Cribl Search 101: A Query Engine over Your Data

What Cribl Search is

The Basic Concepts page defines the product through its core terms. At the center are Engines, which are "Capacity units that power your queries." There are two. Lakehouse engines "store and search logs and metrics ingested from Cribl Search Sources," and the data "is structured and stays hot with no tiers to manage." You can add as many lakehouse engines as you need, and size each one for its ingest rate. The Federated engine "runs search-in-place of data stored elsewhere, with no need for ingestion or pre-indexing," and each Cribl.Cloud Workspace has one federated engine.

Data is organized in Datasets, which are "Containers for grouping related data." Search Datasets "store data ingested into a lakehouse engine," and they are either Log Datasets or Metrics Datasets, assigned through Log Dataset rules and Metric Dataset rules. Federated Datasets, by contrast, "point to specific paths in external storage, such as S3 or Azure Blob," and each one uses a Dataset Provider that "holds the query endpoint and access credentials."

Datatypes are "Sets of rules that parse logs into structured events," and you can use stock Datatypes or create custom ones. Lakehouse engines "can assign Datatypes automatically at ingestion time," and Datatype rules let you catch the remaining uncategorized data. On the analysis side, Dashboards are "Collections of visualization panels that display search results and metrics," holding charts such as scatter plots, gauges, or maps. Inputs let viewers filter a Dashboard without editing the underlying queries, and Interactions let them drill down into a data point. Notebooks are "Document-like workspaces that keep related searches, charts, and notes in one browser tab" and are persistent records you can share with others. Notebook templates are reusable layouts for repeatable processes or operational runbooks.

Also, Investigations are "AI-guided incident analysis that starts from a plain-language prompt," analyzing telemetry, finding patterns, and documenting findings without you writing every query manually. Monitors are "Watches on metric queries that tell you when a metric moves outside its expected range," and they raise alerts when their metrics cross thresholds or behave anomalously. Notifications deliver alerts to where your team works; a Notification needs a Notification target, which sets the delivery method, such as email, Slack, or a webhook. Alerts come from scheduled searches and from Monitors, which you configure separately.

Management follows the Cribl.Cloud structure. Your Organization "is your Cribl.Cloud account, covering your license and billing," and its AWS or Azure region is where your searches run. Workspaces are "isolated environments inside your Cribl.Cloud Organization, each with its own engines, Datasets, and limits." Three Cribl Search Permissions set what someone can do: Search Admins manage engines and have unrestricted access, Search Editors add Datasets, rules, and Packs, and Search Users "only search and build, limited to the resources shared with them." Finally, Usage Groups "apply to users you select," with the built-in default group covering ad-hoc searches and the system group covering all searches, while Limits "apply to your whole Cribl.Cloud Workspace."

Getting started

The Quick Start guide takes you to your first log search. Its first step is creating a Cribl.Cloud Organization.

1. Start at the Cribl.Cloud signup page, select the New User? Free signup option, and register with your work email address.
2. Use the verification code from Cribl's email to confirm your registration.
3. On the Create Organization page, optionally enter an Organization Name, a friendly alias for the randomly generated ID that Cribl will assign to your Organization.
4. Select an AWS or Azure Region to host your Cribl.Cloud Leader, then select Create Organization.
5. On the resulting page labeled We're spinning up your Organization..., complete the quick survey that asks how you plan to use Cribl products, then select Complete to access your new Organization.

The goals you select there, and the Sources and Destinations you choose on the next page, "will display personalized guidance as soon as you open your Organization." You open the product itself by selecting the Search tile's Explore button. The first time you sign in, you'll see a tile with a goat who can walk you through setting up Cribl Search. If you skip the walkthrough, you can start it at any later time by opening the Support/Copilot drawer's Get Help tab.

The guide then runs a couple of searches against a built-in sample Dataset named cribl_search_sample. From the Cribl Search sidebar, select Data to open the default Datasets tab, find the Dataset, and select the Search button on its row. The Logs page opens and runs a basic search that references the Dataset with the field dataset and its ID, in this case cribl_search_sample. The pipe | character "indicates a new process for the query to run," and here it adds a limit operator "so the search only returns up to 1,000 events from the Dataset."

