Skip to content
LogoLogScale DocumentationFull Library Knowledge Base Release Notes Integrations Query Examples Training API GraphQL API Contacting Support
help

Versions of this Page

  • GraphQL Datatypes
    • Types
      • AccessTokenValidatorResultType
      • Account
      • ActionSecurityPolicies
      • ActionTemplate
      • ActiveSchemaOnView
      • AddGroupMutation
      • AddRecentQuery
      • AddRoleMutation
      • AddStarToFieldMutation
      • AddUsersToGroupMutation
      • AggregateAlert
      • AggregateAlertTemplate
      • Alert
      • AlertFieldValues
      • AlertTemplate
      • AliasInfo
      • AliasMapping
      • AnalyzeQueryInfo
      • ArrayGap
      • ArrayWithGap
      • AssertionOnFieldWasOrphaned
      • AssetPermissionSearchResultSet
      • AssignOrganizationManagementRoleToGroupMutation
      • AssignOrganizationRoleToGroupMutation
      • AssignRoleToGroupMutation
      • AssignSystemRoleToGroupMutation
      • Auth0Authentication
      • BlockedQuery
      • BlockIngestMutation
      • BooleanResultType
      • BucketStorageConfig
      • ByProxyAuthentication
      • CachePolicy
      • ChildOrganizationsResultSet
      • Client
      • Cluster
      • ClusterConnectionTag
      • ClusterManagementSettings
      • ClusterNode
      • ClusterStats
      • ConnectionAspectErrorType
      • CopyDashboardMutation
      • CreateActionFromPackageTemplateMutation
      • CreateDashboardFromPackageTemplateMutation
      • CreateDashboardMutation
      • CreateParserFromPackageTemplateMutation
      • CreateParserMutation
      • CreateRepositoryMutation
      • CreateSavedQueryFromPackageTemplateMutation
      • CreateSavedQueryPayload
      • CreateSystemPermissionsTokenV2Output
      • CrossOrgViewConnection
      • CrowdStrikeIOCStatus
      • CurrentStats
      • CustomLinkInteraction
      • Dashboard
      • DashboardEntry
      • DashboardFilter
      • DashboardLink
      • DashboardLinkInteraction
      • DashboardLinkInteractionDashboardReference
      • DashboardPage
      • DashboardTemplate
      • Datasource
      • DeleteDashboardMutation
      • DeleteEvents
      • DictionaryEntryType
      • DynamicConfigKeyValueType
      • EmailAction
      • EnrolledCollector
      • EnterpriseOnlyAuthentication
      • EnvironmentVariableUsage
      • EventForwarderForSelection
      • EventForwardingRule
      • EventField
      • EvictionStatus
      • ExternalFunctionSpecificationOutput
      • FdrFeed
      • FdrFeedControl
      • FeatureFlagV2
      • Field
      • FieldAliasSchema
      • FieldAliasSchemasInfo
      • FieldConfiguration
      • FieldHadConflictingAssertions
      • FieldHadUnexpectedValue
      • FieldHasValue
      • FieldUnexpectedlyPresent
      • File
      • FileDashboardParameter
      • FileEntry
      • FileNameAndPath
      • FileParameterValueFilter
      • FilterAlert
      • FilterAlertConfig
      • FilterAlertTemplate
      • FixedListDashboardParameter
      • FleetConfigurationTest
      • FleetInstallationToken
      • FixedListParameterOption
      • FlightRecorderSettings
      • FreetextDashboardParameter
      • Group
      • GroupFilterInfo
      • GroupOrganizationManagementRole
      • GroupOrganizationRole
      • GroupPage
      • GroupResultSetType
      • GroupSearchDomainRole
      • GroupSystemRole
      • HealthStatus
      • HTTPHeaderEntry
      • HumioMetadata
      • HumioQuery
      • HumioRepoAction
      • IdentityProviderAuth
      • Ignored
      • Ingest
      • IngestFeed
      • IngestFeedAwsAuthenticationIamRole
      • IngestFeedConfigurationStatus
      • IngestFeedExecutionInfo
      • IngestFeedQueryResultSet
      • IngestFeedPreprocessingSplitAwsRecords
      • IngestFeedPreprocessingSplitNewline
      • IngestFeedS3SqsSource
      • IngestFeedStatus
      • IngestFeedStatusCause
      • IngestListener
      • IngestPartition
      • IngestToken
      • InstallPackageFromRegistryResult
      • InstallPackageFromZipResult
      • InteractionId
      • IOCTableInfo
      • IpDatabaseInfo
      • IpDatabaseMetadata
      • IPFilter
      • KafkaClusterDescription
      • KafkaEventForwarder
      • KafkaLogDir
      • KafkaNode
      • KafkaNodeTopicPartitionLogDescription
      • KafkaTopicConfig
      • KafkaTopicConfigs
      • KafkaTopicDescription
      • KafkaTopicPartition
      • KafkaTopicPartitionDescription
      • KindOutput
      • LanguageVersion
      • LanguageVersionOutputType
      • Limit
      • Limited
      • LimitedScheduledReport
      • LimitV2
      • LinkWidget
      • LocalClusterConnection
      • LocalClusterConnectionStatus
      • LogCollector
      • LogCollectorConfigInfo
      • LogCollectorConfiguration
      • LogCollectorConfigurationProblemAtPath
      • LogCollectorDebugLoggingStatic
      • LogCollectorDetails
      • LogCollectorGroup
      • LogCollectorInstallCommand
      • LogCollectorInstaller
      • LogCollectorLabel
      • LogCollectorLogSource
      • LogCollectorMergedConfiguration
      • LoginBridge
      • LoginBridgeRequest
      • LookupFileTemplate
      • Marketplace
      • MarketPlaceCategory
      • MarketplaceCategoryGroup
      • ModifiedInfoToken
      • ModifiedInfoUser
      • MonthlyIngest
      • MonthlyStorage
      • NeverDashboardUpdateFrequency
      • NoAuthentication
