Overview
The Cribl Search Migration Service is designed to help organizations transition from their existing analytics or SIEM platforms into a modern, flexible, and cost-efficient Cribl-powered analysis environment. Through a combination of data onboarding, content migration, and enablement, this offering provides a structured and accelerated pathway to adopt Cribl for fast search, AI-guided exploration, and continuous data operations.
Regardless of the current analytics or monitoring platform in use, Cribl experts will partner with your team to plan, configure, and execute the migration steps needed to achieve a smooth and confident transition.
Service Objectives
This service helps you:
Migrate priority dashboards, saved searches, alerts, and reports from an existing analytics platform into Cribl’s modern Search ecosystem.
Set up or enhance data collection, including Cribl Edge, agents, syslog sources, API pulls, and cloud-native inputs.
Evaluate and classify existing data sources for retention policies, RBAC considerations, sensitivity, and lifecycle needs.
Enable you to self-manage future data onboarding and content creation after service completion
How It Works
Migration Planning & Assessment
Cribl consultants work directly with your technical and operational teams to understand your current analytics environment and define the migration path.
Activities typically include:
• Inventory of existing dashboards, saved searches, alerts, and workflows.
• Review of current data sources, retention requirements, access control needs, and ingest patterns.
• Identification and prioritization of must-have content to migrate (e.g., top 10 dashboards, key SEC/IR searches, compliance alerts).
• Mapping existing data to Cribl’s routing, schema, and processing capabilities.Data Collection Setup
We configure or validate configurations:
• Cribl Edge, UF/agents, syslog, API pulls, cloud sources, and other pipelines.
• Data Typing, timestamp handling, metadata enrichment.
• Ensuring architectural alignment with scale, availability, and operational requirements.
Note: Migration of existing agent configuration to Cribl Edge is only included in the largest Service, Platinum.Content Migration & Use Case Enablement
Cribl works with you to migrate priority analytics content:
• Rebuilding equivalent dashboards, searches, alerts, or workflows within Cribl Search.
• Creating new or enhanced use cases using Cribl Search.
• Delivering fully functional searches/dashboards consistent with customer requirements.
• Validating both data and content behavior to ensure accuracy and completeness.Education & Operational Enablement
Finally, we prepare your team for long-term success by teaching them how to:
• Onboard new data sources.
• Maintain and extend searches/dashboards/reports.
• Manage retention, RBAC, and day-to-day operation.
• Apply best practices for architecture and governance.
This ensures you can independently evolve their Cribl Search environment after the engagement.
Service Tier
Ideal for smaller environments or focused migration initiatives.
Up to 10 data sources onboarded.
Up to 30 saved searches migrated.
Up to 5 dashboard migrations.
Introductory enablement for data onboarding and Search usage.
The Silver tier of this service will leverage the data collection capabilities available through Cribl Cloud’s native collection methods, ensuring rapid onboarding and streamlined configuration. This tier is designed to focus on content migration rather than endpoint transformation. As such, conversion of existing agents or collectors to Cribl Edge is not included in this scope. Customers requiring agent replacement, largescale endpoint rollout, or Cribl Edge deployment should consider an expanded tier or an add-on services package.
Delivery & Scheduling
The parties will agree on a start date for the Search Migration & Activation Service no later than one (1) week from Cribl’s acceptance of your purchase order. Sessions will be delivered remotely unless otherwise agreed. A mutually defined schedule will be established during the first meeting to start the Service (“Start Date”)
Service Expiration
The Customer has a period of ninety (90) days starting from the start date for the Search Migration Service to schedule and utilize the Search Migration Service (“Service Period”). Unless approved by Cribl, the Search Migration Service will terminate automatically at the conclusion of the ninety-day period. Any unused portion of the Search Migration Service is non-refundable and non-creditable. Cribl may deliver Search Migration Services after the end of the Service Period if the Customer provides written notice at least thirty (30) days before the end of the Service Period and Cribl agrees to provide Search Migration Services after the end of the Service Period.
Requirements
To ensure delivery of Search Migration as described in this Service Brief, Customer must:
Provide sufficient sample data containing no personal data for the consultant to work offline for Use Case development when applicable
Attend scheduled meetings ranging from one (1) to four (4) hours
Complete prerequisites work prior to scheduled meetings
Bring subject matter experts (SMEs) to meetings to assist with integration of Cribl Products in Customer’s environment
Validate migration content and provide feedback about deployment in a timely manner
Managing all data reconfiguration required to route data into Cribl Search
Terms and conditions
Cribl, or an authorized partner, will provide the services as described in this Service Brief and subject to the applicable Order Form and Subscription Services Agreement, or other applicable agreement in place between Cribl and the Customer.
Out of scope
The following are out of scope items:
Onboarding Data into Cribl Stream or object storage
Performance testing and benchmarking of the platform
Archival data migration
Any services or activities other than those explicitly specified in this Service Brief