.show queries
The .show queries command lists queued, running, or all queued and running searches. You can limit the list to only searches run by a specific user.
.show queries ignores the set time range.
// show all queued and running searches
.show queriesPurpose
Use .show queries to monitor search status, track individual and overall search performance, and identify searches that are taking longer than expected. This command is especially useful in multi-user environments.
Permissions
| Search Member Type | Permissions |
|---|---|
| Admin | Can see all searches in their Organization. |
| Editor or User | Can see only those searches that they ran themselves or that were shared with them. |
Syntax
.show [Status] queries [by user User] [with(reason = "InvestigationReason")]
You can also combine this command with operators.
Parameters
| Parameter | Type | Description |
|---|---|---|
Status | string | The status of the queries to list:
|
User | string | The names of the user whose queries you want to list. |
InvestigationReason | string | The reason for running the .show queries command, which is added to the Cribl Search audit log. |
Returns
Returns the details of the specified searches.
Examples
Show searches queued by specific users.
.show queued queries by user "John*" with(reason = "Just checking.")Show searches being run by specific users.
.show running queries by user "John*" with(reason = "Thinking of resources.")Show all running searches.
.show running queries with(reason = "Checking what's taking so long.")