API Stability Long-Term

The runningQueries() GraphQL query is used to get a list of running queries. You can filter the results with a search term.

For more information on saved queries, see the User Functions (Saved Searches) reference page where saved queries are discussed. Also, look at the Searching Data documentation page as it relates to recent queries and saving queries.

Syntax

Below is the syntax for the runningQueries() query field:

graphql
runningQueries(
     searchTerm: string
     sortField: SortField
     sortOrder: SortOrder,
     global: boolean
   ): RunningQueries!

Below is an example of how this query field might be used:

Raw
graphql
query {
  runningQueries(searchTerm:"host", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  runningQueries(searchTerm:\"host\", global: true,  ^
                 sortField: Status, sortOrder: Ascending) ^
   {totalNumberOfQueries, queries { ^
    id, initiatedBy, view} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  runningQueries(searchTerm:\"host\", global: true, 
                 sortField: Status, sortOrder: Ascending)
   {totalNumberOfQueries, queries {
    id, initiatedBy, view} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "runningQueries": {
      "totalNumberOfQueries": 1,
      "queries": [
        {
          "id": "IQ-ZAVBkI4t4XtriaV1cHWmtBaD",
          "initiatedBy": "Bob Newhart ([email protected])",
          "view": "humio"
        }
      ]
    }
  }
}

Given Datatypes

For the given datatype, SortField, there are several parameters that may be given. Below is a list of them along with their datatypes and a description of each:

Table: SortField

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: May 9, 2025
Age   Long-TermSort by age of events.
DeltaLiveCost   Long-TermSort by change of live cost.
DeltaLiveCPU   Long-TermSort by change of live CPU.
DeltaStaticCost   Long-TermSort by change of static cost.
DeltaStaticCPU   Long-TermSort by change of static CPU.
DeltaTotalCost   Long-TermSort by change of total cost.
DeltaTotalMemoryAllocation   Long-TermSort by change in total memory allocation.
InitiatedBy   Long-TermSort by which user or entity initiated.
LiveCost   Long-TermSort by live cost.
StaticCost   Long-TermSort by static cost.
Status   Long-TermSort by event status.
TotalCost   Long-TermSort by total cost.
TotalLiveCPU   Long-TermSort by total live CPU.
TotalMemoryAllocation   Long-TermSort by total memory allocation.
TotalStaticCPU   Long-TermSort by total static CPU.
View   Long-TermSort by view.

The given datatype, SortOrder is also an enumerated list, but with only two choices: Ascending, or Descending.

Returned Datatypes

The returned datatype RunningQueries has several parameters. Below is a list of them along with their datatypes and a description of each:

Table: RunningQueries

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Oct 3, 2024
queries[RunningQuery]yes Long-TermQueries being executed, at most 1000 queries are returned. See RunningQuery.
totalIncludedByteslongyes Long-TermTotal size of included bytes for all queries being executed.
totalNumberOfClientsintegeryes Long-TermTotal number of clients querying.
totalNumberOfLiveQueriesintegeryes Long-TermTotal number of live queries being executed.
totalNumberOfQueriesintegeryes Long-TermTotal number of queries being executed.
totalQueuedByteslongyes Long-TermTotal size of remaining bytes to be processed for all queries being executed.
totalSkippedByteslongyes Long-TermTotal size of skipped bytes for all queries being executed.
updateAvailableInlongyes Long-TermNumber of milliseconds until next update is available.