Skip to content
LogoLogScale DocumentationFull Library Knowledge Base Release Notes Integrations Query Examples Training API GraphQL APISearch Archives Contacting Support
Help button for documentation
    • Terminology Reference
      • Actions
      • Aggregate Alert
      • Aggregation
      • Alert
      • Anomaly Detection
      • API (Application Programming Interface)
      • Archival
      • Asset
      • Asset Permissions
      • Authentication
      • Authorization
      • Automated Actions
      • Backfilling
      • Backup
      • Baseline
      • Bloom Filter
      • Bucket
      • Built-in Parsers
      • Cardinality
      • Cluster
      • Cluster Management
      • Cold Storage
      • Compression
      • Configuration
      • Correlation
      • CrowdStrike Query Language (CQL)
      • Cron
      • CrowdStrike Parsing Standard (CPS)
      • Custom Resource Definitions (CRD)
      • Dashboard
      • Data Export
      • Data Ingestion
      • Data Retention
      • Data Visualization
      • Datasource
      • Deployment
      • Dynamic Configuration
      • Endpoint
      • Enrichment
      • Environment Variables
      • Event
      • Event Fields
      • Event List
      • Extraction
      • Field
      • Field Aliasing
      • Field Data Types
      • Field Mapping
      • Field Panel
      • Filter
      • Filter Alert
      • Format Panel
      • Function
      • GraphQL
      • groupBy()
      • Groups
      • Histogram
      • Hot Storage
      • Humio Operator
      • HumioCluster
      • Identity Provider (IdP)
      • Indexing
      • Ingest Token
      • Ingestion
      • @ingesttimestamp
      • Inspection Panel
      • Installation
      • Integration
      • Join
      • Kubernetes
      • LDAP (Lightweight Directory Access Protocol)
      • License Management
      • Live Query
      • Load Balancing
      • Log Shipper
      • LogScale Query Language (CQL)
      • Lookup Table
      • Multi-Cluster-Search
      • Multi-Cluster View
      • Memory Limits
      • Metadata
      • Metadata Fields
      • Monitoring
      • Node
      • Notification
      • OAuth
      • OpenID Connect (OIDC)
      • Operator
      • Organization
      • Organization Owner
      • Parser
      • Permissions
      • Pipeline
      • Proxy Authentication
      • Query
      • Query Coordinator
      • Query Editor
      • Query Profiling
      • RBAC (Role-Based Access Control)
      • Real-time
      • Regex (Regular Expression)
      • Repository
      • Repository Permissions
      • REST API
      • Result
      • Reverse Proxy
      • Roles
      • Security Assertion Markup Language (SAML)
      • Saved Search
      • Scheduled Search
      • Search
      • Search Interface
      • Security
      • Segment
      • SIEM (Security Information and Event Management)
      • Tag
      • Tag Fields
      • Tagging
      • Template Language
      • Threshold
      • Throttling Period
      • TimeChart
      • @timestamp
      • Timestamp Parsing
      • Token
      • Transformation
      • Triggers
      • User Account
      • User Interface (UI)
      • User Management
      • User Roles
      • View
      • View-based Access Control
      • Visualization
      • Webhook
      • Widget
      • Worker Node
Falcon LogScale Documentation
/ LogScale Terminology

LogScale Query Language (CQL)

The proprietary query syntax for searching and analyzing data in LogScale.

Related Content

  • CrowdStrike Query Language Syntax

Related Terms

  • CrowdStrike Query Language (CQL)

  • Search Interface

  • Search Templates

Support
  • Twitter
  • LinkedIn
  • Youtube

© 2025 CrowdStrike All other marks contained herein are the property of their respective owners.

Enter search term