Skip to content
LogoLogScale DocumentationLibraryGuidance Release Notes Integrations Query Examples Training APIGraphQLSearch Archives Contact Support
🔖 🔔 ੆Help button for documentation
    • Getting Data Out
    • Manage Repositories and Views
      • Create Repository or View
      • Persisted Aggregation Repositories
      • Repository and View Settings
      • Delete a Repository or View
      • Falcon LTR Repositories
      • Lookup Files
        • Supported File Types and Formats
        • Create a Lookup File
        • Manage Lookup Files
        • Lookup Files Operations with match()
    • Search Data
      • Query Editor
      • Event Fields
      • Display Fields
      • Manage Fields
      • Display Results and Events
      • Inspect Events
      • Copy Rows
      • Look Up Events
      • Show in Context
      • Format Columns
      • Column Properties
      • Field Data Types
      • Field Interactions
      • Choose Visualization
      • Highlight Filter Match
      • Change Time Interval
      • Set Time Zone
      • Save Results
      • Export Data
      • Search Status
      • Event List Interactions
      • Field Aliasing
        • Configuring Field Aliasing
        • Managing Field Aliasing
        • Searching with Field Aliasing
        • Understanding Field Mapping Requirements
        • Understanding Schema Requirements
    • Write Queries
      • Basic Query Principles
      • Returned Events
      • Query Management
        • Write a New Query
        • Save Searches
          • Create a Saved Search
          • Manage Saved Searches
          • Grant Permissions for Saved Queries
        • Persisted Aggregations
        • Use Saved Queries in Interactions
      • Common Queries
      • Statement Order for Better Queries
      • Query Readability and Better Usage
    • Data Visualization
      • Dashboards
        • Step-by-Step Guide to Dashboards
        • Create Dashboards
        • Optimize Dashboard Performance with Persisted Aggregations
        • Manage Dashboards
        • Customize Dashboards
        • Design the Dashboard Layout
          • Dashboard Sections
        • Work with Time on Dashboards
          • Shared Time Selector
          • Widget Time Selector
          • Section Time Selector
          • Live Dashboards
          • Time Zone Settings
          • Default Time Settings for Dashboards
        • Make your Dashboard Interactive
          • Apply Dashboard Filters
          • Work with Dashboard Parameters
          • Work with Dashboard Interactions
        • Share Dashboards
          • Disabling Access to Shared Dashboards
          • Restricting Access with IP Filters
        • Export Dashboards as PDF
          • PDF Export Options
      • Widgets
        • Create Widgets
        • Manage Widgets
          • Hint: Deselect Series in Widgets
          • Limitation: Widgets with Live join() Functions
          • Hint: Embedding iFrame Widgets
        • Widget Gallery
        • Bar Chart Widget
          • Bar Chart Usage and Data Format
          • Bar Chart Examples Gallery
            • Event Detection Across Severity Levels
            • Failed and Successful Authentication Attempts
            • Threat Type Distribution
            • Alert Type Proportion in Detection Sources
            • Detection Counts with Severity Average
          • Bar Chart Property Reference
        • Event List Widget
          • Event List Usage and Data Format
          • Event List Property Reference
        • Gauge Widget
          • Gauge Usage and Data Format
          • Gauge Examples Gallery
            • Display Number of Errors
            • Display Query Memory
            • Display Small Multiple Charts
          • Gauge Property Reference
        • Heat Map Widget
          • Heat Map Usage and Data Format
          • Heat Map Examples Gallery
            • Github Push Events
            • Response Time
          • Heat Map Property Reference
        • Note Widget
            • Note Widget Property Reference
        • Parameter Panel Widget
        • Pie Chart Widget
          • Pie Chart Usage and Data Format
          • Pie Chart Examples Gallery
            • Distribution of Security Alert Severities
            • Authentication Methods Distribution
            • Malware Types by Infection Count (In Small Multiples)
            • Network Traffic by Protocol
          • Pie Chart Property Reference
        • Sankey Diagram Widget
          • Sankey Usage and Data Format
          • Sankey Examples Gallery
            • Network Traffic
            • Thread Usage
          • Sankey Property Reference
        • Scatter Chart Widget
          • Usage and Data Format
          • Scatter Chart Examples Gallery
            • CPU vs Memory Usage
            • Job CPU Time vs Elapsed Time
          • Scatter Chart Property Reference
        • Single Value Widget
          • Single Value Usage and Data Format
          • Single Value Examples Gallery
            • Active Error Count
            • Build Test Failure Count
            • Non-Numeric Status Indicator
            • Ingestion Rate Trend
            • Values in a Grid
          • Single Value Property Reference
        • Table Widget
          • Table Usage and Data Format
          • Table Widget Interactions
          • Table Widget Examples Gallery
            • HTTP Error Summary by Method and Status
            • Top Endpoints by Error Count
          • Table Property Reference
        • Time Chart Widget
          • Time Chart Usage and Data Format
          • Time Chart Examples Gallery
            • Charting Metric Data
            • Charting Log Levels
            • Charting Commits in GitHub
          • Time Chart Property Reference
        • World Map Widget
          • World Map Usage and Data Format
          • World Map Examples Gallery
            • IP-Based Geographic Distribution
            • Service Performance Monitoring
            • Geohash Performance Clustering
          • World Map Property Reference
    • Automation
      • Triggers
        • What Trigger Type to Choose
        • General Information About Triggers
        • Trigger Management
          • Create Triggers
          • Edit Triggers
          • Manage Triggers
        • Trigger Properties
          • General Properties
          • Configuration Properties
          • Actions Properties
          • Advanced Settings
          • Scheduled Search Properties
        • Monitor, Diagnose, and Troubleshoot Triggers
          • Monitor Triggers with humio-activity Repository
          • Aggregate Alert Errors and Solutions
          • Scheduled Search Errors and Solutions
          • Filter Alert Errors and Solutions
          • Legacy Alert Errors and Solutions
          • Errors when Using Live join() Functions
      • Actions
        • Create Actions
        • Manage Actions
        • Action Type: Email
        • Action Type: Falcon LogScale Repository
        • Action Type: OpsGenie
        • Action Type: PagerDuty
        • Action Type: S3
        • Action Type: Slack
        • Action Type: Lookup File
        • Action Type: VictorOps (Splunk On-Call)
        • Action Type: Webhooks
        • Send aggregate results to actions
        • Message Templates and Variables
      • Schedule PDF Reports
        • Scheduled Reports Security
          • Create a Scheduled PDF Role using the web interface
        • Managing Scheduled Reports
        • Create Scheduled Reports
        • Edit Scheduled Reports
        • Scheduled Report Operation and Limitations
        • Scheduled Report Errors and Resolutions
      • Persisted Aggregations
        • Persisted Aggregation Management
          • Create Persisted Aggregations
          • Configure Persisted Aggregation Properties
            • Scheduling Details
          • Edit Persisted Aggregations
          • Manage Persisted Aggregations
      • Cron Scheduling
    • Template Language
      • Template Expressions
      • Template Variable Types
      • Template Examples
Falcon LogScale Documentation
/ Getting Data Out (GDO)
/ Write Queries

