Dynamic Configuration Parameters

Dynamic Configuration parameters allow for setting configuration values for the cluster while it is running.

Table: Dynamic Configuration Parameters Table

VariableDefault ValueAvailabilityDescription
AdHocTablesLimit10  Maximum number of ad hoc tables that can be created. Limits the total number of ad hoc query result tables that can exist in the system at one time.
AggregatorOutputRowLimit100 million rows  Number of rows allowed in queries with aggregate functions.
ArchivingClusterWideDisabledtrue  Boolean flag that controls whether archiving is disabled across the entire cluster. When set to true, all archiving operations will be disabled for all repositories in the cluster regardless of individual settings.
ArchivingClusterWideEndAt7  Timestamp that defines when cluster-wide archiving should end. This setting applies to all repositories that match the archiving cluster-wide regex pattern. The format is ISO 8601 (e.g., "2023-12-31T23:59:59Z"). When empty, archiving will continue indefinitely (or until disabled).
ArchivingClusterWideRegexForRepoName.*  Regular expression pattern to match repository names for cluster-wide archiving operations. Only repositories with names matching this pattern will be subject to cluster-wide archiving settings. Use ".*" to match all repositories or provide a specific pattern to target a subset of repositories.
ArchivingClusterWideStartFrom1  Timestamp that defines when cluster-wide archiving should begin. This setting applies to all repositories that match the archiving cluster-wide regex pattern. The format is ISO 8601 (e.g., "2023-01-01T00:00:00Z"). When empty, archiving will start from the beginning of available data.
BlockSignuptrue  Boolean flag that controls whether new user signups are blocked. When set to true, new user registration will be disabled, preventing the creation of new accounts. Useful for maintenance periods or when you want to control access to the system.
BucketStorageKeySchemeVersion2 MB  Sets a new format for the keys (file names) placed in the bucket.
BucketStorageUploadInfrequentThresholdDays   Minimum data retention days remained to switch from default "S3 Standard" to "S3 Intelligent-Tiering".
BucketStorageWriteVersion3  Allows files larger than 2GB in bucket storage for less memory pressure.
CancelQueriesExceedingAggregateOutputRowLimitdisabled  Cancels aggregate functions in queries that exceed the limit set by the AggregatorOutputRowLimit configuration.
CorrelateConstellationTickLimit5  Maximum number of processing ticks allowed in correlation constellation operations. This setting helps prevent excessive resource consumption in complex correlation operations. Higher values allow more complex correlations but consume more computational resources.
CorrelateConstraintLimit5  Maximum number of constraints allowed in correlation operations. This setting limits the complexity of correlation queries to prevent excessive resource consumption. Higher values allow more complex constraints but may increase memory usage and processing time.
CorrelateLinkValuesLimit100  Maximum number of link values allowed in correlation operations. This setting limits the total number of values that can be linked across events during correlation. Higher values allow for more comprehensive correlation results but require more memory.
CorrelateLinkValuesMaxByteSize1,024  Maximum total byte size allowed for link values in correlation operations. This setting limits the memory footprint of linked values during correlation processing. Specified in bytes, this limit prevents excessive memory consumption when correlating events with large field values.
CorrelateMinIterations2  Minimum number of iterations that the correlation algorithm will perform. This setting ensures correlation operations run for at least the specified number of iterations, allowing time for patterns to emerge even if early convergence criteria are met.
CorrelateNumberOfTimeBuckets100,000  Number of time buckets to use when performing correlation analysis. This setting controls how the time range is divided into discrete intervals for temporal correlation. Higher values provide finer time granularity but require more computational resources.
CorrelateQueryEventLimit100,000  Maximum number of events allowed in correlation query operations.
CorrelateQueryLimit5  Maximum number of queries allowed in correlation operations.
DebugAuditRequestTracetrue  Controls whether to enable debug tracing for audit requests.
defaultDigestReplicationFactor2  Configures the replication factor used for the digest partitions table.
defaultSegmentReplicationFactor2  Specifies the number of replicas each segment file will have.
DelayIngestResponseDueToIngestLagScale300,000 milliseconds  Sets the number of milliseconds of lag that adds 1 to the factor applied.
DelayIngestResponseDueToIngestLagMaxFactor2  Sets the delay of the ingest response when the digest node experiences digest lag.
DelayIngestResponseDueToIngestLagThreshold20,000 milliseconds  Sets the number of milliseconds of digest lag where the feature starts to kick in.
DeleteDuplicatedNameViewsAfterMergingfalse  Controls whether to delete views with duplicate names after merging.
DisableAnalyticsJobtrue  Controls whether analytics jobs are disabled.
DisableUserTrackingtrue  Controls whether user tracking is disabled.
DisableViewWithSameNameCleanuptrue  Disable views with the same name during clean-up.
DisableNewRegexEnginedisabled  Disables the LogScale Regular Expression Engine V2 globally on the cluster, preventing the submission of new queries.
EnableDemoDatatrue  Controls whether demo data is enabled.
EnableGlobalJsonStatsLoggerfalse  Controls whether the global JSON statistics logger is enabled.
ExperimentalSortDataStructurefalse  Controls whether to use experimental sort data structure.
ExternalFunctionRequestResponseEventCountLimit10,000  Maximum number of events allowed in an external function response.
ExternalFunctionRequestResponseSizeLimitBytes10,485,760  Maximum size in bytes allowed for an external function response.
FdrMaxNodesPerFeed5  Maximum number of nodes allowed per feed for FDR.
FdrS3FileSizeMax250,000,000  Maximum file size in bytes for S3 files in FDR.
FdrEnablefalse  Turns FDR polling on/off on the entire cluster with a single update.
FdrExcludedNodesempty  Excludes specific nodes from polling from FDR.
FdrMaxNodes5 nodes  Maximum number of nodes that simultaneously poll data from the same FDR feed.
FileReplicationFactor5  Replication factor for files in the cluster.
FlushSegmentsAndGlobalOnShutdownfalse  Allows the shutdown of all in-progress segments and forces a write (and upload) of global snapshot.
GracePeriodBeforeDeletingDeadEphemeralHostsMs100  Grace period in milliseconds before dead ephemeral hosts are deleted.
GracefulShutdownConsideredAliveSeconds300  Number of seconds a server is considered alive during graceful shutdown.
GraphQLSelectionSizeLimit1,000 queries  Number of GraphQL queries on the total number of selected fields and fragments.
GraphQLAliasCountLimit100  Maximum number of aliases allowed in a GraphQL query.
GraphQLDirectiveCountLimit100  Maximum number of directives allowed in a GraphQL query.
GraphQLQueryAnalysisDisabledtrue  Controls whether GraphQL query analysis is disabled.
GraphQlDirectivesAmountLimit25 directives  The amount of GraphQL directives allowed in a query.
GroupDefaultLimit20,000 group elements  Default limit of group elements allowed in functions like groupBy() or selfJoin().
GroupMaxLimit1,000,000 group elements  Maximum limit of group elements allowed in groupBy().
IngestFeedGovernorCycleDuration1,000  Duration in milliseconds for each ingest feed governor cycle.
IngestFeedMaxConcurrentPolls1,000  Maximum number of concurrent polls allowed for ingest feeds.
IngestFeedAwsDownloadMaxObjectSize2,147,483,648 bytes  Max size of objects downloaded from S3.
IngestFeedAwsProcessingDownloadBufferSize8,388,608 bytes  Size of the buffer when downloading.
IngestFeedAwsProcessingEventBufferSize1 MB  Size of the buffer after preprocessing and splitting into individual events.
IngestFeedAwsProcessingEventsPerBatch1,000 events  Number of events ingested per batch.
IngestFeedGovernorRateOverride100,000  Change in rate when under/over the setpoint. Increasing this will make the governor more aggressive in changing the ingest rate.
IngestFeedGovernorIngestDelayHigh10 seconds 

