The issue is the 40-KB limit associated with directly running raw script content. The safer method is to upload the script to the endpoint with put, then execute it from the host path using runscript -hostpath.
This avoids forcing the full script body through a raw command execution path. Breaking the script into smaller files is operationally messy and increases the chance of partial execution or sequencing errors. runscript -cloudfile is used for scripts already available as cloud files or RTR-managed content, but the option that says to upload locally and execute directly misstates how that workflow functions. In RTR operations, the clean method for larger local scripts is to place the file on the endpoint and run it from the host path.

Process Timeline is the intended investigative view because it lets a responder examine the process execution and the process-related telemetry surrounding it within the selected time window. This is useful for identifying nearby process starts and other events that explain what happened before and after the suspicious activity. A general Host Search returns information organized by categories, but it is not the focused chronological view requested here. Full Detection Details primarily shows the process ancestry and relationships associated with the detection, rather than every relevant event around the selected execution.
"Process Search" is not the appropriate timeline workflow described by the Falcon Responder material.
Therefore, the best answer is to open a Process Timeline and apply the host and time context.