Query Management

In LogScale, use the Search page to perform these activities:

  • Write a New Query

  • Save Searches

  • Grant Permissions for Saved Queries

  • Use Saved Queries in Interactions

Support
  • Twitter
  • LinkedIn
  • Youtube

© 2026 CrowdStrike All other marks contained herein are the property of their respective owners.

Children of this Page

Write a New Query
Save Searches
Create a New Saved Search
Manage Existing Saved Searches
Grant Permissions for Saved Queries
Persisted Aggregations
Use Saved Queries in Interactions

  • Other articles on this topic

    • Frequent query operations
    • Grammar Subset
    • Join Methods
    • Queries and Querying
    • Query Basics
    • Query Functions
    • Query Functions
    • Query Joins and Lookups
    • Query Management
    • Query management
    • Save Results
    • Write Queries

  • Similar Content

    • Frequent query operations
    • Save Results
    • Write Queries

  • Related Language Syntax

    • Adding Fields to Events
    • Adding Fields to Events
    • Conditional Evaluation
    • Conditional Evaluation
    • Function Syntax
    • Function Syntax
    • Operators
    • Operators
    • Query Filters
    • Query Filters
    • Query Language Syntax
    • Query Language Syntax
    • Time Syntax
    • Time Syntax
    • User Parameters (Variables)
    • User Parameters (Variables)

Enter search term