How to Export Falcon LogScale Logs
Summary
A guide to exporting Falcon LogScale events through its query API or search UI, converting NDJSON @rawstring data to raw logs, and troubleshooting permissions, timestamps, aggregation, missing fields and timeouts.
Key points
- The query API can return events as NDJSON; extracting the @rawstring field restores original log lines.
- A query token needs repository query permission and should be treated like a password.
- Use a filter rather than aggregation functions when exporting individual events.
- The Search UI can export plain text, JSON or CSV; JSON preserves complete event objects, while plain text requires @rawstring.
- For large searches, narrow the time range or use the asynchronous query jobs API.
- Troubleshooting guidance covers authorization errors, incorrect repository names or timestamp units, aggregated results, missing @rawstring data and timeouts.
Article Details
- Topic
- Exporting Falcon LogScale logs through the query API or web interface for review in LogTotal