In a nutshell
Cribl Search gives you the power to quickly search your data where it is—no need to centralize before you analyze.
With its search-in-place technology, users are empowered to explore and analyze telemetry data that was previously unreachable - directly at its source, across any cloud, even flowing from API endpoints. The power of Cribl Search lies in its strategic approach: locate and then only forward actionable data to your systems of analysis.
Benefits
Discover, query, retrieve, route, and analyze all your data, logs, metrics, traces, configs, and more that's been buried, ignored, or just forgotten across your enterprise.
Data isn’t just in your SIEM—it lives in data lakes, object stores, API endpoints, host systems, and more. Search finds that data anywhere. Use AI to run faster, more collaborative investigations with Notebooks.
Effortlessly store and search massive volumes of ever-changing telemetry data in Cribl Lakehouse. Lakehouse enables real-time, high-performant searching and analytics dashboard generation.
Features
Search data in place without first having to move it to specialized storage. Search supports the following types of data resources:
Data Lakes - including Amazon Security Lake, Amazon S3, and S3 compatible stores.
Object Stores – including Azure Blob Storage and Google Cloud Storage.
Analytics Services and platforms, like Azure Data Explorer, Elasticsearch, Opensearch, Prometheus, Snowflake, Clickhouse, and more.
API Endpoints – including Azure, AWS, Google Workspace, Okta, Zoom, even a Generic HTTP API allowing you to query any HTTP API.
Cribl Stream, Edge, and Lake are fully integrated.
Capabilities

Streamline investigative workflows with Cribl Search:
Run queries without having to move or collect data first
Reach data in any object store, and in any format
Iterate, enrich, collaborate, and share investigative path with Notebooks

Quickly and easily integrate external data to enhance your analysis and gain more insights. Streamline your analysis process by eliminating manual searching for additional data sources to enrich your events.
Use Lookups to enrich your events
Use Joins to merge data coming from different dataset providers

Datasets are addressable sets of data you define for querying. This could include a cloud provider like AWS, Azure, or Google, an API endpoint like Okta, Zoom, or Google Workspace, or even Cribl Edge and Lake data you can target for a query. Cribl makes it easy to get started:
Click on any dataset and instantly start a search
Target your specific data with our wizard; create new dataset in minutes
History and save options retain previous and common searches

Filter, summarize, and manipulate how your results are plotted and displayed
Multiple settings to display results by fields, tables, charts, and colorization
Shape results without having to re-execute the search
Export and share data or dashboards

One-step forwarding, no complex configuration
Shape or process results to any format
Route results to any destination

Optimize monitoring and workflows
Send notifications based on the evaluation of search results
Aggregate data over time to compare results and identify anomalies
Differentiators
Query data where it lives
Free your data! No forced indexing or centralization. Maintain control over where data resides and how it’s managed.
Built for IT and security
Always-accessible data helps teams troubleshoot and investigate faster—without wading through unnecessary data movement or overhead.
Engineered for speed
Low-latency, high-performance query execution means you get answers in seconds. Run fast, efficient searches at scale even with massive datasets.
Adapts to your data strategy
Extract insights from data stored anywhere—hot, warm, or cold. Query across multiple sources in one place for a unified search experience.
FAQ
Integrations

Cribl Search provides default access to Cribl Lake and can easily query data already collected in Amazon S3 (or S3 compatible), Amazon Security Lake, Azure Blob, Google Cloud Storage, and more.

Already using Cribl Stream? Send your Search results for additional processing with a single command
Native Search/Stream Integration right out of the box
Forward Search results to Stream and route to any Destination
Forward Stream pipeline data to Data Lake to be Searched

Already deployed Cribl Edge? Take Cribl Search for a spin.
Native Search support of Edge nodes
Insights with zero data movement
Resources
get started
Try a Sandbox to get your feet wet or jump right in and create a FREE Cribl.Cloud account. Start searching for data answers immediately.