      • NoteWidget
      • Notification
      • NotificationsResultSet
      • OAuthAuthentication
      • OAuthProvider
      • OIDCIdentityProvider
      • OIDCIdentityProviderAuth
      • OIDCProvider
      • OnlyTotal
      • OnPremLicense
      • OpsGenieAction
      • Organization
      • OrganizationConfigs
      • OrganizationDetails
      • OrganizationLimits
      • OrganizationLink
      • OrganizationOwnership
      • OrganizationPermissionsToken
      • OrganizationSearchResultEntry
      • OrganizationSearchResultSet
      • OrganizationSession
      • OrganizationStats
      • OrgConfig
      • OutputEvent
      • Package2
      • PackageAuthor
      • PackageInstallation
      • PackageRegistrySearchResultItem
      • PackageUpdateResult
      • PagerDutyAction
      • PageType
      • ParameterPanel
      • ParameterSpecificationOutput
      • ParameterValue
      • ParentOrganizationsResultSet
      • ParsedEvent
      • Parser
      • ParserTemplate
      • ParserTestCase
      • ParserTestCaseFailuresForOutput
      • ParserTestCaseOutputAssertions
      • ParserTestCaseOutputFailures
      • ParserTestCaseResult
      • ParserTestEvent
      • ParserTestRunAborted
      • ParserTestRunCompleted
      • PendingUser
      • PersonalUserToken
      • queryAnalysis
      • QueryAssistantDiagnostic
      • QueryAssistantDiagnosticMessage
      • QueryAssistantDiagnosticPosition
      • QueryAssistantError
      • QueryAssistantAssistance
      • QueryAssistantSuccess
      • QueryBasedDashboardParameter
      • QueryBasedWidget
      • QueryBasedWidgetInteraction
      • QueryConcatenationInfo
      • QueryDiagnostic
      • QueryDiagnosticInfoOutputType
      • QueryInProgress
      • QueryLanguageRestriction
      • QueryPrefixes
      • QueryQuotaDefaultSettings
      • QueryQuotaExceeded
      • QueryQuotaIntervalSetting
      • QueryQuotaUsage
      • QueryQuotaUserSettings
      • QueryValidationInfo
      • QueryValidationResult
      • RealTimeDashboardUpdateFrequency
      • ReasonsNodeCannotBeSafelyUnregistered
      • RecentQuery
      • RefreshClusterManagementStatsMutation
      • RegionSelectData
      • RegistryPackageVersionInfo
      • RemoteClusterConnection
      • RemoteClusterConnectionStatus
      • RemoveGroupMutation
      • RemoveParserMutation
      • RemoveStarToFieldMutation
      • RemoveUserByIMutation
      • RemoveUserMutation
      • RemoveUsersFromGroupMutation
      • RepositoriesUsageQueryResult
      • Repository
      • RepositoryUsageValue
      • Role
      • RolePage
      • RolesResultSetType
      • RunningQueries
      • RunningQuery
      • S3Configuration
      • SAMLAuthentication
      • SAMLIdentityProvider
      • SamlIdentityProviderAuth
      • SamlMetadata
      • SavedQuery
      • SavedQueryIsStarred
      • SavedQueryStarredUpdate
      • SavedQueryTemplate
      • ScannedData
      • Schedule
      • ScheduledReport
      • ScheduledReportLayout
      • ScheduledSearch
      • ScheduledSearchTemplate
      • SchemaField
      • SchemaViolation
      • SearchAssetPermissionsResultEntry
      • SearchDomainAssetsResultSet
      • SearchDomainPage
      • SearchDomainRole
      • SearchDomainSearchResultSet
      • SearchFleetAggregations
      • SearchFleetInProgress
      • SearchFleetInstallationTokenResultSet
      • SearchFleetResultSet
      • SearchLinkInteraction
      • SearchLogCollectorConfigurationResultSet
      • SearchLogCollectorGroupsResultSet
      • SearchResult
      • Section
      • Segment
      • ServiceMetadata
      • Session
      • SessionQueryResultSet
      • setAutomaticSearching
      • SharedDashboard
      • SharedDashboardsSecurityPolicies
      • SharedDashboardTimeInterval
      • SlackAction
      • SlackFieldEntry
      • SlackPostMessageAction
      • SocialLoginSettings
      • SourceEventsQueryResultType
      • StorageOnDay
      • StoredData
      • SubdomainConfig
      • SuggestedAlertTypeInfo
      • SystemPermissionsToken
      • Tag
      • TagGroupingRule
      • TagInfo
      • TestFDRErrorResult
      • TestFDRRequestError
      • TestFDRSuccessResult
      • TestFDRValidationError
      • TestParserErrorResult
      • TestParserSuccessResultV2
      • TestResult
      • TimeInterval
      • TokenQueryResultSet
      • TokenSecurityPolicies
      • TrialLicense
      • UnassignIngestTokenMutation
      • UnassignOrganizationManagementRoleFromGroup
      • UnassignOrganizationRoleFromGroup
      • UnassignRoleFromGroup
      • UnassignSystemRoleFromGroup
      • UnblockIngestMutation
      • UnknownWidget
      • Unlimited
      • UnlimitedUsage
      • UnregisterNodeMutation
      • UnsavedAggregateAlert
      • UnsavedAlert
      • UnsavedFilterAlert
      • UnsavedParser
      • UnsavedScheduledSearch
      • UpdateDashboardMutation
      • UpdateDefaultQueryPrefixMutation
      • UpdateDefaultRoleMutation
      • UpdateDescriptionMutation
      • UpdateGroupMutation
      • UpdateParametersInteraction
      • UpdateParserMutation
      • UpdateQueryPrefixMutation
      • UpdateRetentionMutation
      • UpdateRoleMutation
      • UpdateSavedQueryPayload
      • UpdateUserByIDMutation
      • UpdateUserMutation
      • UploadedFileSnapshot
      • UploadFileAction
      • UsageLimitDefined
      • UsageOnDay
      • UsageStats
      • User
