Skip to content
LogoLogScale DocumentationLibraryGuidance Release Notes Integrations Query Examples Training APIGraphQLSearch Archives Contact Support
🔖 🔔 ੆Help button for documentation
    • CrowdStrike Query Language (CQL)
    • Data Representation in LogScale
      • Event Stream
      • Event Structure
      • Event Timestamps
      • Event Data During Queries
      • Event Time Selection and Sequence
      • Field Naming and Standards
      • Data Retention and Expiration
      • Ingesting Old Data
    • Query Operation
      • Query Pipeline
        • Query Pipeline Sequence
        • Event Data Sources
        • Query Statement Order
        • Query Processing
        • Modifying Event Data
        • Modifying an Event Set
        • Finalizing an Event Set
      • Subqueries
        • Subquery Syntax
        • Subquery Inputs: What Events Are Processed
        • Subquery Outputs: How Results Are Used
        • Subquery Examples
        • Subquery Categories
        • Subquery Context and Limitations
      • Query Context
      • Files
      • Query Prefix
      • Effects of Limits
        • Implied Limit
        • Function Limits
        • Variables Governing Limits
      • Query Performance
      • Query Readability and Format
    • Query Language Syntax
      • Comments
      • Query Filters
      • Operators
      • Adding Fields to Events
      • User Parameters/Variables
      • Conditional Evaluation
      • Array Syntax
      • Expressions
      • Saved Searches (User Functions)
      • Function Syntax
      • Time Syntax
        • Supported Time Zones
        • Relative Time Syntax
      • Referencing Resources
      • Regular Expression Syntax
        • Regular Expression Engine V2 Syntax Patterns
        • Regular Expression Syntax Patterns
          • Unsupported Regular Expression Patterns
        • Regular Expression Flags
        • LogScale Regular Expression Engines
        • Differences from Other Regex Implementations
      • Persisted Aggregations Syntax
    • Function Operation
      • Function Parameters
      • Function Location
      • Function Input/Output
      • Function Types
    • Datatypes in CQL
      • Aggregate Function
      • Array
      • Arrayname
      • Array of aggregate functions
      • Array of arrays of strings
      • Array of expressions
      • Array of fieldnames
      • Array of numbers
      • Array of strings
      • Boolean
      • Double
      • Fixed Values
      • Expression
      • Fieldname
      • File
      • Function
      • Integer
      • Long
      • Number
      • Regex
      • Relative time
      • String
      • Time point
      • Timezone
    • Query Functions
      • Aggregate Query Functions
      • Array Query Functions
      • Comparison Query Functions
      • Conditional Query Functions
      • Data Manipulation Query Functions
      • Event Information Query Functions
      • Filtering Query Functions
      • Formatting Query Functions
      • Geolocation Query Functions
      • Hash Query Functions
      • Join Query Functions
      • Query Debugging Functions
      • Math Query Functions
      • Network and Location Query Functions
      • Parsing Query Functions
      • Preamble Query Functions
      • Regular Expression Query Functions
      • Security Related Query Functions
      • Sequence Query Functions
      • Statistics Query Functions
      • String Query Functions
      • Time and Date Query Functions
      • Transformation Query Functions
      • Widget Query Functions
      • accumulate()
      • appendAggregation()
      • array:append()
      • array:contains()
      • array:dedup()
      • array:drop()
      • array:eval()
      • array:exists()
      • array:filter()
      • array:intersection()
      • array:length()
      • array:reduceAll()
      • array:reduceColumn()
      • array:reduceRow()
      • array:regex()
      • array:rename()
      • array:sort()
      • array:union()
      • asn()
      • avg()
      • base64Decode()
      • base64Encode()
      • beta:param()
      • beta:repeating()
      • bitfield:extractFlags()
      • bitfield:extractFlagsAsArray()
      • bitfield:extractFlagsAsString()
      • bucket()
      • callFunction()
      • cidr()
      • coalesce()
      • collect()
      • communityId()
      • concat()
      • concatArray()
      • copyEvent()
      • correlate()
      • count()
      • counterAsRate()
      • createEvents()
      • crypto:md5()
      • crypto:sha1()
      • crypto:sha256()
      • default()
      • defineTable()
      • drop()
      • dropEvent()
      • duration()
      • end()
      • eval()
      • eventFieldCount()
      • eventInternals()
      • eventSize()
      • explain:asTable()
      • fieldset()
      • fieldstats()
      • findTimestamp()
      • format()
      • formatDuration()
      • formatTime()
      • geography:distance()
