How to Export Falcon LogScale Logs

Send your query to the LogScale query API, POST /api/v1/repositories/<repo>/query, and ask for application/x-ndjson: you get one event per line. The original log line sits in @rawstring, so one jq call turns the export back into raw logs. Alternatively, export logs directly from the LogScale UI as plain text, JSON or CSV.

LogScale (formerly Humio) is built for high-volume log search, so it often holds the most complete record a team has. Prime Core has 23,747 detection rules for Falcon LogScale, mapped to 674 MITRE ATT&CK techniques. Below is how to get data out, sanitize it, and investigate it for free in LogTotal.

This guide covers standalone LogScale, cloud or self-hosted. If you use LogScale inside the Falcon console as part of Next-Gen SIEM, the console and its APIs are different.

Get Started For Free

Before you start

A token. Create an API token with permission to query the repository. Treat it like a password.

Base URL and repository. Cloud customers use their region’s URL, such as https://cloud.us.humio.com. Self-hosted clusters use their own hostname. You also need the repository or view name.

Retention. Each repository has its own retention. Check it before you promise anyone a week of history.

Export with the query API

LS="https://cloud.us.humio.com"
START=$(date -d '2026-10-19T00:00:00Z' +%s000)
END=$(date -d '2026-10-20T00:00:00Z' +%s000)

curl -sS "$LS/api/v1/repositories/security/query" \
  -H "Authorization: Bearer $LOGSCALE_TOKEN" \
  -H "Content-Type: application/json" -H "Accept: application/x-ndjson" \
  -d "{\"queryString\": \"host=web-03\", \"start\": $START, \"end\": $END, \"isLive\": false}" \
  > logscale_web03_1019.ndjson

# raw lines only
jq -r '."@rawstring"' logscale_web03_1019.ndjson > logscale_web03_1019.log

The start and end values are epoch milliseconds; relative values like “24h” work too. The date -d syntax is GNU, so on macOS compute the timestamps another way.

Keep the query a filter. Anything that aggregates (groupBy, count, timechart) returns the aggregate, not events. For very long or heavy searches, use the query jobs API, which runs the search asynchronously and lets you poll for results.

Export logs through the Falcon LogScale Search UI

For quick investigations or smaller log samples, you can export events directly from the Falcon LogScale web interface without using the API.

1. Open Search. Sign in to Falcon LogScale, select the repository or view containing your logs, and open the Search page.
2. Run a query. Enter a search filter, for example host=web-03. Set the time range and run the search.
3. Review results. Check that the returned events match what you need. Avoid aggregation functions such as groupBy(), count() or timeChart() if you want individual log events.
4. Export the logs. From the search results, click Save > Export data to file.
5. Choose the file format.
   • Plain text (.txt): Exports the @rawstring field, preserving the original log lines. Best for LogTotal when the source contains syslog-style text.
   • JSON (.json): Exports complete event objects, including parsed fields and metadata. Best when you need structured events.
   • CSV (.csv): Exports selected fields into a table. Useful for reporting, but less suitable for LogTotal. Select ‘Select all’ in ‘Fields to export’.
6. Download. Enter a filename and click Export to save the file locally.

Limitations. Plain-text export requires the original log content to be available in @rawstring. If that field is missing, export the complete events as JSON instead. For large datasets, narrow the time range or use the query API. Non-aggregated search exports may contain events in a different order from the UI results.

Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the file. 
2. Sanitize. 
3. Review. 

When it goes wrong