Cribl Search^™

Discover, Refine, Display, Export.

Benefits Features Capabilities FAQ Integrations Resources

In a nutshell

Search data in place. Find what matters, when it's needed.

Cribl Search gives you the power to quickly search your data where it is—no need to centralize before you analyze.

With its search-in-place technology, users are empowered to explore and analyze telemetry data that was previously unreachable - directly at its source, across any cloud, even flowing from API endpoints. The power of Cribl Search lies in its strategic approach: locate and then only forward actionable data to your systems of analysis.

Solution brief

Benefits

Provide real-time visibility into data graveyards

Discover, query, retrieve, route, and analyze all the data, logs, metrics, traces, configs, and more that's been buried, ignored, or just forgotten across your enterprise

Investigate data where it lives

Data lakes, Object stores, API endpoints, Host systems, and more - with Search, your data is at your service.

Search any and all telemetry easily

Any data type, storage type, application, even vendor’s system.

Rethink your archiving strategy

Leverage low cost storage, without giving up visibility and instant retrieval, no waiting for data to ‘thaw’.

Route query results to any destination

Store data where you want, retrieve it when you need, and never again have to compromise between cost and time to access.

Reduce storage costs

Leave data in low-cost objects, query and retrieve only when needed.

Features

Why Cribl Search?

Search-In-Place

Agnostic

Federated

Easily find the data you need

Search data in place without first having to move it to specialized storage. Search supports the following types of data resources:

Data Lakes – including Amazon Security Lake, Amazon S3, and compatible.
Object Stores – including Azure Blob Storage and Google Cloud Storage.
Analytics Services and platforms, like Azure Data Explorer, Elasticsearch, Opensearch, Prometheus, Snowflake, Clickhouse, and more.
API Endpoints – including Azure, AWS, Google Workspace, Okta, Zoom, even a Generic HTTP API allowing you to query any HTTP API.
Cribl Stream, Edge, and Lake are fully integrated.

Try Cribl Search — for free!

Capabilities

Feature highlights

Enrich

Easily bring the outside in

Quickly and easily integrate external data to enhance your analysis and gain more insights. Streamline your analysis process by eliminating manual searching for additional data sources to enrich your events.

Use Lookups to enrich your events
Use Joins to merge data coming from different dataset providers

Discover

Look before you leap

Datasets are addressable sets of data you define for querying. This could include a cloud provider like AWS, Azure, or Google, an API endpoint like Okta, Zoom, or Google Workspace, or even Edge node data you can target for a query. Cribl makes it easy to get started:

Click on any dataset and instantly start a search
Target your specific data with our wizard; create new dataset in minutes
History and save options retain previous and common searches

Analyze

Query without the weary

Cribl Search enables administrators with a single search tool to query all their IT and security data, without having to first collect it:

Search for any term, pattern or value/pairs
Search for any data type
Search anywhere you can reach

Visualize

Visualize & shape your data

Filter, summarize, and manipulate how your results are plotted and displayed
Multiple settings to display results by fields, tables, charts, and colorization
Shape results without having to re-execute the search
Export and share data or dashboards

Route

Easily send your query results out for analysis

One step forwarding, no complex configuration
Shape or process results to any format
Route results to any destination

Automate

Scheduled searches collect and analyze your data - automatically

Optimize monitoring and workflows
Send notifications based on the evaluation of search results
Aggregate data over time to compare results and identify anomalies

FAQ

Frequently Asked Questions

Cribl Search helps you search, explore, and analyze telemetry data – logs, instrumentation data, application data, metrics, etc. – in place without first moving it to specialized storage. Search continues to expand accessible resources, currently supporting the following types of data storage providers:

Data Lakes – including Amazon Security Lake, Amazon S3 and compatible.
Object Stores – including the likes of Amazon S3, Azure Blob Storage, Google Cloud Storage and more.
Analytics Services and platforms, like Azure Data Explorer, Elasticsearch, Opensearch, Prometheus and more.
API Endpoints – including Azure, AWS, Google Workspace, Okta, Zoom, and even a Generic HTTP API option allowing you to query any HTTP API.

Cribl Search is based on Kusto Query Language (KQL), which lets you delve into your data to discover patterns, identify anomalies and outliers, and create statistical models.

Yes, there is no requirement to use any other Cribl products. However, Cribl Search helps you search, explore, and analyze telemetry data – logs, instrumentation data, application data, metrics, etc. – in place without first moving it to specialized storage, this capability is further enhanced via Cribl Stream or Lake. By sending Search results to Cribl Streams robust processing engine it can then route, reduce, reformat, enrich, or otherwise structure data intended for any destination. While Cribl Lake automates and optimizes data storage, Search can provide an interface to get to it if needed.

No, Cribl Search is designed to work in parallel with a customer's existing tools. Cribl Search works collaboratively with other vendors' products, allowing the discovery of data via Search and routing results to 3rd party tools for any additional processing required.

Cribl Search follows Cribl’s consumption pricing so you only pay for what you use, or another way only when you search. You start by purchasing a pool of credits, list price of Cribl.Cloud credits are $1 USD per credit and these credits can be used for any Cribl.Cloud product. Cribl Search is priced based on CPU-Hours, when you execute a search CPU resources (executors) are spun up to perform the search and the sum of the total number of CPUs is what you are billed on. Search will draw down on the customer’s pool of Credits at a fixed rate of 1 Credit per CPU-Hour (3600 seconds) of executor time.

For more information on Cribl Lake pricing, visit www.cribl.io/pricing.

Integrations

Streamline workflows

Data Lake

Too much junk in your trunk?

Cribl Search provides default access to Cribl Lake and can easily query data already collected in Amazon S3 (or S3 compatible), Amazon Security Lake, Azure Blob, Google Cloud Storage, and more.

Spend time at the lake