On This Page

Home /Cribl Copilot

Cribl Copilot

Cribl Copilot is a collection of tools and capabilities that use the power of AI to help you streamline your work and maximize your productivity with Cribl products. Cribl Copilot allows you to use ordinary language, or natural language, to get answers to product questions, perform advanced searches, create Pipelines, and more.

Cribl Copilot includes the following features:

  • Chatbot: Answers common question and helps troubleshoot issues in all Cribl products.
  • Copilot Editor: Helps you create and edit data transformation Pipelines.
  • KQL assistant: Translates your natural-language queries into Kusto Query Language (KQL) in Cribl Search.
  • Visualization assistant: Helps you create custom Chart and Dashboard visualizations in Cribl Search.

Enable or Disable Cribl Copilot
​

Users with Owner or Admin Permission can enable or disable Cribl Copilot for all products and features. Enabling and disabling Cribl Copilot applies to all Members in the Organization.

  1. From Settings, select the Global tab, and then select AI Settings.
  2. After carefully reading the privacy policy and applicable terms, select the button to turn Cribl Copilot on or off.
    When Cribl Copilot is turned on, you can enable or disable the ability to create AI-generated Pipelines in Cribl Stream.

You can disable Cribl Copilot programmatically in two ways:

  • In the file $CRIBL_HOME/local/cribl/ai.yml, change the disabled setting to true in the following schema:
   consent:
     id: <GUID>
     accepted: <true/false>
     initialized: <true/false>
   disabled: <true/false>
  • By setting the environment variable DISABLED_AI to true, in either the OS shell environment or when running the Cribl server, with a command like: DISABLED_AI=true ./cribl start

Both of these methods prevent Members from enabling Cribl Copilot via Settings.

Frequently Asked Questions
​

Does Copilot have access to my Organization’s data?

Cribl Copilot does not have access to your Organization’s data, with the following exceptions:

  • Cribl Copilot generates follow-up queries by looking at the last 50 queries (not their results), the current query, and field names from the last-used Dataset.
  • KQL assistant creates KQL queries from natural language by looking at any KQL query present in the search box, and at field names from the 10 last-used Datasets.
  • Visualization assistant looks at your current Dataset to suggest ways to effectively display its data.
  • Pipeline assistant: Requires a single, user-selected sample event to assist in transformation logic.

Does Cribl use my data to train large language models (LLMs)?

No, Cribl does not use user data to train LLMs.

Are the Cribl Copilot features available on-prem?

The following features of Cribl Copilot are available in on-premises deployments of Cribl:

  • Cribl Copilot chatbot
  • Copilot Editor
  • Function assistance for Pipelines
  • Copilot-generated commit messages