Dynamic Configuration Parameters
Dynamic Configuration parameters allow for setting configuration values for the cluster while it is running.
To get the current configuration value for a dynamic variable, see Getting Dynamic Configuration List
To set the current configuration value for a dynamic variable, see Setting a Dynamic Configuration Value
Table: Dynamic Configuration Parameters Table
| Variable | Default Value | Availability | Description |
|---|---|---|---|
BucketStorageKeySchemeVersion | 2 MB | Sets a new format for the keys (file names) placed in the bucket. | |
BucketStorageUploadInfrequentThresholdDays | Minimum data retention days remained to switch from default "S3 Standard" to "S3 Intelligent-Tiering". | ||
BucketStorageWriteVersion | 3 | Allows files larger than 2GB in bucket storage for less memory pressure. | |
defaultDigestReplicationFactor | 2 | Configures the replication factor used for the digest partitions table. | |
defaultSegmentReplicationFactor | 2 | Specifies the number of replicas each segment file will have. | |
DelayIngestResponseDueToIngestLagScale | 300,000 milliseconds |
Sets the number of milliseconds of lag that adds
1 to the factor applied.
| |
DelayIngestResponseDueToIngestLagMaxFactor | 2 | Sets the delay of the ingest response when the digest node experiences digest lag. | |
DelayIngestResponseDueToIngestLagThreshold | 20,000 milliseconds | Sets the number of milliseconds of digest lag where the feature starts to kick in. | |
FdrEnable | false | Turns FDR polling on/off on the entire cluster with a single update. | |
FdrExcludedNodes | empty | Excludes specific nodes from polling from FDR. | |
FdrMaxNodes | 5 nodes | Maximum number of nodes that simultaneously poll data from the same FDR feed. | |
FlushSegmentsAndGlobalOnShutdown | false | Allows the shutdown of all in-progress segments and forces a write (and upload) of global snapshot. | |
GraphQLSelectionSizeLimit | 1,000 queries | Number of GraphQL queries on the total number of selected fields and fragments. | |
GroupDefaultLimit | 20,000 group elements |
Default limit of group elements allowed in functions like
groupBy() or selfJoin().
| |
GroupMaxLimit | 1,000,000 group elements |
Maximum limit of group elements allowed in
groupBy().
| |
IngestFeedAwsDownloadMaxObjectSize | 2,147,483,648 bytes | Max size of objects downloaded from S3. | |
IngestFeedAwsProcessingDownloadBufferSize | 8,388,608 bytes | Size of the buffer when downloading. | |
IngestFeedAwsProcessingEventBufferSize | 1 MB | Size of the buffer after preprocessing and splitting into individual events. | |
IngestFeedAwsProcessingEventsPerBatch | 1,000 events | Number of events ingested per batch. | |
IngestFeedGovernorRateOverride | 100,000 | Change in rate when under/over the setpoint. Increasing this will make the governor more aggressive in changing the ingest rate. | |
IngestFeedGovernorIngestDelayHigh | 10 seconds |
Default ingest delay high setpoint for the ingest feed governor. | |
IngestFeedGovernorIngestDelayLow | 5 seconds |
Default ingest delay low setpoint for the ingest feed governor. | |
JoinRowLimit | 200,000 rows |
Max number of rows that | |
LiveQueryMemoryLimit | 100,000,000 bytes | deprecated in 1.116.0 | Amount of memory that a live query can consume during its execution. |
LookupTableSyncAwaitSeconds | 30 seconds | Waiting time before the lookup operation fails. | |
MatchFilesMaxHeapFraction | 0.5 | Total fraction of the heap allowed for lookup tables. Defaults to half of the total configured heap. | |
MaxCsvFileUploadSizeBytes | 209,715,200 bytes |
Maximum size of uploaded CSV files. | |
MaxIngestRequestSize | 33,554,432 bytes | Size limit of ingest requests after content-encoding has been applied. | |
MaxJsonFileUploadSizeBytes | 104,857,600 bytes |
Maximum size of uploaded JSON files.
If | |
MaxOpenSegmentsOnWorker | 50,000 segment files | Maximum open segment files for the scheduler. Do not modify this setting unless advised to do so by CrowdStrike Support. | |
QueryBacktrackingLimit | 2,000 backtracks | introduced in 1.139.0 | Number of allowed query backtracks to limit a query iterating over individual events too many times. |
QueryCoordinatorMaxHeapFraction | 0.5 | Configures query queueing based on the available memory in the query coordinator. | |
QueryCoordinatorMemoryLimit | 4,000,000,000 bytes | Memory that the query coordinator can consume during execution per query, to ensure that the coordinating nodes of a cluster do not run out of memory. | |
QueryMemoryLimit | 100,000,000 bytes | deprecated in 1.116.0 | How much memory a non-live query can consume during its execution. |
QueryPartitionAutoBalance | true | Turns on/off automatic balancing of query partitions across nodes. | |
QueryResultRowCountLimit | 100,000 rows | How many events a query can return. | |
RdnsDefaultLimit | 5,000 events | introduced in 1.137.0 |
Default number of resulting events allowed in
rdns().
|
RdnsMaxLimit | 20,000 events | introduced in 1.137.0 |
Maximum allowed number of resulting events in
rdns().
|
ReplaceANSIEscapeCodes | true | Specifies whether LogScale replaces ANSI escape codes in the result set. | |
StateRowLimit | 20,000 rows |
Maximum number of rows allowed in functions. | |
StaticQueryFractionOfCores | 2 | Limit in the queries that one organization or user can run on a certain percentage of mapper threads. | |
TargetMaxRateForDatasource | 2 MB | Target maximum rate of ingest for each shard of a datasource. | |
UnauthenticatedGraphQLSelectionSizeLimit | 150 queries | Number of GraphQL queries on the total number of selected fields and fragments for unauthenticated users. | |
UndersizedMergingRetentionPercentage | 20 % | Time span percentage that can be merged together when selecting undersized segments to merge. |