      • UserAndTimestamp
      • UserOrGroupAssetPermissionSearchResultSet
      • UserOrGroupSearchDomainRoleResultSet
      • UserOwnership
      • UserPermissions
      • UserPermissionsPage
      • UserResultSetType
      • UsernameAndPasswordAuthentication
      • Users
      • UsersAndGroupsSearchResultSet
      • UserSettings
      • UsersLimit
      • UsersPage
      • VictorOpsAction
      • View
      • ViewConnection
      • ViewInteraction
      • ViewInteractionEntry
      • ViewInteractionTemplate
      • ViewPermissionsToken
      • WebhookAction
      • WellKnownEndPointDetails
      • WidgetInteractionCondition
      • WorkerQueryTracingItem
      • WorkerQueryTracingState
    • Enumerators
      • ActionType
      • ActorType
      • AlertType
      • ArchivalKind
      • ArchivingFormat
      • AssetAction
      • AssetPermissionsAssetType
      • AssetType
      • BlockedQueryMatcherType
      • Changes
      • ColumnChangeKind
      • ConnectionAspect
      • DashboardUpdateFrequency
      • DynamicConfig
      • EnabledInScope
      • EntitiesPageDirection
      • EntitySearchSortOrderType
      • EntitySearchEntityType
      • EnvironmentType
      • EventForwarderKind
      • FeatureAnnouncement
      • FieldConditionOperatorType
      • Fleet__SortBy
      • FleetConfiguration__SortBy
      • GroupsOrUsersFilter
      • IngestFeedAwsAuthenticationKind
      • IngestFeedCompression
      • IngestFeedPreprocessingKind
      • IngestListenerProtocol
      • IocTableStatus
      • KindEnum
      • LanguageVersionEnum
      • LocalTargetType
      • LogCollectorConfigurationAssignmentType
      • LogCollectorStatusType
      • MergeStrategy
      • NodeTaskEnum
      • NotificationSeverity
      • NotificationTypes
      • ObjectAction
      • OrganizationAction
      • OrganizationManagementPermission
      • OrganizationMode
      • OrganizationPermission
      • PackageInstallationSourceType
      • PackageType
      • ParameterTypeEnum
      • PendingUserState
      • Permission
      • PermissionSetType
      • PermissionType
      • Purposes
      • QueryAssistantDiagnosticSeverity
      • QueryOwnership_SelectionTargetType
      • QueryOwnershipType
      • QueryQuotaInterval
      • QueryQuotaIntervalSettingKind
      • QueryQuotaIntervalSettingSource
      • QueryQuotaMeasurementKind
      • QueryTimestampType
      • ReadonlyDefaultRole
      • RepositoriesUsageQuerySortBy
      • RepositoryDataType
      • RepositoryType
      • S3ArchivingFormat
      • SearchDomainTypes
      • SearchFleetOsFilter
      • SearchFleetStatusFilter
      • Severity
      • ShowTermsAndConditions
      • SocialLoginField
      • SocialProviderProfile
      • SortField
      • SortOrder
      • StabilityLevel
      • SystemAction
      • SystemPermission
      • Targets
      • Tokens__SortBy
      • Tokens__Type
      • TriggerMode
      • UiTheme
      • ViewAction
    • Input Structures
      • ActionSecurityPoliciesInput
      • ActorInput
      • AddAlertLabel
      • AddAliasMappingInput
      • AddToBlockListInput
      • AddIngestTokenV3Input
      • AddLabelScheduledSearch
      • AddLimitInput
      • AddLimitV2Input
      • AddRecentQueryInput
      • AddRoleInput
      • AddStarScheduledSearch
      • AddStarToAlert
      • AddStarToFieldInput
      • AddStarToQueryInput
      • AddSubdomainInput
      • AddToBlocklistByIdInput
      • AddUserInput
      • AddUserInputV2
      • AddUsersToGroupInput
      • AlertFieldValuesInput
      • AliasInfoInput
      • AliasMappingInput
      • AnalyticsBrowser
      • AnalyticsDevice
      • AnalyticsDeviceInfo
      • AnalyticsEngine
      • AnalyticsFeature
      • AnalyticsInfo
      • AnalyticsOS
      • AnalyticsLog
      • AnalyticsLogWithTimestamp
      • AnalyticsMetrics
      • AnalyticsUserAgent
      • AnalyzeQueryArguments
      • ArgumentInput
      • AssignOrganizationManagementRoleToGroupInput
      • AssignParserToIngestTokenInputV2
      • AssignRoleToGroupInput
      • AssignSystemRoleToGroupInput
      • AssignUserRolesInSearchDomainInput
      • BatchUpdateQueryOwnershipInput
      • BlockIngestOnOrgInput
      • CachePolicyInput
      • CancelRedactEventsInput
      • CheckLocalClusterConnectionInput
      • CheckRemoteClusterConnectionInput
      • ClearErrorOnAggregateAlertInput
      • ClearErrorOnAlertInput
      • ClearErrorOnFilterAlertInput
      • ClearErrorOnScheduledSearchInput
      • ClearFieldConfigurationsInput
      • ClearRecentQueriesInput
      • ClearSearchLimitForSearchDomain
      • ClusterConnectionInputTag
      • ConcatenateQueriesArguments
      • CreateAggregateAlert
      • CreateAlert
      • CreateActionFromTemplateInput
      • CreateAlertFromTemplateInput
      • CreateAwsS3SqsIngestFeed
      • CreateCrossOrgViewInput
      • CreateDashboardFromTemplateV2Input
      • CreateDashboardInput
      • CreateEmailAction
      • CreateEventForwardingRule
      • CreateFdrFeed
      • CreateFieldAliasSchemaInput
      • CreateFieldAliasSchemaFromTemplateInput
      • CreateFilterAlert
      • CreateHumioRepoAction
      • CreateIngestListenerV3Input
      • CreateKafkaEventForwarder
      • CreateCustomLinkInteractionInput
      • CreateDashboardLinkInteractionInput
      • CreateLocalClusterConnectionInput
      • CreateOpsGenieAction
      • CreateOrganizationPermissionTokenInput
