> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center.md).

# Overview of the Query Center

The **Query Center** displays information about all queries that were run on the tenant, and the queries that are currently **In Progress**. The **Query Center** displays the following tabs:

* **Query History**

  View and manage all completed Cortex Query Language (XQL) and Graph Search queries. On this tab you can view query results, re-run and adjust queries, and schedule when a query runs. You can also see details of cancelled queries, including the query type and source, and the name of the user who cancelled the query.
* **Active Queries**

  View and manage all queries that are currently **In Progress** on the tenant. You can view details about a running query, including the user who ran the query, the context from which it ran, the source of the query, and the amount of time that the query has been running. From this tab you can also cancel active queries.

{% hint style="info" %}

### Note

* Very short queries might not be listed.
* You cannot cancel correlation queries.
* The default retention period for historic queries is aligned with issue retention.
  {% endhint %}

**Query Center reference information**

The table below lists the common fields in the Query Center, where the options differ for an XQL query versus a Graph Search query.

{% hint style="info" %}

### Note

Certain fields are exposed and hidden by default. An asterisk (\*) is beside every field that is exposed by default.
{% endhint %}

<details>

<summary>Query Center table</summary>

| Field                       | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **BQL**                     | <p>Indicates whether the Cortex Query Language (XQL) query was created by the native search.</p><p>Native search has been deprecated; this field allows you to view data for XQL queries performed before deprecation.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| **COMPUTE UNIT USAGE**      | For XQL queries, indicates the number of query units that were used to execute the API query and Cold Storage query.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| **ISSUED BY** \*            | For XQL queries, indicates the user who ran or scheduled the query. For Graph Search queries, indicates the user who ran the query.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| **DURATION (SEC)**          | Number of seconds it took to execute the XQL query.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| **EXECUTION ID**            | Unique identifier of XQL and Graph Search queries in the tenant. The identifier ID generated for queries executed in Cortex AgentiX and XQL query API.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| **NUM OF RESULTS**\*        | Number of results returned by the query.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| **PUBLIC API**              | Whether the source executing the XQL query was an XQL query API.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| **QUERY DESCRIPTION**\*     | Query parameters used to run the query.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| **QUERY ID**                | Unique identifier of the query.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| **QUERY NAME**\*            | <ul><li><p>For saved queries, the <strong>Query Name</strong> identifies the query specified according to a randomly generated number.</p><ul><li>XQL queries use the format <strong>XQL-QUERY-\<number></strong>, such as <strong>XQL-QUERY-12</strong>.</li><li>Graph Search queries use the format <strong>Graph-Query-\<number></strong>, such as <strong>Graph-Query-1247</strong>.</li></ul></li><li>For scheduled queries, the <strong>Query Name</strong> identifies the auto-generated name of the parent XQL query. Scheduled queries also display an icon to the left of the name to indicate that the XQL query is recurring.</li></ul><p><img src="/files/5fKnJgMWXTTe7INPaPSQ" alt="query-scheduled.png" data-size="original"></p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| **QUERY STATUS**\*          | <p>Status of the query, where the options differ based on the query type:</p><ul><li><p>XQL queries:</p><ul><li><strong>Queued</strong>: The query is queued and will run when there is an available slot.</li><li><strong>Running</strong></li><li><strong>Failed</strong></li><li><strong>Partially completed</strong>: The query was stopped after exceeding the maximum number of permitted results. The default results for a Cortex Data Model (XDM) query or an XQL dataset query is limited to 1000, when no limit is explicitly stated in the query. This applies to basic queries with no stages except the <strong><code>fields</code></strong> stage. This default limit does not apply to widgets, Correlation Rules, public APIs, saved queries, or scheduled queries, where the limit is a maximum of 1,000,000 results. Queries based on legacy templates are limited to 10,000 results. To reduce the number of results returned, you can adjust the query settings and rerun.</li><li><strong>Stopped</strong>: The query was stopped by an administrator.</li><li><strong>Completed</strong></li><li><strong>Deleted</strong>: The query was pruned.</li></ul></li><li><p>Graph Search queries:</p><ul><li><strong>Failed</strong></li><li><strong>Completed</strong></li></ul></li></ul> |
| **QUERY SYNTAX**            | The exact syntax used to write the query.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| **RESULTS SAVED**\*         | For XQL queries, you can choose whether to save the query results, so the output of the field is either **Yes** or **No**. Yet, for Graph Search queries, the results can't be saved and must be run each time again, so the field is always **No**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| **SIMULATED COMPUTE UNITS** | Number of XQL query units that were used to execute the Hot Storage query.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| **Source**                  | Source from which the query was run, for example Playbook, Report, or Investigation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| **Source ID**               | ID of the source from where the query was run.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| **Source Name**             | Name of the source from where the query was run.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| **TIMESTAMP**\*             | Date and time the query was created.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| **XQL**                     | Indicates whether the XQL query was created by an XQL search.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
