Skip to content
LogoLogScale DocumentationFull Library Knowledge Base Release Notes Integrations Query Examples Training API GraphQL API Contacting Support
help

Versions of this Page

    • Cloud Overview
    • Getting Started
    • Instance Administration
      • Cluster statistics
      • Data Retention
      • Data Archiving
        • S3 Archiving
      • LogScale Internal Logging
      • LogScale SaaS Upgrades
      • Ingest Usage Management
        • What's Measured
          • Measurement Repositories
        • Measure Data Ingest
        • Optimize Ingestion
          • Best Practices to Optimize Data Ingestion
        • Monitor Usage
      • Dynamic Configuration Parameters
        • AdHocTablesLimit
        • AggregatorOutputRowLimit
        • AllowInPlaceMigration
        • ArchivingClusterWideDisabled
        • ArchivingClusterWideEndAt
        • ArchivingClusterWideRegexForRepoName
        • ArchivingClusterWideStartFrom
        • BlockSignup
        • BucketStorageKeySchemeVersion
        • BucketStorageUploadInfrequentThresholdDays
        • BucketStorageWriteVersion
        • CancelQueriesExceedingAggregateOutputRowLimit
        • CorrelateConstellationTickLimit
        • CorrelateConstraintLimit
        • CorrelateLinkValuesLimit
        • CorrelateLinkValuesMaxByteSize
        • CorrelateMinIterations
        • CorrelateNumberOfTimeBuckets
        • CorrelateQueryEventLimit
        • CorrelateQueryLimit
        • DebugAuditRequestTrace
        • defaultDigestReplicationFactor
        • defaultSegmentReplicationFactor
        • DeleteDuplicatedNameViewsAfterMerging
        • DisableAnalyticsJob
        • DisableNewRegexEngine
        • DisableUserTracking
        • DisableViewWithSameNameCleanup
        • EnableGlobalJsonStatsLogger
        • ExternalAssetsCacheGeneralizationEnabled
        • ExternalFunctionRequestResponseEventCountLimit
        • ExternalFunctionRequestResponseSizeLimitBytes
        • FdrEnable
        • FdrExcludedNodes
        • FdrMaxNodes
        • FdrMaxNodesPerFeed
        • FdrS3FileSizeMax
        • FileReplicationFactor
        • FlushSegmentsAndGlobalOnShutdown
        • GracePeriodBeforeDeletingDeadEphemeralHostsMs
        • GracefulShutdownConsideredAliveSeconds
        • GraphQLSelectionSizeLimit
        • GraphQLAliasCountLimit
        • GraphQLDirectiveCountLimit
        • GraphQlDirectivesAmountLimit
        • GraphQLQueryAnalysisDisabled
        • GroupDefaultLimit
        • GroupMaxLimit
        • IngestFeedAwsDownloadMaxObjectSize
        • IngestFeedAwsProcessingDownloadBufferSize
        • IngestFeedAwsProcessingEventBufferSize
        • IngestFeedAwsProcessingEventsPerBatch
        • IngestFeedGovernorRateOverride
        • IngestFeedGovernorIngestDelayHigh
        • IngestFeedGovernorIngestDelayLow
        • IsAutomaticUpdateCheckingAllowed
        • JoinDefaultLimit
        • JoinRowLimit
        • LiveAdhocTableUpdatePeriodMinimumMs
        • LiveQueryMemoryLimit
        • LookupTableSyncAwaitSeconds
        • MatchFilesMaxHeapFraction
        • MaxAccessTokenTTL
        • MaxRelocatedDatasourcesInGlobal
        • MaxConcurrentQueriesOnWorker
        • MaxCsvFileUploadSizeBytes
        • MaxIngestRequestSize
        • MaxJsonFileUploadSizeBytes
        • MaxOpenSegmentsOnWorker
        • MaxQueryPenaltyCreditForBlockedQueriesFactor
        • MaxQueryPollsForWorker
        • MinQueryPermitsFactor
        • MinimumHumioVersion
        • MultiPassDefaultIterationLimit
        • MultiPassMaxIterationLimit
        • ParserBacktrackingLimit
        • ParserThrottlingAllocationFactor
        • QueryFSMSyncMergeThreshold
        • QueryBacktrackingLimit
        • QueryCoordinatorMaxHeapFraction
        • QueryCoordinatorMemoryLimit
        • QueryMemoryLimit
        • QueryPartitionAutoBalance
        • QueryResultRowCountLimit
        • QueryMaxLength
        • RdnsDefaultLimit
        • RdnsMaxLimit
        • RejectIngestOnParserExceedingFraction
        • ReplaceANSIEscapeCodes
        • ReverseDnsConcurrentRequests