      • CreateOrganizationPermissionsTokenV2Input
      • CreateOrUpdateExternalFunctionInput
      • CreatePagerDutyAction
      • CreateParserFromTemplateInput
      • CreateParserInput
      • CreateParserInputV2
      • CreatePersonalUserTokenInput
      • CreatePostMessageSlackAction
      • CreateRemoteClusterConnectionInput
      • CreateScheduledReportLayoutInput
      • CreateScheduledReportParameterValueInput
      • CreateScheduledReportScheduleInput
      • CreateSavedQueryInput
      • CreateScheduledReportInput
      • CreateScheduledSearch
      • CreateScheduledSearchV2
      • CreateSearchLinkInteractionInput
      • CreateSlackAction
      • CreateSystemPermissionTokenInput
      • CreateSystemPermissionTokenV2Input
      • CreateUploadFileAction
      • CreateVictorOpsAction
      • CreateViewPermissionsTokenInput
      • CreateViewPermissionsTokenV2Input
      • CloneParserInput
      • ColumnChange
      • ConflictResolutionConfiguration
      • CrossOrganizationViewConnectionInputModel
      • CustomLinkInteractionInput
      • DashboardLinkInteractionInput
      • DashboardUpdateFrequencyInput
      • DeleteAction
      • DeleteAggregateAlert
      • DeleteClusterConnectionInput
      • DeleteDashboardInput
      • DeleteDashboardInputV2
      • DeleteEventForwarderInput
      • DeleteEventForwardingRule
      • deleteExternalFunctionInput
      • DeleteFdrFeed
      • DeleteFilterAlert
      • DeleteFieldAliasSchema
      • DeleteIngestFeed
      • DeleteInteractionInput
      • DeleteParserInput
      • DeleteSavedQueryInput
      • DeleteScheduledReportInput
      • DeleteScheduledSearch
      • DeleteSearchDomainByIdInput
      • DisableAggregateAlert
      • DisableAlert
      • DisableEventForwarderInput
      • DisableFieldAliasSchemaOnOrgInput
      • DisableFieldAliasSchemaOnViewInput
      • DisableFieldAliasSchemaOnViewsInput
      • DisableFilterAlert
      • DisableOrganizationIocAccess
      • DisableFieldAliasSchemaOnOrgInput
      • DisableOrganizationIocAccess
      • DynamicConfigInputObject
      • EnableAggregateAlert
      • EnableAlert
      • EnableEventForwarderInput
      • EnableFieldAliasSchemaOnViewsInput
      • EnableFieldAliasSchemaOnOrgInput
      • EnableFilterAlert
      • EnabledInput
      • EnableOrganizationIocAccess
      • EnableScheduledReportInput
      • EnableStarScheduledSearch
      • EnableWorkerQueryTracingInputType
      • EnforceSubdomainsInput
      • EntitiesPageInputType
      • EntitySearchInputType
      • EntitySearchSortInfoType
      • FunctionListInput
      • FieldConfigurationInput
      • FieldHasValueInput
      • FilterInput
      • FieldInteractionConditionInput
      • FileFieldFilterType
      • GenerateAggregateAlertFromTemplateInput
      • GenerateAlertFromPackageTemplateInput
      • GenerateAlertFromTemplateInput
      • GenerateFilterAlertFromTemplateInput
      • GenerateParserFromTemplateInput
      • GenerateScheduledSearchFromPackageTemplateInput
      • GenerateScheduledSearchFromTemplateInput
      • GetExternalFunctionInput
      • GroupFilter
      • GroupRoleAssignment
      • HttpHeaderEntryInput
      • IngestFeedAwsAuthenticationInput
      • IngestFeedPreprocessingInput
      • IngestPartitionInput
      • InputData
      • InputDictionaryEntry
      • InstallPackageFromRegistryInput
      • IPFilterIdInput
      • IPFilterInput
      • IPFilterUpdateInput
      • KindInput
      • LanguageVersionInputType
      • LinkInput
      • LoginBridgeInput
      • LoginBridgeUpdateInput
      • MarkLimitDeletedInput
      • MigrateLimitsInput
      • OidcConfigurationInput
      • OrderByUserFieldInput
      • OrganizationLimitsInput
      • ParameterFilePropertiesInput
      • ParameterFileValueFilter
      • ParameterFixedListOption
      • ParameterFixedListPropertiesInput
      • ParameterFreeTextPropertiesInput
      • ParameterInput
      • ParameterQueryPropertiesInput
      • ParameterSpecificationInput
      • PermissionSetInput
      • ParserTestCaseAssertionsForOutputInput
      • ParserTestCaseInput
      • ParserTestCaseInput
      • ParserTestEventInput
      • ParserTestRunInput
      • PermissionAssignmentInputType
      • QueryArgument
      • QueryArgumentInputType
      • QueryQuotaDefaultSettingsInput
      • QueryQuotaIntervalSettingInput
      • QueryQuotaUserSettingsInput
      • RedactEventsInputType
      • RemoveAlertLabel
      • RemoveAliasMappingInput
      • RemoveCrossOrgViewConnectionsInput
      • RemoveFromBlocklistInput
      • RemoveLabelScheduledSearch
      • RemoveLimitInput
      • RemoveOrganizationRoleFromGroupInput
      • RemoveParserInput
      • RemoveRoleFromGroupInput
      • RemoveSecondarySubdomainInput
      • RemoveStarFromAlert
      • RemoveStarFromQueryInput
      • RemoveStarToFieldInput
      • RemoveStarScheduledSearch
      • RemoveSystemRoleFromGroupInput
      • RemoveUserByIdInput
      • RemoveUsersFromGroupInput
      • RemoveUserInput
      • RenameSearchDomainByIdInput
      • RepoFilterInput
      • ReportErrorInput
      • ResetQuotaInput
      • RestoreDeletedSearchDomainInput
      • ResubmitMarketoLeadData
      • RevokeSessionInput
      • RotateTokenInputData
      • RunInconsistencyCheckInput
      • ScheduledReportResultFailedInput
      • ScheduledReportResultSucceededInput