      • geohash()
      • getField()
      • groupBy()
      • hash()
      • hashMatch()
      • hashRewrite()
      • head()
      • if()
      • in()
      • ioc:lookup()
      • ipLocation()
      • join()
      • json:prettyPrint()
      • kvParse()
      • length()
      • linReg()
      • lower()
      • lowercase()
      • match()
      • matchAsArray()
      • math:abs()
      • math:arccos()
      • math:arcsin()
      • math:arctan()
      • math:arctan2()
      • math:ceil()
      • math:cos()
      • math:cosh()
      • math:deg2rad()
      • math:exp()
      • math:expm1()
      • math:floor()
      • math:log()
      • math:log10()
      • math:log1p()
      • math:log2()
      • math:mod()
      • math:pow()
      • math:rad2deg()
      • math:sin()
      • math:sinh()
      • math:spherical2cartesian()
      • math:sqrt()
      • math:tan()
      • math:tanh()
      • max()
      • min()
      • neighbor()
      • now()
      • objectArray:eval()
      • objectArray:exists()
      • parseCEF()
      • parseCsv()
      • parseFixedWidth()
      • parseHexString()
      • parseInt()
      • parseJson()
      • parseLEEF()
      • parseTimestamp()
      • parseUri()
      • parseUrl()
      • parseXml()
      • partition()
      • percentage()
      • percentile()
      • range()
      • rdns()
      • readFile()
      • readPersistedAggregation()
      • regex()
      • rename()
      • replace()
      • reverseDns()
      • round()
      • sample()
      • sankey()
      • select()
      • selectFromMax()
      • selectFromMin()
      • selectLast()
      • selfJoin()
      • selfJoinFilter()
      • series()
      • session()
      • setField()
      • setTimeInterval()
      • shannonEntropy()
      • slidingTimeWindow()
      • slidingWindow()
      • sort()
      • split()
      • splitString()
      • start()
      • stats()
      • stdDev()
      • stripAnsiCodes()
      • subnet()
      • sum()
      • table()
      • tail()
      • test()
      • text:contains()
      • text:editDistance()
      • text:editDistanceAsArray()
      • text:endsWith()
      • text:length()
      • text:positionOf()
      • text:startsWith()
      • text:substring()
      • text:trim()
      • time:dayOfMonth()
      • time:dayOfWeek()
      • time:dayOfWeekName()
      • time:dayOfYear()
      • time:hour()
      • time:millisecond()
      • time:minute()
      • time:month()
      • time:monthName()
      • time:second()
      • time:weekOfYear()
      • time:year()
      • timeChart()
      • tokenHash()
      • top()
      • transpose()
      • unit:convert()
      • upper()
      • urlDecode()
      • urlEncode()
      • wildcard()
      • window()
      • worldMap()
      • writeJson()
      • xml:prettyPrint()
    • Common Query Patterns
      • Common Misconceptions
      • Converting Data
      • Modifying Data
      • Array Operations
      • Deduplicating Data
      • Limiting Returned Events
        • Grouping or Limting by Specific fields
      • Sorting Data
      • Formatting Values
      • LogScale and Time
      • Other Tricks and Recipes
    • Query Basics
    • Query management
      • Writing New Queries
      • Save searches
      • Grant Permissions for Saved Queries
      • Use Saved Queries in Interactions
    • Troubleshooting Queries
    • SQL to CQL
      • LogScale and Database Terminology
      • SQL to CQL: Basic Query Structure
      • SQL to CQL: Time-Based Queries
      • SQL to CQL: Pattern Matching & Search
      • SQL to CQL: Dynamic vs. Static Schema
      • SQL to CQL: Analytical Capabilities
      • SQL to CQL: Iterative Development Approach
      • SQL to CQL: Collaboration & Reusability
      • SQL to CQL: Sorting and Limiting Results
      • SQL to CQL: Filtering with Multiple Conditions
      • SQL to CQL: Data Aggregation
      • SQL to CQL: Subqueries
      • SQL to CQL: Joins and Correlations
Falcon LogScale Documentation
/ CrowdStrike Query Language

Query management

In LogScale, use the Search page to perform these activities:

  • Writing New Queries

  • Save searches

  • Grant Permissions for Saved Queries

  • Use Saved Queries in Interactions

Support
  • Twitter
  • LinkedIn
  • Youtube

© 2026 CrowdStrike All other marks contained herein are the property of their respective owners.

Children of this Page

Writing New Queries
Save searches
Grant Permissions for Saved Queries
Use Saved Queries in Interactions

  • Other articles on this topic

    • Grammar Subset
    • Queries and Querying
    • Save Results

  • Similar Content

    • Query Basics
    • Query Functions

  • Related Language Syntax

    • Adding Fields to Events
    • Conditional Evaluation
    • Function Syntax
    • Operators
    • Query Filters
    • Query Language Syntax
    • Time Syntax
    • User Parameters (Variables)

Enter search term