Search

This message originated from Cribl Community Slack.Click here to view the original link.I was asked this today and I have absolutely what the answer is - why are some fields shaded with a different color in search?Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.This may have been answered before but I cannot find it. Is there a way in Search if the _time value is visually represented as 2026-05-27 17:11:51.000 and I export to CSV, to keep the time format? I did an export and got the numerical value 1776932840 .

This message originated from Cribl Community Slack.Click here to view the original link.As we had some debate about this today in a Cribl class... how does Search run its workloads? was it Lambda functions in the early times, and nowadays it's... a Stream instance standing on standby for this? Is this a shared instance between different orgs, or a dedicated one? I've read the part about parallel workers and saw their logs (and saw that they log as version 4.18.1, which suggests at least shared codebase with "general" Cribl) - but are there more details? I'm curious :smile:

This message originated from Cribl Community Slack.Click here to view the original link.Is there any way to use Cribl Search with an S3 object that is compressed and password protected?

This message originated from Cribl Community Slack.Click here to view the original link.Should any consideration be given to how often a LHE will be searched when choosing a size? Where does search run? The leader? Instances that are spun up on demand?

This message originated from Cribl Community Slack.Click here to view the original link.I have data that gets processed in STREAM that I want to send to LHE. Do I send it to search, destination or do I send it to something like a HEC destination and then plugin the endpoint that’s provided in the search sources?

This message originated from Cribl Community Slack.Click here to view the original link.can cribl search read splunk frozen buckets that I store in my own S3?

This message originated from Cribl Community Slack.Click here to view the original link.i have some data that is getting processed in stream and I want to send it to search LHE. Will search take the timestamp that has already been created for the event within the pipeline, or do I need to create an additional timestamp config via datatypes?

This message originated from Cribl Community Slack.Click here to view the original link.Hello Team, have a weird issue with a token in a dashboard in Cribl Search. I have a dropdown input that is populated by a search, which is working fine, however it has a value being returned that is Software/Technology I am trying to use the value to filter results in a table in one of the visualizations however I am getting an error because of the / character in the value. The error is Search failed: mismatched input '/' expecting {<EOF>, ';'}; token: /; line: 1 column: 119 is there any way to sanitize the token so that it can just search on the text?

This message originated from Cribl Community Slack.Click here to view the original link.I am considering scheduling a search to return if any IOCs are found from various sources I get e.g. CISA, MSISAC, EDR company, etc. I have a basic lookup: ip,source_desc 5.252.179.169,waterisac 5.252.179.89,waterisac I tried what I thought would work in search and then went to AI to refine it because it was returning my internal IPs not the IPs in the lookup:Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.i have a situation in search/LHE where fields are getting duplicated, and the duplicated ones are prefixed with the phrase “data_“. Anyone ever see that? The datatype that I want is being used.Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone got any strategies for managing alert suppression? Looking at using search as a complete search & alerting platform but worried about alert management

This message originated from Cribl Community Slack.Click here to view the original link.How do you handle masking/redacting in Cribl Search?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a way to do a cumulative sum on log events in Search? Or even with metrics? I'm not seeing anything mentioning cumulative in the stats functions in the docs. I would like to graph at what time a service reached 1,000 total requests, or when a service first had 100 unique clients IPs. I currently only have the events with this data, but if I need to convert these to metrics in Stream and send them over to Search as well I can, I'm just not sure Search supports cumulative queries

This message originated from Cribl Community Slack.Click here to view the original link.can search send data to http listeners, or does it have to go through stream?

This message originated from Cribl Community Slack.Click here to view the original link.Should I be able to click on a column in search table to change the sort on rows?