      • SchemaFieldInput
      • SearchFleetVersionFilter
      • SearchLinkInteractionInput
      • SectionInput
      • SeriesConfigInput
      • ServiceLevelIndicatorLogArg
      • SetLimitDisplayNameInput
      • SetPrimarySubdomainInput
      • SetSearchLimitForSearchDomain
      • SetSubdomainSettingsInput
      • SharedDashboardsSecurityPoliciesInput
      • SlackFieldEntryInput
      • SessionInput
      • SetDefaultSavedQueryInput
      • SetGlobalDefaultCachePolicyInput
      • SetOffsetForDatasourcesOnPartitionInput
      • SocialLoginSettingsInput
      • StopQueriesInput
      • TagGroupingRuleInput
      • TagsInput
      • TestAwsS3SqsIngestFeed
      • TestEmailAction
      • TestFdrFeed
      • TestHumioRepoAction
      • TestKafkaEventForwarder
      • TestOpsGenieAction
      • TestPagerDutyAction
      • TestParserInputV2
      • TestPostMessageSlackAction
      • TestSlackAction
      • TestUploadFileAction
      • TestVictorOpsAction
      • TestWebhookAction
      • TimeIntervalInput
      • TokenInput
      • TokenSecurityPoliciesInput
      • TriggerPollIngestFeed
      • UnassignOrganizationManagementRoleFromGroupInput
      • UnsetDynamicConfigInputObject
      • UpdateAggregateAlert
      • UpdateAwsS3SqsIngestFeed
      • UpdateCrossOrganizationViewConnectionFiltersInput
      • UpdateCustomLinkInteractionInput
      • UpdateDashboardInput
      • UpdateDashboardLinkInteractionInput
      • UpdateDefaultQueryPrefixInput
      • UpdateDefaultRoleInput
      • UpdateDescription
      • UpdateEmailAction
      • UpdateEventForwardingRule
      • UpdateFdrFeed
      • UpdateFdrFeedControl
      • UpdateFieldAliasMappingInput
      • UpdateFilterAlert
      • UpdateFieldAliasSchemaInput
      • UpdateGroupInput
      • UpdateHumioRepoAction
      • UpdateIngestFeedDescription
      • UpdateIngestListenerV3Input
      • UpdateKafkaEventForwarder
      • UpdateLimitInput
      • UpdateLimitInputV2
      • UpdateLocalClusterConnectionInput
      • UpdateLong
      • UpdateOrganizationPermissionsTokenPermissionsInput
      • UpdatePagerDutyAction
      • UpdateParametersInteractionInput
      • UpdateParserInput
      • UpdateParserInputV2
      • UpdateParserScriptInput
      • UpdateOidcConfigurationInput
      • UpdateOpsGenieAction
      • UpdatePackageFromRegistryInput
      • UpdatePostMessageSlackAction
      • UpdateQueryPrefixInput
      • UpdateRemoteClusterConnectionInput
      • UpdateRepoDataTypeInputObject
      • UpdateRepoLimitIdInputObject
      • UpdateRoleInput
      • UpdateSavedQueryInput
      • UpdateScheduledReportInput
      • UpdateScheduledReportLayoutInput
      • UpdateScheduledReportParameterValueInput
      • UpdateScheduledReportScheduleInput
      • UpdateScheduledSearch
      • UpdateScheduledSearchV2
      • UpdateSearchLinkInteractionInput
      • UpdateSlackAction
      • UpdateSubscriptionInputObject
      • UpdateSystemPermissionsTokenPermissionsInput
      • UserRoleAssignment
      • UpdateUploadFileAction
      • UpdateUserByIdInput
      • UpdateVictorOpsAction
      • UpdateViewPermissionsTokenPermissionsInput
      • UpdateWebhookAction
      • UpgradeAccountData
      • UserDefaultSettingsInput
      • UserRoleAssignmentInput
      • UTMParams
      • ViewConnectionInput
      • ViewPermissionsTokenAssetPermissionAssignmentInput
      • WidgetInput
      • WidgetLinkPropertiesInput
      • WidgetNotePropertiesInput
      • WidgetParameterPanelPropertiesInput
      • WidgetQueryPropertiesInput
    • Interfaces
      • Action
      • ArchivingConfiguration
      • AssetActionsBySource
      • AuthenticationMethod
      • AuthenticationMethodAuth
      • ClusterConnection
      • ClusterConnectionStatus
      • contractual
      • DashboardParameter
      • EventForwarder
      • IdentityProviderAuthentication
      • License
      • ModifiedInfo
      • QueryOwnership
      • Searchdomain
      • Token
      • Widget
    • GraphQL API
      • Accessing GraphQL using API Explorer
      • Accessing GraphQL using a Script or curl
    • GraphQL API Stability
  • GraphQL Queries
    • alertFieldValues()
    • analyzeQuery()
    • asnDatabaseInfo()
    • blockedQueries()
    • checkDomain()
    • checkLocalClusterConnection()
    • checkRemoteClusterConnection()
    • childOrganizations()
    • cluster()
    • clusterManagementSettings()
    • concatenateQueries()
    • currentUser()
    • dashboardsPage()
    • dynamicConfig()
    • dynamicConfigs()
    • entitiesSearch()
    • entitiesPage()
    • environmentVariableUsage()
    • eventForwarders()
    • exceededQueryQuotas()
    • featureFlags()
    • fetchOIDCMetadataFromDiscoveryEndpoint()
    • fetchSamlMetadataFromDiscoveryEndpoint()
    • fieldAliasSchemas()
    • fieldAliasSchemaOnView()
    • findIdentityProvider()
    • fleetInstallationToken()
    • fleetInstallationTokens()
    • flightRecorderSettings()
    • generateAggregateAlertFromPackageTemplate()
    • generateAggregateAlertFromTemplate()
    • generateAlertFromPackageTemplate()
    • generateAlertFromTemplate()
    • generateFilterAlertFromPackageTemplate()
    • generateFilterAlertFromPackageTemplate()
    • generateParserFromTemplate()
    • generateScheduledSearchFromPackageTemplate()
    • generateScheduledSearchFromTemplate()
    • getExternalFunction()
    • getFileContent()
