Skip to content
LogoLogScale DocumentationLibraryGuidance Release Notes Integrations Query Examples Training APIGraphQLSearch Archives Contact Support
🔖 🔔 ੆Help button for documentation
    • CrowdStrike Query Language (CQL)
    • Data Representation in LogScale
      • Event Stream
      • Event Structure
      • Event Timestamps
      • Event Data During Queries
      • Event Time Selection and Sequence
      • Field Naming and Standards
      • Data Retention and Expiration
      • Ingesting Old Data
    • Query Operation
      • Query Pipeline
        • Query Pipeline Sequence
        • Event Data Sources
        • Query Statement Order
        • Query Processing
        • Modifying Event Data
        • Modifying an Event Set
        • Finalizing an Event Set
      • Subqueries
        • Subquery Syntax
        • Subquery Inputs: What Events Are Processed
        • Subquery Outputs: How Results Are Used
        • Subquery Examples
        • Subquery Categories
        • Subquery Context and Limitations
      • Query Context
      • Files
      • Query Prefix
      • Effects of Limits
        • Implied Limit
        • Function Limits
        • Variables Governing Limits
      • Query Performance
      • Query Readability and Format
    • Query Language Syntax
      • Comments
      • Query Filters
      • Operators
      • Adding Fields to Events
      • User Parameters/Variables
      • Conditional Evaluation
      • Array Syntax
      • Expressions
      • Saved Searches (User Functions)
      • Function Syntax
      • Time Syntax
        • Supported Time Zones
        • Relative Time Syntax
      • Referencing Resources
      • Regular Expression Syntax
        • Regular Expression Engine V2 Syntax Patterns
        • Regular Expression Syntax Patterns
          • Unsupported Regular Expression Patterns
        • Regular Expression Flags
        • LogScale Regular Expression Engines
        • Differences from Other Regex Implementations
      • Persisted Aggregations Syntax
    • Function Operation
      • Function Parameters
      • Function Location
      • Function Input/Output
      • Function Types
    • Datatypes in CQL
      • Aggregate Function
      • Array
      • Arrayname
      • Array of aggregate functions
      • Array of arrays of strings
      • Array of expressions
      • Array of fieldnames
      • Array of numbers
      • Array of strings
      • Boolean
      • Double
      • Fixed Values
      • Expression
      • Fieldname
      • File
      • Function
      • Integer
      • Long
      • Number
      • Regex
      • Relative time
      • String
      • Time point
      • Timezone
    • Query Functions
      • Aggregate Query Functions
      • Array Query Functions
      • Comparison Query Functions
      • Conditional Query Functions
      • Data Manipulation Query Functions
      • Event Information Query Functions
      • Filtering Query Functions
      • Formatting Query Functions
      • Geolocation Query Functions
      • Hash Query Functions
      • Join Query Functions
      • Query Debugging Functions
      • Math Query Functions
      • Network and Location Query Functions
      • Parsing Query Functions
      • Preamble Query Functions
      • Regular Expression Query Functions
      • Security Related Query Functions
      • Sequence Query Functions
      • Statistics Query Functions
      • String Query Functions
      • Time and Date Query Functions
      • Transformation Query Functions
      • Widget Query Functions
      • accumulate()
      • appendAggregation()
      • array:append()
      • array:contains()
      • array:dedup()
      • array:drop()
      • array:eval()
      • array:exists()
      • array:filter()
      • array:intersection()
      • array:length()
      • array:reduceAll()
      • array:reduceColumn()
      • array:reduceRow()
      • array:regex()
      • array:rename()
      • array:sort()
      • array:union()
      • asn()
      • avg()
      • base64Decode()
      • base64Encode()
      • beta:param()
      • beta:repeating()
      • bitfield:extractFlags()
      • bitfield:extractFlagsAsArray()
      • bitfield:extractFlagsAsString()
      • bucket()
      • callFunction()
      • cidr()
      • coalesce()
      • collect()
      • communityId()
      • concat()
      • concatArray()
      • copyEvent()
      • correlate()
      • count()
      • counterAsRate()
      • createEvents()
      • crypto:md5()
      • crypto:sha1()
      • crypto:sha256()
      • default()
      • defineTable()
      • drop()
      • dropEvent()
      • duration()
      • end()
      • eval()
      • eventFieldCount()
      • eventInternals()
      • eventSize()