Default ingest delay high setpoint for the ingest feed governor.

IngestFeedGovernorIngestDelayLow5 seconds 

Default ingest delay low setpoint for the ingest feed governor.

IsAutomaticUpdateCheckingAllowedfalse  Controls whether automatic update checking is allowed.
JoinDefaultLimit100,000  Default limit for join operations in queries.
JoinRowLimit200,000 rows 

Max number of rows that join() and selfJoin() can return.

LiveAdhocTableUpdatePeriodMinimumMs10,000 ms  Defines the minimum period of time between two table updates. See Ad-hoc Tables Update Frequency and Cluster Performance.
LiveQueryMemoryLimit100,000,000 bytesdeprecated in 1.116 Amount of memory that a live query can consume during its execution.
LookupTableSyncAwaitSeconds60 seconds  Waiting time before the lookup operation fails.
MatchFilesMaxHeapFraction0.5  Total fraction of the heap allowed for lookup tables. Defaults to half of the total configured heap.
MaxAccessTokenTTL2,592,000  Maximum time-to-live in seconds for access tokens.
MaxConcurrentQueriesOnWorker1,000  Maximum number of historic queries that can be executed on a single worker node. This limit does not apply to live parts of queries.
MaxQueryPenaltyCreditForBlockedQueriesFactor5.0  Maximum factor for penalty credit given for blocked queries.
MaxQueryPollsForWorker100  Maximum number of worker polls (across all workers) scheduled per second.
MaxRelocatedDatasourcesInGlobal100  Maximum number of datasources that can be relocated to global.
MaxCsvFileUploadSizeBytes209,715,200 bytes 

Maximum size of uploaded CSV files.

MaxIngestRequestSize33,554,432 bytes  Size limit of ingest requests after content-encoding has been applied.
MaxJsonFileUploadSizeBytes104,857,600 bytes 

Maximum size of uploaded JSON files.