    • getFleetManagementUrl()
    • getLogCollectorDebugLogging()
    • getLogCollectorDetails()
    • getLogCollectorInstanceDebugLogging()
    • getLostCollectorDays()
    • group()
    • groupByDisplayName()
    • groupsAndUsersWithPermissionsOnAsset()
    • groupsPage()
    • hasOrgRoot()
    • identityProvider()
    • identityProviders()
    • installedLicense()
    • installedPackage()
    • iocDatabaseInfo()
    • ipDatabaseInfo()
    • ipFilters()
    • kafkaCluster()
    • languageRestrictions()
    • listNotifications()
    • logCollectorConfiguration()
    • logCollectorInstallers()
    • logCollectorMergedConfiguration()
    • logCollectorVersionsAvailable()
    • loginBridgeRequest()
    • marketplace()
    • meta()
    • nonDefaultBucketConfigs()
    • oidcIdentityProvider()
    • organization()
    • parentOrganizations()
    • pendingUser()
    • pendingUsers()
    • proxyOrganization()
    • queryAnalysis()
    • queryAssistance()
    • queryQuotaDefaultSettings()
    • queryQuotaUsage()
    • queryQuotaUserSettings()
    • querySearchDomains()
    • redactEvents()
    • repositories()
    • repository()
    • role()
    • roles()
    • rolesInOrgForChangingUserAccess()
    • rolesPage()
    • runningQueries()
    • s3ArchivingRequiresRole()
    • samlIdentityProvider()
    • scheduledReport()
    • savedQuery()
    • searchDomain()
    • searchDomainAssets()
    • searchDomains()
    • searchDomainsPage()
    • searchFleet()
    • searchFleetInstallationTokens()
    • searchLogCollectorConfigurations()
    • searchLogCollectorGroups()
    • searchOrganizations()
    • segment()
    • servicesMetadata()
    • serviceStatus()
    • sessions()
    • sharedDashboards()
    • starredDashboards()
    • tokenForFleetManagement()
    • token()
    • tokens()
    • usage()
    • user()
    • users()
    • usersAndGroupsForChangingUserAccess()
    • usersPage()
    • usersWithoutOrganizations()
    • validateAccessToken()
    • validateAccessTokenV2()
    • validateQuery()
    • validateToken()
    • viewer()
    • viewerOpt()
    • workerQueryTracingState()
  • GraphQL Mutations
    • acceptTermsAndConditions()
    • activateAccount()
    • addAlertLabelV2()
    • addCrossOrgViewConnections()
    • addDashboardFilter()
    • addDashboardLabel()
    • addFieldAliasMapping()
    • addFunctionsToAllowList()
    • addGroup()
    • addIngestTokenV3()
    • addLimit()
    • addLoginBridgeAllowedUsers()
    • addOrUpdateQueryQuotaDefaultSettings()
    • addOrUpdateQueryQuotaUserSettings()
    • addRecentQuery()
    • addScheduledSearchLabel()
    • addStarToAlertV2()
    • addStarToDashboard()
    • addStarToField()
    • addStarToScheduledSearch()
    • addStarToSearchDomain()
    • addSubdomain()
    • addToBlocklist()
    • addToBlocklistById()
    • addToLogCollectorConfigurationTest()
    • addUsersToGroup()
    • addUserV2()
    • assignLogCollectorConfiguration()
    • assignLogCollectorsToConfiguration()
    • assignOrganizationManagementRoleToGroup()
    • assignOrganizationRoleToGroup()
    • assignParserToIngestTokenV2()
    • assignPermissionsForResources()
    • assignRoleToGroup()
    • assignSystemRoleToGroup()
    • assignTasks()
    • assignUserRolesInSearchDomain()
    • batchUpdateQueryOwnership()
    • blockIngest()
    • blockIngestOnOrg()
    • cancelRedactEvents()
    • changeUserAndGroupRolesForSearchDomain()
    • clearCid()
    • clearErrorOnAggregateAlert()
    • clearErrorOnAlert()
    • clearErrorOnFilterAlert()
    • clearErrorOnScheduledSearch()
    • clearFieldConfigurations()
    • clearRecentQueries()
    • ClearSearchLimitForSearchDomain()
    • cloneParser()
    • clusterUnregisterNode()
    • copyDashboard()
    • createActionFromPackageTemplate()
    • createActionFromTemplate()
    • createAggregateAlert()
    • createAlert()
    • createAwsS3SqsIngestFeed()
    • createCrossOrgView()
    • createCustomLinkInteraction()
    • createDashboard()
    • createDashboardFromPackageTemplate()
    • createDashboardFromTemplateV2()
    • createDashboardLinkInteraction()
    • createDemoDataRepository()
    • createEmailAction()
    • createEmptyOrganization()
    • createFdrFeed()
    • createFieldAliasSchemaFromTemplate()
    • createFieldAliasSchema()
    • createFilterAlert()
    • createFleetInstallToken()
    • createEventForwardingRule()
    • createHumioRepoAction()
    • createIngestListenerV3()
    • createIPFilter()
    • createKafkaEventForwarder()
    • createLocalClusterConnection()
    • createLookupFileFromPackageTemplate()
    • createLogCollectorConfiguration()
    • createLogCollectorGroup()
    • createOpsGenieAction()
    • createOrganizationPermissionsToken()
    • createOrganizationsViews()
    • createOrUpdateCrossOrganizationView()
    • createOrUpdateExternalFunction()
    • createOrganizationPermissionsTokenV2()
    • createPagerDutyAction()
    • createParser()
    • createParserV2()
    • createParserFromPackageTemplate()
    • createParserFromTemplate()
    • createPersonalUserToken()
    • createPersonalUserTokenV2()
    • createReadonlyToken()
    • createRemoteClusterConnection()
    • createRepository()
    • createRole()
    • createSavedQuery()
    • createSavedQueryFromPackageTemplate()
    • createScheduledReport()
    • createScheduledSearch()
    • createScheduledSearchV2()
