Check currently running queries

Users with the necessary permissions can go to Data Search → Query Management to consult a list of the queries currently running in a domain. This lets you check their priority, CPU consumption, the number of parsed and returned events, and the quantity of parsed bytes. You can also copy a query's LINQ script or cancel a query from running.

To copy a query's LINQ script, select the row of the query. The script is displayed and the copy icon on the right can be used to copy the script to the clipboard. You can also click the ellipsis icon that appears at the end of the row upon hovering and select Show query.
To cancel a query, click the ellipsis icon that appears at the end of the row upon hovering and select Cancel query. Canceling a query stops it from running until it is activated again. When a query has been canceled, it disappears from the list.

Click this icon at the top right corner to refresh the list of queries.

Related to Data Search, the Query Management area shows dates relating to the query to calculate the histogram and query or queries to get the events shown in the table. The time range of the query may not coincide with the time range selected. The Started column shows the time the query was executed. The from and to columns show the date range for the query.

For the histogram, if various time ranges have been selected, only the missing interval will be loaded. These missing intervals are due to previous histogram data being discarded when the difference between the time ranges selected is more than three days. If there is a difference of less than three days, the histogram is simply extended without discarding any data.

As well as building the histogram, there are queries to search events. In this case, various queries with time ranges falling within the search interval can be executed, to avoid downloading all of the data and to prevent browser memory exhaustion.