Next, the guide runs an aggregating search that counts the number of events per source, a built-in field that contains the name of the data object that included the event:

dataset="cribl_search_sample"
| limit 1000
| summarize count() by source

Aggregate results "are displayed on the Chart tab," and Cribl Search "comes with rich charting options out-of-the-box, allowing you to adjust charts as needed." The guide also notes that runnable Kusto code examples in the docs carry a Run in Cribl Search link in the top-right corner of the code block, and a Copy button for pasting a query into your own search.

What the UI gives you

The UI Tour page annotates the Logs page with 20 numbered areas in three groups: the sidebar (areas 1-12), the query box (areas 13-17), and the Datasets and Searches area (areas 18-20).

The sidebar covers:

• Recents show your latest work: recently visited Dashboards, Notebooks, saved searches, and Packs.
• Logs is where you run log searches.
• Metrics is where you explore, filter, and visualize metrics.
• Monitors watch metric queries and raise alerts.
• History keeps previous log searches so you can reuse them or check cached results.
• Saved Searches let you run queries on schedule and set up Notifications.
• Dashboards visualize log searches and metrics queries in a variety of ways.
• Notebooks let you combine queries, metrics, visualizations, and notes on one tab.
• Data is where Search Admins and Editors manage Engines, Sources, Datasets, Dataset Providers, and Datatypes.
• Knowledge contains your lookups, Parsers, regexes, Grok patterns, and Macros.
• Packs let Search Admins and Editors import, export, and share knowledge objects.
• Settings is where Search Admins set Notification targets, Usage Groups, and limits.

The query box covers:

• The Query Box is where you build your log searches in Kusto Query Language (KQL). Selecting Build Query lets you use natural language instead.
• The gear button changes query box options or opens the KQL reference.
• Run Investigation starts an AI-powered investigation session.
• Sampling reduces the number of results for quick, exploratory searches.
• The Timepicker narrows down your search to a specific time period.

The Datasets and Searches area covers:

• Available Datasets let you inspect your logs before running a search, with Cribl-hosted Log Datasets marked with the lakehouse icon.
• The History tab shows a quick overview of recent log searches.
• Sample Searches help you get started with running queries.

What the docs flag

The strongest note is about the Organization region. The Quick Start's info box says that "Once you select a region when registering your Organization, you cannot change it," and in Cribl Search "the Organization region is the physical location where searches are executed" (in Cribl Lake, the region instead defines where data is stored). The box adds that you can create Cribl-managed Stream Worker Groups in different AWS and Azure regions.

The lighter note is that the goat's walkthrough is not a one-time prompt: if you skip it at first sign-in, "you can start it at any later time by opening the Support/Copilot drawer's Get Help tab, where you'll find the goat."

Frequently asked questions

What is a Cribl Search Lakehouse engine?

A Lakehouse engine is a capacity unit that powers your queries in Cribl Search, and it stores and searches logs and metrics ingested from Cribl Search Sources. The data is structured and stays hot with no tiers to manage, you can add as many lakehouse engines as you need, and you size each one for its ingest rate.

How do I run my first search in Cribl Search?

You create a Cribl.Cloud Organization, open Cribl Search from the Search tile's Explore button, find the built-in sample Dataset cribl_search_sample under Data, and select its Search button. The Logs page then runs a basic search that returns up to 1,000 events, and you can follow it with an aggregating search such as counting events per source.

What are the three groups in the Cribl Search UI tour?

The UI Tour organizes the Logs page into the sidebar (areas 1-12), the query box (areas 13-17), and the Datasets and Searches area (areas 18-20). The sidebar holds Recents, Logs, Metrics, Monitors, History, Saved Searches, Dashboards, Notebooks, Data, Knowledge, Packs, and Settings, while the query box holds the Query Box, the gear button, Run Investigation, Sampling, and the Timepicker.

Can I change my Cribl.Cloud Organization region after registering?

No, once you select a region when registering your Organization, you cannot change it. In Cribl Search the region is the physical location where searches are executed, although you can create Cribl-managed Stream Worker Groups in different AWS and Azure regions.