    • createSearchLinkInteraction()
    • createSlackAction()
    • createSlackPostMessageAction()
    • createSystemPermissionsToken()
    • createSystemPermissionsTokenV2()
    • createUploadFileAction()
    • createVictorOpsAction()
    • createView()
    • createViewPermissionsToken()
    • createViewPermissionsTokenV2()
    • createWebhookAction()
    • deleteAggregateAlert()
    • deleteAction()
    • deleteAlert()
    • deleteClusterConnection()
    • deleteDashboard()
    • deleteDashboardV2()
    • deleteEventForwarder()
    • deleteEventForwardingRule()
    • deleteExternalFunction()
    • deleteFdrFeed()
    • deleteFeatureFlag()
    • deleteFieldAliasSchema()
    • deleteFilterAlert()
    • deleteIdentityProvider()
    • deleteIngestFeed()
    • deleteIngestListener()
    • deleteInteraction()
    • deleteIPFilter()
    • deleteLogCollectorConfiguration()
    • deleteLogCollectorGroup()
    • deleteLostCollectors()
    • deleteNotification()
    • deleteParser()
    • deleteReadonlyToken()
    • deleteSavedQuery()
    • deleteScheduledReport()
    • deleteScheduledSearch()
    • deleteSearchDomain()
    • deleteSearchDomainById()
    • deleteToken()
    • disableAggregateAlert()
    • disableAlert()
    • disableArchiving()
    • disableDemoDataForUser()
    • disableEventForwarder()
    • disableFieldAliasSchemaOnView()
    • disableFieldAliasSchemaOnViews()
    • disableFilterAlert()
    • disableFeature()
    • disableFeatureForOrg()
    • disableFeatureForUser()
    • disableFieldAliasSchemaOnOrg()
    • disableLogCollectorDebugLogging()
    • disableLogCollectorInstanceDebugLogging()
    • disableOrganizationIocAccess()
    • disableScheduledReport()
    • disableScheduledSearch()
    • disableWorkerQueryTracing()
    • dismissNotification()
    • enableAlert()
    • enableArchiving()
    • enableDemoDataForUser()
    • enableEventForwarder()
    • enableFeature()
    • enableFeatureForOrg()
    • enableFeatureForUser()
    • enableFieldAliasSchemaOnOrg()
    • enableFieldAliasSchemaOnViews()
    • enableFilterAlert()
    • enableLogCollectorDebugLogging()
    • enableLogCollectorInstanceDebugLogging()
    • enableOrganizationIocAccess()
    • enableScheduledReport()
    • enableScheduledSearch()
    • enableWorkerQueryTracing()
    • extendCloudTrial()
    • findOrCreateBucketStorageEntity()
    • gcsConfigureArchiving()
    • installPackageFromRegistryV2()
    • installPackageFromZip()
    • killQuery()
    • languageRestrictionsEnable()
    • linkChildOrganization()
    • logAnalytics()
    • logAnalyticsBatch()
    • logFrontendServiceLevelIndicators()
    • logoutOfSession()
    • markLimitDeleted()
    • migrateToNewLimits()
    • newAzureAdOidcIdentityProvider()
    • newFile()
    • newOIDCIdentityProvider()
    • newSamlIdentityProvider()
    • notify()
    • overrideRolledOutFeatureFlag()
    • proxyOrganization()
    • publishLogCollectorConfiguration()
    • recoverOrganization()
    • redactEvents()
    • refreshClusterManagementStats()
    • refreshRegions()
    • removeAlertLabelV2()
    • removeCrossOrgViewConnections()
    • removeDashboardFilter()
    • removeDashboardLabel()
    • removeDemoDataRepository()
    • removeFieldAliasMapping()
    • removeFile()
    • removeFromBlocklist()
    • removeFromLogCollectorConfigurationTest()
    • removeFunctionsFromAllowList()
    • removeGlobalDefaultCachePolicy()
    • removeGroup()
    • removeIngestToken()
    • removeLimit()
    • removeLimitWithId()
    • removeLoginBridge()
    • removeLoginBridgeAllowedUsers()
    • removeOrganization()
    • removeOrganizationBucketConfig()
    • removeOrgDefaultCachePolicy()
    • removeParser()
    • removeQueryQuotaDefaultSettings()
    • removeQueryQuotaUserSettings()
    • removeRepoCachePolicy()
    • removeRole()
    • removeScheduledSearchLabel()
    • removeSecondarySubdomain()
    • removeSizeBasedRetentionForAllOrganizations()
    • removeStarFromAlertV2()
    • removeStarFromDashboard()
    • removeStarFromField()
    • removeStarFromScheduledSearch()
    • removeStarFromSearchDomain()
    • removeSubdomainSettings()
    • removeUser()
    • removeUserById()
    • removeUsersFromGroup()
    • renameDashboard()
    • renameSearchDomain()
    • renameSearchDomainById()
    • renameWidget()
    • resendInvitation()
    • resetFlightRecorderSettings()
    • resetQuota()
    • resetToFactorySettings()
    • restartArchiving()
    • restoreDeletedSearchDomain()
    • revokePendingUser()
    • revokeSession()
    • rollbackOrganization()
    • rotateToken()
    • runGlobalConsistencyCheck()
    • runInconsistencyCheck()
    • s3ConfigureArchiving()
    • s3DisableArchiving()
    • s3EnableArchiving()
    • s3ResetArchiving()
    • setAllowRebalanceExistingSegments()
    • setAllowUpdateDesiredDigesters()
    • setAutomaticSearching()
    • setCid()
    • setConsideredAliveFor()
    • setConsideredAliveUntil()
    • setDefaultDashboardFilter()
    • setDefaultSavedQuery()
    • setDigestReplicationFactor()
    • setDynamicConfig()
    • setEnforceSubdomains()
    • setFieldConfiguration()
    • setGlobalDefaultCachePolicy()
    • setIsBeingEvicted()
    • setLimitDisplayName()
    • setLoginBridge()
    • setLoginBridgeTermsState()
    • setLostCollectorDays()
    • setOffsetForDatasourcesOnPartition()
    • setOldObjectSampleDurationMinutes()