        • ReverseDnsDefaultLimit
        • ReverseDnsDefaultTimeoutInMs
        • ReverseDnsMaxLimit
        • ReverseDnsRequestsPerSecond
        • S3ArchivingClusterWideDisabled
        • S3ArchivingClusterWideEndAt
        • S3ArchivingClusterWideRegexForRepoName
        • S3ArchivingClusterWideStartFrom
        • SampleIntervalForDatasourceRates
        • SelfJoinLimit
        • StateRowLimit
        • StaticQueryFractionOfCores
        • TableCacheMaxStorageFraction
        • TableCacheMaxStorageFractionForIngestAndHttpOnly
        • TableCacheMemoryAllowanceFraction
        • TargetMaxRateForDatasource
        • UnauthenticatedGraphQLSelectionSizeLimit
        • UndersizedMergingRetentionPercentage
        • Getting Dynamic Configuration List
        • Setting a Dynamic Configuration Value
    • Organization Essentials
      • Organization Settings
      • Organization Query Monitor
        • Query Stats
        • Query Details
        • Query Clients
        • Block and Kill
      • Blocking Queries
        • Add Query to Blocklist
        • Blocked Query Indications
    • Configure Security
      • Tokens in LogScale
      • API Tokens
        • Use API Tokens
          • Use an Expired API Token
          • Use an IP Filtered API Token
        • Repository and View API Tokens
          • View Repository Tokens
          • Create Repository API Tokens
          • Manage Repository API Tokens
        • Organization API Tokens
          • View Organization API Tokens
          • Create Organization API Tokens
          • Manage Organization API Tokens
        • Personal API Token
      • IP Filters
        • IP Filter Rules
        • Manage IP Filters
        • Create an IP Filter
        • Edit an IP Filter
      • Security policies
        • Dashboard security policies
        • API token security policies
          • Behavior when changing token security policies
          • Personal API token security policy
          • Repository and View API tokens security policy
          • Organization API tokens security policies
        • Actions security policies
        • Change actions security policies
          • Email action security policy
          • OpsGenie action security policy
          • PagerDuty action security policy
          • Slack action security policy
          • Upload file action security policy
          • LogScale repository action security policy
          • VictorOps action security policy
          • Custom webhook actions action security policy
      • Session management
      • Audit Logging
    • Authentication and identity providers
      • SAML Authentication
        • Active Dir. Federation Svc.
        • Entra ID (formerly Azure Active Dir.)
        • Duo Security
        • Okta
        • PingOne
        • Google
        • Auth0
      • OpenID Connect
    • Users and Permissions
      • Manage Users
        • Manage User Roles
        • Grant Permissions to Specific Assets
      • Manage Groups
        • Group Roles
        • Grant permissions to specific assets to groups
        • Group Memberships
        • Group Synchronization
      • Manage Roles
        • Default Role Permissions
      • Permissions requirements
        • Repository and View permissions
        • Organization Admin. Permissions
        • Supported Functionality
        • Functionality Requirements
    • Ingesting Data
      • Log Shippers
      • Backfilling Data
      • Disabling Ingestion
      • Ingest FDR Data
        • Troubleshooting FDR Ingest
      • Ingest Tokens
      • Ingest Feeds
        • Ingest Data from AWS S3
          • Set up a New AWS Ingest Feed
          • Edit Ingest Feed Configuration
          • Delete an Ingest Feed
          • Enable and Disable Ingest Feeds
        • Ingest Data from Azure Event Hubs
          • Set up a New Azure Ingest Feed
          • Edit Azure Ingest Feed Configuration
          • Delete an Azure Ingest Feed
          • Enable and Disable Azure Ingest Feeds
    • LogScale URLs and Endpoints
    • Limits and Standards

 

