Welcome!
Welcome! Thanks for taking the time to explore how Cribl Notebooks can transform the way you handle incident investigations and runbooks.
We’re going to assume you're already familiar with Crib and how we help teams control their telemetry data across its entire lifecycle. If you're new to Cribl, we'd recommend checking out “The Suite Life of Cribl.Cloud” first to understand how our Data Engine for IT and Security gives you complete control over your observability data. Then come back here to see Notebooks in action.
In this walkthrough, we'll show you how Cribl Notebooks turns static runbooks into interactive investigation tools. You'll see how to:
- Document your incident scenarios with context
- Avoid tool switching and query your telemetry data directly
- Visualize results and spot patterns faster
- Collaborate with your team in real-time
- Turn investigations into reusable runbooks
By the end, you'll understand how Notebooks help you maximize uptime and minimize chaos by giving you total control over your telemetry data during the moments that matter most.
You an SRE? Yeah you know me!
As an SRE, you know the drill: incidents happen, and when they do, you need answers fast. But searching across multiple tools, correlating logs from different sources, and trying to remember where that one metric lives? That's time you don't have during an outage.
What if your runbook could be interactive—allowing you to query your data, collaborate with your team, and document your investigation all in one place? That's exactly what Cribl Notebooks delivers.
The Trouble with Traditional Runbooks
Traditional runbooks are static. They tell you what to check, but you still have to jump between tools to actually get answers. By the time you've logged into three different platforms and correlated the data manually, precious minutes have ticked by.
And when the incident is over? Updating that runbook is often an afterthought, which means next time around, you're working with outdated information.
Notebooks for life
Cribl Notebooks transforms your runbook from a static document into a living, interactive investigation tool. It combines documentation, queries, and collaboration in a single interface—giving you total control over your telemetry and accelerating your path to resolution.
Think of it as your command center for incident response and troubleshooting.
(The pages in this demo scroll btw J)
OUR Runbook, comrade.
Every good runbook starts with context. In Cribl Notebooks, you can document your scenario using markdown. Describe the alert, the symptoms, and what you're investigating. This isn't just for you; it's for your team and for future incidents. You're building institutional knowledge as you troubleshoot.
Query Data, Directly
Querying at speed of thought is where Notebooks really shine. Instead of telling someone to "check the application logs in out system of analysis," you can embed the actual query right in your runbook. Execute it with one click and see results immediately.
Whether you're searching logs in Cribl Lake, querying metrics, or analyzing traces, your data is right here—no context switching required.
Visualize Results Inline
Results aren't just dumped as text—Notebooks helps you visualize what matters. See error rates trending up? Graph it. Need to spot anomalies in response times? Chart it right here.
Your investigation becomes visual, making patterns obvious and root cause analysis faster.
There's No I in Notebook
Incidents aren't solo missions. Cribl Notebooks breaks down silos by enabling real-time collaboration. Share your notebook with teammates, add comments, and build on each other's work. Developers, infrastructure teams, and SREs all working from the same source of truth.
No more "what did you find?" Slack threads. The investigation *is* the documentation.
(Again, these pages scroll. You can look to see other queries run by other team members)
Iterate. Refine. Runbook.
As you investigate, your runbook evolves. Try different queries, refine your filters, add new data sources. Notebooks capture every step. When you solve the issue, you've also documented the exact path to resolution.
That's valuable for post-mortems, onboarding new team members, and handling similar incidents in the future.
From Outage to Runbook
Once your incident is resolved, your Notebook becomes your runbook. Save it as a template, share it with the team, and reference it next time. Unlike static documents, these runbooks stay connected to your live data. They are always relevant, continually actionable.
This is how you reduce toil and build reliability at scale.
Notebooks or Nothing
Cribl Notebooks aren't just a nice-to-have, their part of Cribl's complete telemetry data control plane. Combined with Cribl Lake for cost-effective storage, Cribl Stream for real-time data routing, even Cribl Edge for data collection, you get complete visibility without trade-offs.
You control your data. You choose your tools. And you get better outcomes: faster troubleshooting, lower costs, and happier SREs.
Feel free to shedule a demo or try cribl by clicking on either.
Schedule a demoTry Cribl