    • setOldObjectSampleEnabled()
    • setOrganizationBucket1()
    • setOrganizationBucket2()
    • setOrgDefaultCachePolicy()
    • setMinHostAlivePercentageToEnableClusterRebalancing()
    • setPrimarySubdomain()
    • setRepoCachePolicy()
    • SetSearchLimitForSearchDomain()
    • setSegmentReplicationFactor()
    • setSubdomainSettings()
    • setTagGroupings()
    • setWantedLogCollectorVersion()
    • starQuery()
    • startLogCollectorConfigurationTest()
    • stopAllQueries()
    • stopHistoricalQueries()
    • stopLogCollectorConfigurationTest()
    • stopStreamingQueries()
    • testEmailAction()
    • testFdrFeed()
    • testHumioRepoAction()
    • testKafkaEventForwarderV2()
    • testOpsGenieAction()
    • testPagerDutyAction()
    • testParser()
    • testParserV2()
    • testSlackAction()
    • testSlackPostMessageAction()
    • testUploadFileAction()
    • testVictorOpsAction()
    • testWebhookAction()
    • triggerPollIngestFeed()
    • unassignOrganizationManagementRoleFromGroup()
    • unassignUserRoleForSearchDomain()
    • unassignIngestToken()
    • unassignOrganizationRoleFromGroup()
    • unassignRoleFromGroup()
    • unassignSystemRoleFromGroup()
    • unassignTasks()
    • unblockIngest()
    • unenrollLogCollectors()
    • uninstallPackage()
    • unlinkChildOrganization()
    • unsetDynamicConfig()
    • unsetOrganizationBucket2()
    • unstarQuery()
    • updateActionSecurityPolicies()
    • updateAggregateAlert()
    • updateAlert()
    • updateAwsS3SqsIngestFeed()
    • updateCrossOrgViewConnectionFilters()
    • updateCustomLinkInteraction()
    • updateDashboard()
    • updateDashboardFilter()
    • updateDashboardLinkInteraction()
    • updateDashboardToken()
    • updateDefaultQueryPrefix()
    • updateDefaultRole()
    • updateDescriptionForSearchDomain()
    • updateDraftLogCollectorConfiguration()
    • updateEmailAction()
    • updateEventForwardingRule()
    • updateFdrFeed()
    • updateFdrFeedControl()
    • updateFieldAliasMapping()
    • updateFieldAliasSchema()
    • updateFile()
    • updateFilterAlert()
    • updateFleetInstallTokenConfigId()
    • updateGroup()
    • updateHumioRepoAction()
    • updateIngestListenerV3()
    • updateIngestPartitionScheme()
    • updateIPFilter()
    • updateKafkaEventForwarder()
    • updateLicenseKey()
    • updateLimit()
    • updateLimitV2()
    • updateLocalClusterConnection()
    • updateLogCollectorConfigurationDescription()
    • updateLogCollectorConfigurationName()
    • updateLogCollectorGroupConfigIds()
    • updateLogCollectorGroupFilter()
    • updateLogCollectorGroupName()
    • updateLogCollectorGroupWantedVersion()
    • updateLoginBridge()
    • updateMaxAutoShardCount()
    • updateMaxIngestRequestSize()
    • updateOIDCIdentityProvider()
    • updateOpsGenieAction()
    • updateOrganizationForeignKey()
    • updateOrganizationInfo()
    • updateOrganizationLimits()
    • updateOrganizationMutability()
    • updateOrganizationNotes()
    • updateOrganizationPermissionsTokenPermissions()
    • updateOrganizationRoot()
    • updateOrganizationSubscription()
    • updatePackageFromRegistryV2()
    • updatePackageFromZip()
    • updatePagerDutyAction()
    • updateParser()
    • updateParserV2()
    • updateProfile()
    • updateQueryPrefix()
    • updateReadonlyDashboardIPFilter()
    • updateRemoteClusterConnection()
    • updateRepositoryDataType()
    • updateRepositoryLimitId()
    • updateRepositoryType()
    • updateRepositoryUsageTag()
    • updateRetention()
    • updateRole()
    • updateSamlIdentityProvider()
    • updateSavedQuery()
    • updateScheduledReport()
    • updateScheduledSearch()
    • updateScheduledSearchV2()
    • updateSearchLinkInteraction()
    • updateSessionSettings()
    • updateSettings()
    • updateSharedDashboardsSecurityPolicies()
    • updateSlackAction()
    • updateSlackPostMessageAction()
    • updateSocialLoginSettings()
    • updateSystemPermissionsTokenPermissions()
    • updateTokenSecurityPolicies()
    • updateUploadFileAction()
    • updateUser()
    • updateUserById()
    • updateUserDefaultSettings()
    • updateVictorOpsAction()
    • updateView()
    • updateViewPermissionsTokenPermissions()
    • updateWebhookAction()
    • upgradeAccount()
Falcon LogScale Documentation
/ LogScale GraphQL Reference - Datatypes

Interfaces

Besides the common datatypes such as strings and integers, LogScale GraphQL has many of specialized datatypes. This page lists all of the interface datatypes.

  • Action

  • ArchivingConfiguration

  • AssetActionsBySource

  • AuthenticationMethod

  • AuthenticationMethodAuth

  • ClusterConnection

  • ClusterConnectionStatus

  • contractual

  • DashboardParameter

  • EventForwarder

  • IdentityProviderAuthentication

  • License

  • ModifiedInfo

  • QueryOwnership

  • Searchdomain

  • Token

  • Widget

Support
  • Twitter
  • Facebook
  • LinkedIn
  • Youtube

© 2025 CrowdStrike All other marks contained herein are the property of their respective owners.

Children of this Page

Action
ArchivingConfiguration
AssetActionsBySource
AuthenticationMethod
AuthenticationMethodAuth
ClusterConnection
ClusterConnectionStatus
contractual
DashboardParameter
EventForwarder
IdentityProviderAuthentication
License
ModifiedInfo
QueryOwnership
Searchdomain
Token
Widget

Enter search term

OSZAR »