    • Data Analysis Overview
    • LogScale Web Interface
      • System Tabs and Falcon Icon
      • Navigation Icons
        • Notifications
        • Releases and Release Notes
        • Help
        • Avatar icon
      • Informational Panels
      • Left-hand Navigation Panel
      • Table Components
      • Repositories and Views
        • Repositories and Views Menubar
        • Search interface
        • Dashboards Interface
        • Automation Interface
        • Parsers Interface
        • Resources Interface
          • Asset Type Interface Elements
        • Settings Interface
      • All Dashboards
      • Data Ingest
    • Manage Repositories and Views
      • Create Repository or View
      • Repository and View Settings
      • Falcon LTR Repositories
      • Lookup Files
      • Delete a Repository or View
    • Manage Account
    • Parse Data
      • Built-in Parsers
      • Create a Parser
          • Normalize and Validate Against CPS Schema
      • Ingest Tokens
      • Parser Errors
      • Removing Fields
      • Parsing Event Tags
      • Parsing Timestamps
    • Search Data
      • Query Editor
      • Event Fields
      • Display Fields
      • Select and Filter Fields
      • Add and Remove Fields
      • Display Results and Events
      • Inspect Events
      • Copy Rows
      • Look Up Events
      • Show in Context
      • Format Columns
      • Column Properties
      • Field Data Types
      • Field Interactions
      • Different Visuals
      • Highlight Filter Match
      • Change Time Interval
      • Set Time Zone
      • Save Results
      • Export Data
      • Search Status
      • Event List Interactions
      • Field Aliasing
        • Configuring Field Aliasing
        • Managing Field Aliasing
        • Searching with Field Aliasing
        • Understanding Field Mapping Requirements
        • Understanding Schema Requirements
    • Write Queries
      • Basic query principles
      • Returned events
      • Query management
        • Write new queries
        • Save searches
        • Grant permissions for saved queries
        • Use saved queries in interactions
      • Common Queries
      • Statement order for better queries
      • Query readability and better usage
    • Query Language Syntax
      • Comments
      • Query Filters
      • Operators
      • Adding Fields to Events
      • User Parameters/Variables
      • Conditional Evaluation
      • Array Syntax
      • Expressions
      • Function Syntax
      • Time Syntax
        • Supported Time Zones
        • Relative Time Syntax
      • Referencing Resources
      • Regular Expression Syntax
        • Regular Expression Syntax Patterns
        • Unsupported Regular Expression Patterns
        • Regular Expression Flags
        • LogScale Regular Expression Engines
        • Differences from Other Regex Implementations
    • Query Joins and Lookups
      • Types of Join
      • Join Methods
      • Asset Resolution in Subqueries
      • Using Ad-hoc Tables
      • Using Lookup Files
        • Using the readFile() Function
        • Using the match() Function
      • Using join() or selfJoin()
        • Using the join() Function
        • Using the selfJoin() Function
        • Join Operation and Optimization
    • Query Functions
      • Aggregate Query Functions
      • Array Query Functions
      • Comparison Query Functions
      • Conditional Query Functions
      • Data Manipulation Query Functions
      • Event Information Query Functions
      • Filtering Query Functions
      • Formatting Query Functions
      • Geolocation Query Functions
      • Hash Query Functions
      • Join Query Functions
      • Math Query Functions
      • Network and Location Query Functions
      • Parsing Query Functions
      • Preamble Query Functions
      • Regular Expression Query Functions
      • Security Related Query Functions
      • Sequence Query Functions
      • Statistics Query Functions
      • String Query Functions
      • Time and Date Query Functions
      • Tranformation Query Functions
      • Widget Query Functions
      • accumulate()
      • array:append()
      • array:contains()
      • array:dedup()
      • array:drop()
      • array:eval()
      • array:exists()
      • array:filter()
      • array:intersection()
      • array:length()
      • array:reduceAll()
      • array:reduceColumn()
      • array:reduceRow()
      • array:regex()
      • array:rename()
      • array:sort()
      • array:union()
      • asn()
      • avg()
      • base64Decode()
      • base64Encode()
      • beta:param()
      • beta:repeating()
      • bitfield:extractFlags()
      • bitfield:extractFlagsAsArray()
      • bitfield:extractFlagsAsString()