This message originated from Cribl Community Slack.Click here to view the original link.How can I see concurrency metrics? Almost every dashboard panel is getting queued, but I don't see how many searches are actually being run at once so I dont know how much adjustment to usage groups I need to do

In both the API Reference (with authenticated session) and via Python, I started running into an issue with submitting queries to the POST /search/jobs API to submit a remote query to Cribl Search.Despite the fact that it's a POST endpoint, and I'm using the headers generated by the API Reference, I receive the following error<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot POST /api/v1/search/jobs</pre></body></html>In the API Reference this is the payload I am POST'ing with application/json as the accept and Content-Type - the Auth comes from my session automatically{ "query": "cribl dataset=\"cribl_internal_logs\" | limit 10 "}In Python, I attempted to recreate it as well, I can confirm that the Client ID and Client Secret are valid and I receive a valid token. Here is the relevant portion of that script.def generateBearerToken() -> str: url = "https://

We are wanting to use Cribl to repopulate cloud trail logs from S3 into Splunk on-demand for review/audit/analysis purposes. Ideally, we would be able to request from within Splunk, but we could also query within Cribl to pull the data if necessary. Are there any best practices or use-cases that you can provide?

Hi,Excuse me for my "not knowing", maybe a easy answer for all of you.I am in the process of migrating our Heavy Forwaders to Cribl . One off the inputs is for Cisco IOS devices. The props.conf has a Regex in it to change the sourcetype with help of a transforms. The props uses a regex to select the events.Where and how do i put the regex which is used in the props.conf for filtering the events. Do i have to place this regex in the "filter expresion" in the route? Or in a pre-pipeline? And how do i do it?Thanks in advancegreetingsJari

I'd like to search a CloudTrail S3 bucket. What I want to search is "in all accounts" and only in "US-EAST-2" region for event name:"Assume Role". I'm not sure if I configured the Dataset correctly and/or how to do the search. Regarding the Dataset bucket path. This is the S3 folder layout: AWSLogs/subfolder/<ACCOUNT>/CloudTrail/<REGION>/YYYY/MM/DDIn the Dataset config, i'm not sure what to put in the bucket path. Especially for the <Account> and <Region> parts My guess is something like this AWSLogs/subfolder/${ACCOUNT}/CloudTrail/${REGION}/${_time:%Y}/${_time:%m}/${_time:%d}Regarding search: What I want to search is "in all accounts" and only in "US-EAST-2" region for event name:"Assume Role" When I did: dataset="CloudTrail_DATASET_NAME" | limit 1000 it returns no results. Not sure what I'm missingThanks

How to search ipv4 range through Cribl search. What would be the syntaxI want to know whether we can search fields from raw logs or only parsed fields can be searched?

Dear all,Coming up with yet another question as I couldn't find similar from the history of available requests. I have created the HTTP RAW Source and able to push the data and process it in the pipeline. However, I have observed that when I POST the valid JSON format(all the attributes with double quotes), Cribl http source is parsing them into individual fields after the source process, and if the posted content is not JSON parsable, then the content is available under the key "_raw".As per my requirement, I would like to keep the input JSON object as is, since I was trying to validate the whole json with the schema stored in the Knowledge. If it's not getting parsed then I was able to run my use case as expected. In other case where the JSON is parsed into individual fields, I couldn't find any internal key which holds all these variable to format them back to JSON object to validate against the schema.Hence, reaching out for any suggestions in this. Thanks in advance!NOTE: Would be

I'm attempting to extract values from a JSON string field. However, it seems, that none of the below methods are working for referencing or obtaining the value using a JSON path or dot notation type of approach. I've even tried the "extract_json" function, but to no avail.KQL in Azure has the bag_unpack function, but I noticed this is not supported in Cribl Search.Below are my queries and results.| extend json=parse_json(_raw)| extend test1=_raw._raw.kubernetes.container_name| extend test2=json._raw.kubernetes.container_name| extend test3=json['_raw']['kubernetes']['container_name']| extend test4=extract_json("$._raw.kubernetes.container_name", json, typeof(string))| limit 10

Hello all,I have recently started working with Cribl and my question may seem to be easier one, however, I couldn’t find an option to do this in right way and hence reaching out for help.In one of my use case I am getting a json from source and my requirement is to check whether the attributes in the object are matching with some of the existing Regexes in Crible knowledge section. I was expecting something like below,For ex: To access Schema, we use C.Schema(‘Schema Name’).Validate()In the same way can we do C.Regexes(‘Name of the regex’).test()Please advise on this with any suggestions. Thanks in advance!