If MAX_FILEUPLOAD_SIZE is set, its value will be the default.

MaxOpenSegmentsOnWorker50,000 segment files  Maximum open segment files for the scheduler. Do not modify this setting unless advised to do so by CrowdStrike Support.
MinQueryPermitsFactor1.0  Minimum factor for query permits allocation.
MinimumHumioVersion1.0.0  Minimum version of Humio (LogScale) required for the cluster.
MultiPassDefaultIterationLimit10  Default limit for the number of iterations in multi-pass operations.
MultiPassMaxIterationLimit50  Maximum limit for the number of iterations in multi-pass operations.
ParserThrottlingAllocationFactor1.0  Factor used to determine the allocation of resources for parser throttling. Controls the fraction of resources dedicated to parsing operations to prevent overload.
ParserBacktrackingLimit2,000 backtracks  Number of backtracks for how many new events can be created from a single input event in parsers.
QueryFSMSyncMergeThreshold1,000  Threshold value for synchronous merging in the Query Finite State Machine (FSM). Controls when query results should be merged synchronously rather than asynchronously.
QueryBacktrackingLimit2,000 backtracks  Number of allowed query backtracks to limit a query iterating over individual events too many times.
QueryCoordinatorMaxHeapFraction0.5  Configures query queueing based on the available memory in the query coordinator.
QueryCoordinatorMemoryLimit4,000,000,000 bytes  Memory that the query coordinator can consume during execution per query, to ensure that the coordinating nodes of a cluster do not run out of memory.
QueryMemoryLimit100,000,000 bytesdeprecated in 1.116 How much memory a non-live query can consume during its execution.
QueryPartitionAutoBalancetrue  Turns on/off automatic balancing of query partitions across nodes.
QueryResultRowCountLimit500,000 rows  How many events a query can return.
RdnsDefaultLimit5,000 events  Default number of resulting events allowed in rdns().
RdnsMaxLimit20,000 events  Maximum allowed number of resulting events in rdns().
RejectIngestOnParserExceedingFraction0.85  Fraction threshold that determines when to reject ingest operations if a parser is exceeding its allocated resources. When parser resource usage exceeds this fraction of its allocation, new ingest operations will be rejected.
ReplaceANSIEscapeCodestrue  Specifies whether LogScale replaces ANSI escape codes in the result set.
S3ArchivingClusterWideDisabledfalse  Boolean flag that controls whether S3 archiving is disabled across the entire cluster. When set to true, S3 archiving will be disabled for all repositories in the cluster regardless of individual settings.
S3ArchivingClusterWideEndAt2099-12-31T23:59:59.999Z  End date and time for cluster-wide S3 archiving period. Specifies when to stop S3 archiving across the cluster. Value should be in ISO-8601 format (yyyy-MM-dd'T'HH:mm:ss.SSSZ).
S3ArchivingClusterWideRegexForRepoName.*  Regular expression pattern used to match repository names for cluster-wide S3 archiving. Only repositories with names matching this pattern will be included in cluster-wide S3 archiving. Use ".*" to match all repositories.
S3ArchivingClusterWideStartFrom2020-01-01T00:00:00.000Z  Start date and time for cluster-wide S3 archiving period. Specifies when to begin S3 archiving across the cluster. Value should be in ISO-8601 format (yyyy-MM-dd'T'HH:mm:ss.SSSZ).
SampleIntervalForDatasourceRates60,000  Interval in milliseconds at which datasource rates are sampled. Controls how frequently the system measures and updates data ingest rates for each datasource.
SelfJoinLimit10  Maximum number of self-joins allowed in a query. Limits the complexity of queries to prevent excessive resource consumption from queries with too many self-joins. If 0 or less, then it is unlimited.
StateRowLimit500,000 rows 

Maximum number of rows allowed in functions.

StaticQueryFractionOfCores2  Limit in the queries that one organization or user can run on a certain percentage of mapper threads.
TableCacheMemoryAllowanceFraction0.2  Specifies the maximum fraction of available memory for the table cache. Controls how much of the system's memory can be used for caching query result tables. It is specified as a fraction of the total memory available for files.
TableCacheMaxStorageFraction0.001  Fraction of disk space allowed for caching file data used for query functions such as match() and readFile().
TableCacheMaxStorageFractionForIngestAndHttpOnly0.1  Fraction of disk space allowed on ingest or httponly node for caching file data used for query functions such as match() and readFile().
TargetMaxRateForDatasource2 MB  Target maximum rate of ingest for each shard of a datasource.
UnauthenticatedGraphQLSelectionSizeLimit150 queries  Number of GraphQL queries on the total number of selected fields and fragments for unauthenticated users.
UndersizedMergingRetentionPercentage20 %  Time span percentage that can be merged together when selecting undersized segments to merge.