      • bucket()
      • callFunction()
      • cidr()
      • coalesce()
      • collect()
      • communityId()
      • concat()
      • concatArray()
      • copyEvent()
      • correlate()
      • count()
      • counterAsRate()
      • createEvents()
      • crypto:md5()
      • crypto:sha1()
      • crypto:sha256()
      • default()
      • defineTable()
      • drop()
      • dropEvent()
      • duration()
      • end()
      • eval()
      • eventFieldCount()
      • eventInternals()
      • eventSize()
      • fieldset()
      • fieldstats()
      • findTimestamp()
      • format()
      • formatDuration()
      • formatTime()
      • geography:distance()
      • geohash()
      • getField()
      • groupBy()
          • Grouping in groupBy()
          • Limits when using groupBy()
      • hash()
      • hashMatch()
      • hashRewrite()
      • head()
      • if()
      • in()
      • ioc:lookup()
      • ipLocation()
      • join()
      • json:prettyPrint()
      • kvParse()
      • length()
      • linReg()
      • lower()
      • lowercase()
      • match()
      • matchAsArray()
      • math:abs()
      • math:arccos()
      • math:arcsin()
      • math:arctan()
      • math:arctan2()
      • math:ceil()
      • math:cos()
      • math:cosh()
      • math:deg2rad()
      • math:exp()
      • math:expm1()
      • math:floor()
      • math:log()
      • math:log10()
      • math:log1p()
      • math:log2()
      • math:mod()
      • math:pow()
      • math:rad2deg()
      • math:sin()
      • math:sinh()
      • math:spherical2cartesian()
      • math:sqrt()
      • math:tan()
      • math:tanh()
      • max()
      • min()
      • neighbor()
      • now()
      • objectArray:eval()
      • objectArray:exists()
      • parseCEF()
      • parseCsv()
      • parseFixedWidth()
      • parseHexString()
      • parseInt()
      • parseJson()
      • parseLEEF()
      • parseTimestamp()
      • parseUri()
      • parseUrl()
      • parseXml()
      • partition()
      • percentage()
      • percentile()
      • range()
      • rdns()
      • readFile()
      • regex()
      • rename()
      • replace()
      • reverseDns()
      • round()
      • sample()
      • sankey()
      • select()
      • selectFromMax()
      • selectFromMin()
      • selectLast()
      • selfJoin()
      • selfJoinFilter()
      • series()
      • session()
      • setField()
      • setTimeInterval()
      • shannonEntropy()
      • slidingTimeWindow()
      • slidingWindow()
      • sort()
      • split()
      • splitString()
      • start()
      • stats()
      • stdDev()
      • stripAnsiCodes()
      • subnet()
      • sum()
      • table()
      • tail()
      • test()
      • text:contains()
      • text:editDistance()
      • text:editDistanceAsArray()
      • text:endsWith()
      • text:length()
      • text:positionOf()
      • text:startsWith()
      • text:substring()
      • time:dayOfMonth()
      • time:dayOfWeek()
      • time:dayOfWeekName()
      • time:dayOfYear()
      • time:hour()
      • time:millisecond()
      • time:minute()
      • time:month()
      • time:monthName()
      • time:second()
      • time:weekOfYear()
      • time:year()
      • timeChart()
      • tokenHash()
      • top()
      • transpose()
      • unit:convert()
      • upper()
      • urlDecode()
      • urlEncode()
      • wildcard()
      • window()
      • worldMap()
      • writeJson()
      • xml:prettyPrint()
    • Data Visualization
      • Dashboards
        • Step-by-Step Guide to Dashboards
        • Create Dashboards
        • Manage Dashboards
        • Customize Dashboards
        • Design the Dashboard Layout
          • Dashboard Sections
        • Work with Time on Dashboards
          • Shared Time Selector
          • Widget Time Selector
          • Section Time Selector
          • Live Dashboards
          • Time Zone Settings
          • Default Time Settings for Dashboards
        • Make your Dashboard Interactive
          • Apply Dashboard Filters
          • Work with Dashboard Parameters
          • Work with Dashboard Interactions
        • Share Dashboards
          • Disabling Access to Shared Dashboards
          • Restricting Access with IP Filters
        • Export Dashboards as PDF
          • PDF Export Options
        • Schedule PDF Reports
          • Scheduled Reports Security
          • Managing Scheduled Reports
          • Create Scheduled Reports
          • Edit Scheduled Reports
          • Limitations
          • Scheduled Reports Errors and Resolutions
      • Widgets
        • Create Widgets
        • Manage Widgets
          • Widgets with live join() functions
          • Embedding iFrame Widgets
        • Widgets Gallery
