Environment
- Carbon Black Cloud Console: .38 Release and higher
- Carbon Black Cloud Sensor: Version 3.3 and higher
- Microsoft Windows: All Supported Versions
Objective
Stop a running query in Live Query
Resolution
- Log in to Carbon Black Cloud console and navigate to the "Live Query" page
- Under "Query History", select a query that has a status of " in progress" that you would like to stop running
- In the live query details page, click "Stop Query" in the top right corner
- In the stop Query confirmation box, click "Stop Query"
- A green confirmation dialog will show, indicating that the request to stop the query has been submitted
- Confirm the query has been stopped by going to the Live Query page, and look for the status next to the query. The status should read "Stopped".
Additional Notes
- Any data already collected by the query at the time it stopped will still be visible in the live query details page.
- Before a query has begun running on the endpoint (It's queued up); the "stop" command informs the endpoint not to even begin running it. However, if it's already begun on an endpoint it will not be terminated. There is a code change planned to implement a terminate request (DSEN-8537).
Related Content
