Repeating Queries

Overview

Some functions have limitations around their use in live queries, such as join (see Limitations of live joins) and selfjoin.

Beginning with version 1.17, Humio provides an alternative way of doing live queries to overcome these limitations: repeating queries. A repeating query is a static query that is executed at regular intervals and can be used in the same places as live queries, such as in dashboards or alerts.

When this feature is enabled,you can turn a live query into a repeating by adding the beta:repeating function to the query. For example, this query will be repeated every 10 minutes and can be used in dashboards and alerts:

selfJoin(field=email_id, where=[{from=peter},{to=anders}]) | beta:repeating(10m)

Using beta:repeating in a static query is allowed, but has no effect.

If query snapshot cache is enabled, the static queries made by a repeating query will reuse previous results and will consequently not be as much work for Humio to execute as a regular static query. When this happens, the update interval will be adjusted to the nearest time-bucket.

Enabling Repeating Queries

Repeating queries are in beta. In order to use repeating queries, you must enable them by making the following GraphQL mutation as root from the API explorer found at $$YOUR_HUMIO_URL/docs/api-explorer:

mutation {
    enableFeature(feature: RepeatingQueries)
}

Note that if this feature is disabled later then any alert, dashboard, or saved query using beta:repeating in the query will not function.