max_runtime_minutes

Learn more about the Cortex Query Language max_runtime_minutes config stage.

Syntax

config max_runtime_minutes = <number> | ...

Description

The max_runtime_minutes function is used to override the default query duration timeout (60 minutes). You can increase the query duration timeout up-to the administrator defined value, as defined in Settings → Configurations → General → Query Management → Query Limits.

Only integer values are supported for this field. In addition, the query timeout is an approximate value.

For more information about query limits, see XQL query management.

Examples

config max_runtime_minutes = 90 
| dataset = xdr_data 
| fields actor_process_image_name as apin 
| filter apin != NULL and apin contains "python" 
| limit 100