input.
sortField SortField     Which field to use when sorting. See table below.
sortOrder SortOrder     How to order results. See table below.

For the first special datatype, you can indicate on which field to sort the results (e.g., Status). The table below gives you an enumerated list from which to choose:

Table: SortField Enum Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: May 9, 2025
Age   Long-TermSort by age of events.
DeltaLiveCost   Long-TermSort by change of live cost.
DeltaLiveCPU   Long-TermSort by change of live CPU.
DeltaStaticCost   Long-TermSort by change of static cost.
DeltaStaticCPU   Long-TermSort by change of static CPU.
DeltaTotalCost   Long-TermSort by change of total cost.
DeltaTotalMemoryAllocation   Long-TermSort by change in total memory allocation.
InitiatedBy   Long-TermSort by which user or entity initiated.
LiveCost   Long-TermSort by live cost.
StaticCost   Long-TermSort by static cost.
Status   Long-TermSort by event status.
TotalCost   Long-TermSort by total cost.
TotalLiveCPU   Long-TermSort by total live CPU.
TotalMemoryAllocation   Long-TermSort by total memory allocation.
TotalStaticCPU   Long-TermSort by total static CPU.
View   Long-TermSort by view.

For the second special datatype, you can indicate whether to sort the results in ascending or descending order. The table below gives you an enumerated list from which to choose:

Table: SortOrder Enum Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: May 9, 2025
Ascending   Long-TermSort queries in ascending order.
Descending   Long-TermSort queries in descending order.

Returned Values

For the results, you can get a list of queries that are running, and many totals for them. Below is a list of choices, along with descriptions of each:

Table: RunningQueries Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 3, 2024
queries[RunningQuery]yes Long-TermQueries being executed, at most 1000 queries are returned. See RunningQuery.
totalIncludedByteslongyes Long-TermTotal size of included bytes for all queries being executed.
totalNumberOfClientsintegeryes Long-TermTotal number of clients querying.
totalNumberOfLiveQueriesintegeryes Long-TermTotal number of live queries being executed.
totalNumberOfQueriesintegeryes Long-TermTotal number of queries being executed.
totalQueuedByteslongyes Long-TermTotal size of remaining bytes to be processed for all queries being executed.
totalSkippedByteslongyes Long-TermTotal size of skipped bytes for all queries being executed.
updateAvailableInlongyes Long-TermNumber of milliseconds until next update is available.