Dynamic Configuration Parameters

Dynamic Configuration parameters allow for setting configuration values for the cluster while it is running.

Table: Dynamic Configuration Parameters Table

VariableDefault ValueAvailabilityDescription
BucketStorageKeySchemeVersion2 MB  Sets a new format for the keys (file names) placed in the bucket.
BucketStorageUploadInfrequentThresholdDays   Minimum data retention days remained to switch from default "S3 Standard" to "S3 Intelligent-Tiering".
BucketStorageWriteVersion3  Allows files larger than 2GB in bucket storage for less memory pressure.
defaultDigestReplicationFactor2  Configures the replication factor used for the digest partitions table.
defaultSegmentReplicationFactor2  Specifies the number of replicas each segment file will have.
DelayIngestResponseDueToIngestLagScale300,000 milliseconds  Sets the number of milliseconds of lag that adds 1 to the factor applied.
DelayIngestResponseDueToIngestLagMaxFactor2  Sets the delay of the ingest response when the digest node experiences digest lag.
DelayIngestResponseDueToIngestLagThreshold20,000 milliseconds  Sets the number of milliseconds of digest lag where the feature starts to kick in.
FdrEnablefalse  Turns FDR polling on/off on the entire cluster with a single update.
FdrExcludedNodesempty  Excludes specific nodes from polling from FDR.
FdrMaxNodes5 nodes  Maximum number of nodes that simultaneously poll data from the same FDR feed.
FlushSegmentsAndGlobalOnShutdownfalse  Allows the shutdown of all in-progress segments and forces a write (and upload) of global snapshot.
GraphQLSelectionSizeLimit1,000 queries  Number of GraphQL queries on the total number of selected fields and fragments.
GraphQlDirectivesAmountLimit25 directivesintroduced in 1.145.0 The amount of GraphQL directives allowed in a query.
GroupDefaultLimit20,000 group elements  Default limit of group elements allowed in functions like groupBy() or selfJoin().
GroupMaxLimit1,000,000 group elements  Maximum limit of group elements allowed in groupBy().
IngestFeedAwsDownloadMaxObjectSize2,147,483,648 bytes  Max size of objects downloaded from S3.
IngestFeedAwsProcessingDownloadBufferSize8,388,608 bytes  Size of the buffer when downloading.
IngestFeedAwsProcessingEventBufferSize1 MB  Size of the buffer after preprocessing and splitting into individual events.
IngestFeedAwsProcessingEventsPerBatch1,000 events  Number of events ingested per batch.
IngestFeedGovernorRateOverride100,000  Change in rate when under/over the setpoint. Increasing this will make the governor more aggressive in changing the ingest rate.
IngestFeedGovernorIngestDelayHigh10 seconds 

Default ingest delay high setpoint for the ingest feed governor.

IngestFeedGovernorIngestDelayLow5 seconds 

Default ingest delay low setpoint for the ingest feed governor.

JoinRowLimit200,000 rows 

Max number of rows that join() and selfJoin() can return.

LiveQueryMemoryLimit100,000,000 bytesdeprecated in 1.116.0 Amount of memory that a live query can consume during its execution.
LookupTableSyncAwaitSeconds30 seconds  Waiting time before the lookup operation fails.
MatchFilesMaxHeapFraction0.5  Total fraction of the heap allowed for lookup tables. Defaults to half of the total configured heap.
MaxCsvFileUploadSizeBytes209,715,200 bytes 

Maximum size of uploaded CSV files.

MaxIngestRequestSize33,554,432 bytes  Size limit of ingest requests after content-encoding has been applied.
MaxJsonFileUploadSizeBytes104,857,600 bytes 

Maximum size of uploaded JSON files.

If MAX_FILEUPLOAD_SIZE is set, its value will be the default.

MaxOpenSegmentsOnWorker50,000 segment files  Maximum open segment files for the scheduler. Do not modify this setting unless advised to do so by CrowdStrike Support.
QueryBacktrackingLimit2,000 backtracks  Number of allowed query backtracks to limit a query iterating over individual events too many times.
QueryCoordinatorMaxHeapFraction0.5  Configures query queueing based on the available memory in the query coordinator.
QueryCoordinatorMemoryLimit4,000,000,000 bytes  Memory that the query coordinator can consume during execution per query, to ensure that the coordinating nodes of a cluster do not run out of memory.
QueryMemoryLimit100,000,000 bytesdeprecated in 1.116.0 How much memory a non-live query can consume during its execution.
QueryPartitionAutoBalancetrue  Turns on/off automatic balancing of query partitions across nodes.
QueryResultRowCountLimit100,000 rows  How many events a query can return.
RdnsDefaultLimit5,000 events  Default number of resulting events allowed in rdns().
RdnsMaxLimit20,000 events  Maximum allowed number of resulting events in rdns().
ReplaceANSIEscapeCodestrue  Specifies whether LogScale replaces ANSI escape codes in the result set.
StateRowLimit20,000 rows 

Maximum number of rows allowed in functions.

StaticQueryFractionOfCores2  Limit in the queries that one organization or user can run on a certain percentage of mapper threads.
TableCacheMaxStorageFraction0.001introduced in 1.148.0 Fraction of disk space allowed for caching file data used for query functions such as match() and readFile().
TableCacheMaxStorageFractionForIngestAndHttpOnly0.1introduced in 1.148.0 Fraction of disk space allowed on ingest or httponly node for caching file data used for query functions such as match() and readFile().
TargetMaxRateForDatasource2 MB  Target maximum rate of ingest for each shard of a datasource.
UnauthenticatedGraphQLSelectionSizeLimit150 queries  Number of GraphQL queries on the total number of selected fields and fragments for unauthenticated users.
UndersizedMergingRetentionPercentage20 %  Time span percentage that can be merged together when selecting undersized segments to merge.