        • Bar Chart Widget
          • Bar Chart Usage and Data Format
          • Bar Chart Examples Gallery
            • Event Detection Across Severity Levels
            • Failed and Successful Authentication Attempts
            • Threat Type Distribution
            • Alert Type Proportion in Detection Sources
            • Daily Detection Counts with Detection Severity Average
          • Bar Chart Property Reference
        • Event List Widget
          • Event List Usage and Data Format
          • Event List Property Reference
        • Gauge Widget
          • Gauge Usage and Data Format
          • Gauge Examples Gallery
            • Display Number of Errors
            • Display Query Memory
            • Display Small Multiple Charts
          • Gauge Property Reference
        • Heat Map Widget
          • Heat Map Usage and Data Format
          • Heat Map Examples Gallery
            • Github Push Events
            • Response Time
          • Heat Map Property Reference
        • Note Widget
            • Note Widget Property Reference
        • Parameter Panel Widget
        • Pie Chart Widget
          • Pie Chart Usage and Data Format
          • Pie Chart Examples Gallery
            • Log Level Distribution
            • Method Distribution in Small Multiples
          • Pie Chart Property Reference
        • Sankey Diagram Widget
          • Sankey Usage and Data Format
          • Sankey Examples Gallery
            • Network Traffic
            • Thread Usage
          • Sankey Property Reference
        • Scatter Chart Widget
          • Usage and Data Format
          • Scatter Chart Property Reference
        • Single Value Widget
          • Single Value Usage and Data Format
          • Single Value Examples Gallery
            • Displaying Number of Errors
            • Displaying Statistics from a Build
            • Displaying a Non-Numeric Value
            • Displaying a Trend with a Timechart
            • Displaying Values in a Grid
          • Single Value Property Reference
        • Table Widget
          • Table Usage and Data Format
          • Table Widget Interactions
          • Table Widget Examples Gallery
            • Display Different Statuses
            • Add Temporary Events and URLs
          • Table Property Reference
        • Time Chart Widget
          • Time Chart Usage and Data Format
          • Time Chart Examples Gallery
            • Charting Metric Data
            • Charting Log Levels
            • Charting Commits in GitHub
          • Time Chart Property Reference
        • World Map Widget
          • World Map Usage and Data Format
          • World Map Examples Gallery
            • IP-Based Geographic Distribution
            • Service Performance Monitorings
            • Geohash Performance Clustering
          • World Map Property Reference
    • Automation
      • Triggers
        • What trigger type to choose
        • General information about triggers
        • Trigger management
          • Create triggers
          • Edit triggers
          • Manage triggers
        • Trigger properties
          • General properties
          • Configuration
          • Actions
          • Advanced settings
          • Scheduled search properties
        • Monitor, diagnose, and troubleshoot triggers
          • Monitor Triggers with humio-activity Repository
          • Aggregate alert errors and solutions
          • Scheduled search errors and solutions
          • Filter alert errors and solutions
          • Legacy alert errors and solutions
          • Errors when Using Live join() Functions
      • Actions
        • Create Actions
        • Manage Actions
        • Action Type: Email
        • Action Type: Falcon LogScale Repository
        • Action Type: OpsGenie
        • Action Type: PagerDuty
        • Action Type: Slack
        • Action Type: Lookup File
        • Action Type: VictorOps (Splunk On-Call)
        • Action Type: Webhooks
        • Send aggregate results to actions
        • Message Templates and Variables
      • Cron Scheduling
    • Template Language
      • Template Expressions
      • Template Variable Types
      • Template Examples
    • Keyboard Shortcuts
LogScale Cloud
Falcon LogScale Documentation
/ Falcon LogScale Cloud 1.208.0-1.216.0
/ Instance Administration
/ Dynamic Configuration Parameters

QueryMaxLength

OptionQueryMaxLength
Description Maximum query length in characters.
Introduced Version1.210.0
Default66,000 characters

Support
  • Twitter
  • LinkedIn
  • Youtube

© 2025 CrowdStrike All other marks contained herein are the property of their respective owners.

Version Support

Available version: 1.210.0

Enter search term