[Yandex Cloud documentation](../../../index.md) > [Yandex SIEM](../../index.md) > [Step-by-step guides](../index.md) > [Queries](index.md) > Managing queries

# Managing queries

{% note info %}

This feature is in the [Preview](../../../overview/concepts/launch-stages.md) stage. To get access, contact [tech support](https://center.yandex.cloud/support) or your account manager.

{% endnote %}

This section describes how to create, manage, and run [KQL (Kusto Query Language)](../../kql-reference.md) queries.

## Creating a new query {#create-query}

To create a new query:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Open an investigation.
  1. Click **New query**.
  1. In the query editor, enter a KQL query or select a template.

  {% note tip %}

  Use the tooltip in the editor: Enter a query using KQL syntax, or select a template query.

  {% endnote %}

{% endlist %}

## Editing a query {#edit-query}

To edit a query:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Open an investigation with the required query.
  1. Select the tab with your query.
  1. Make your changes in the query editor.

  Changes are saved automatically.

{% endlist %}

## Selecting a period {#select-time-period}

To select a period for your query:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Click the period selector next to the start button.
  1. Select one of the presets:
     * Last 5 minutes
     * Last 30 minutes
     * Last hour
     * Last 3 hours
     * Last 6 hours
     * Last 12 hours
     * Last day

  Or select a custom period:

  1. Click the time period selector.
  1. Select a custom period.
  1. Specify the start date and time of the period.
  1. Specify the end date and time of the period.
  1. Click **Apply**.

{% endlist %}

## Running a query {#run-query}

To run a query:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Make sure your query is entered in the editor.
  1. Select a time period.
  1. Click the query run button.

  After you run it, the query enters the **Running** status. Once it is over, its results are presented in the table and on the histogram.

  {% note info %}
  
  Maximum number of rows in the investigation results: 1,000,000.
  
  {% endnote %}

{% endlist %}

## Stopping a running query {#stop-query}

To stop a running query:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. While the query is running, click the stop button.
  1. The request will enter the **Canceled** status.

{% endlist %}

## Renaming a query {#rename-query}

To rename a query:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Click the query name in the tab.
  1. Enter a new name.
  1. Press **Enter** or click outside the input field.

{% endlist %}

## Deleting a query {#delete-query}

To delete a query:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Right-click the query tab.
  1. Select **Delete**.
  1. Confirm the deletion.

  {% note warning %}

  Deleting a query is irreversible. The results and execution history will be deleted.

  {% endnote %}

{% endlist %}

## Sharing a query {#share-query}

To share a query:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Open the query.
  1. In the actions menu, select **Share**.
  1. Copy the query link.

  This link contains the query text and the selected period. The recipient will be able to open the query in their investigation.

{% endlist %}

## Customizing the fields displayed in the results {#configure-result-fields}

To customize the fields displayed in the results table:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Run the query.
  1. In the results table, click the column settings icon.
  1. Select the fields you want displayed.
  1. Reorder the fields by dragging and dropping.
  1. Click **Apply**.

{% endlist %}

#### Useful links {#see-also}

* [Investigations](../../concepts/investigations.md)
* [Queries](../../concepts/queries.md)
* [Working with query templates](work-with-templates.md)
* [History](query-history.md)