Falcon LogScale Documentation

Removed the API for managing ingest tokens. This has long been deprecated and replaced by a GraphQL API.

Event List Interactions are now sorted by name and repository name by default.

The Single Value widget now supports interactions on both the Search and Dashboard page. See Managing Dashboard Interactions for more details on interactions.

It is now possible to set a temporary timezone in dashboards, which will be read from the URL on page load.

For more information, see Time Interval Settings.

LogScale Collector Fleet Management now supports remote configuration of LogScale Collectors. This gives an administrator the option of managing the configuration of LogScale Collector instances in LogScale, instead of managing configuration files directly on the device where Falcon Logscale Collector is installed.

For more information, see LogScale Collector Fleet Management, LogScale Collector Releases.

Queries containing a join() function no longer run truly live when the query is set to Live. Instead, these queries will run repeatedly at intervals determined by the query engine.

For more information, see Warnings when Using Live join() Functions, Creating Widgets with Live join() Functions, join(), Special Behaviour for Live Joins.

Fixed an issue for the ingest API that made it possible to ingest into system repositories.