      • explain:asTable()
      • fieldset()
      • fieldstats()
      • findTimestamp()
      • format()
      • formatDuration()
      • formatTime()
      • geography:distance()
      • geohash()
      • getField()
      • groupBy()
      • hash()
      • hashMatch()
      • hashRewrite()
      • head()
      • if()
      • in()
      • ioc:lookup()
      • ipLocation()
      • join()
      • json:prettyPrint()
      • kvParse()
      • length()
      • linReg()
      • lower()
      • lowercase()
      • match()
      • matchAsArray()
      • math:abs()
      • math:arccos()
      • math:arcsin()
      • math:arctan()
      • math:arctan2()
      • math:ceil()
      • math:cos()
      • math:cosh()
      • math:deg2rad()
      • math:exp()
      • math:expm1()
      • math:floor()
      • math:log()
      • math:log10()
      • math:log1p()
      • math:log2()
      • math:mod()
      • math:pow()
      • math:rad2deg()
      • math:sin()
      • math:sinh()
      • math:spherical2cartesian()
      • math:sqrt()
      • math:tan()
      • math:tanh()
      • max()
      • min()
      • neighbor()
      • now()
      • objectArray:eval()
      • objectArray:exists()
      • parseCEF()
      • parseCsv()
      • parseFixedWidth()
      • parseHexString()
      • parseInt()
      • parseJson()
      • parseLEEF()
      • parseTimestamp()
      • parseUri()
      • parseUrl()
      • parseXml()
      • partition()
      • percentage()
      • percentile()
      • range()
      • rdns()
      • readFile()
      • readPersistedAggregation()
      • regex()
      • rename()
      • replace()
      • reverseDns()
      • round()
      • sample()
      • sankey()
      • select()
      • selectFromMax()
      • selectFromMin()
      • selectLast()
      • selfJoin()
      • selfJoinFilter()
      • series()
      • session()
      • setField()
      • setTimeInterval()
      • shannonEntropy()
      • slidingTimeWindow()
      • slidingWindow()
      • sort()
      • split()
      • splitString()
      • start()
      • stats()
      • stdDev()
      • stripAnsiCodes()
      • subnet()
      • sum()
      • table()
      • tail()
      • test()
      • text:contains()
      • text:editDistance()
      • text:editDistanceAsArray()
      • text:endsWith()
      • text:length()
      • text:positionOf()
      • text:startsWith()
      • text:substring()
      • text:trim()
      • time:dayOfMonth()
      • time:dayOfWeek()
      • time:dayOfWeekName()
      • time:dayOfYear()
      • time:hour()
      • time:millisecond()
      • time:minute()
      • time:month()
      • time:monthName()
      • time:second()
      • time:weekOfYear()
      • time:year()
      • timeChart()
      • tokenHash()
      • top()
      • transpose()
      • unit:convert()
      • upper()
      • urlDecode()
      • urlEncode()
      • wildcard()
      • window()
      • worldMap()
      • writeJson()
      • xml:prettyPrint()
    • Common Query Patterns
      • Common Misconceptions
      • Converting Data
      • Modifying Data
      • Array Operations
      • Deduplicating Data
      • Limiting Returned Events
        • Grouping or Limting by Specific fields
      • Sorting Data
      • Formatting Values
      • LogScale and Time
      • Other Tricks and Recipes
    • Query Basics
    • Query management
      • Writing New Queries
      • Save searches
      • Grant Permissions for Saved Queries
      • Use Saved Queries in Interactions
    • Troubleshooting Queries
    • SQL to CQL
      • LogScale and Database Terminology
      • SQL to CQL: Basic Query Structure
      • SQL to CQL: Time-Based Queries
      • SQL to CQL: Pattern Matching & Search
      • SQL to CQL: Dynamic vs. Static Schema
      • SQL to CQL: Analytical Capabilities
      • SQL to CQL: Iterative Development Approach
      • SQL to CQL: Collaboration & Reusability
      • SQL to CQL: Sorting and Limiting Results
      • SQL to CQL: Filtering with Multiple Conditions
      • SQL to CQL: Data Aggregation
      • SQL to CQL: Subqueries
      • SQL to CQL: Joins and Correlations
Falcon LogScale Documentation
/ CrowdStrike Query Language
/ Datatypes in CQL
Content was updated:May 21, 2026

Long

A signed 8-byte (64-bit) integer. The value can be a positive or negative whole number.

logscale
timestamp := 1609459200000
bytes_total := 9876543210
user_id := 123456789012345
max_value := 9223372036854775807
offset := -9876543210

Functions using this Type: beta:repeating(), bucket(), dropEvent(), eval(), fieldset(), formatDuration(), window()

Support
  • Twitter
  • LinkedIn
  • Youtube

© 2026 CrowdStrike All other marks contained herein are the property of their respective owners.

Enter search term