cribl

The cribl operator finds specific events. It is the fundamental Cribl Search operator, and is implicit in queries that do not specify an operator.

Syntax

​

[cribl] StringExpression ComparisonExpression [ BooleanOperator ] [ StringExpression | ComparisonExpression ]

Either a StringExpression or a ComparisonExpression is required.

Rules

​

• cribl is implicit. You don’t need to specify it in a query.
• But to use cribl in a subquery, you must specify it.
• cribl, like find, can be used to initiate a query expression.
• cribl doesn’t support functions (or any kind of expressions). For this, you need to use the where operator.
• Wildcards * represent zero or more characters.
• An escaped \* represents a literal asterisk.
• cribl doesn’t support including both a wildcard * and a literal \* in the same query. To perform this type of search, you need to use the where operator.
• cribl interprets both the == and = tokens as comparison (not assignment) operators.
• cribl implicitly matches against the _raw field if you specify no field; otherwise, it matches against an extracted field.

Arguments

​

The cribl operator accepts a flexible range of arguments.

StringExpression

​

Case-insensitive string of characters. For example, "error" or error. To see if you can omit the double quotes "", see Quotes in cribl Operator. Either a StringExpression or a ComparisonExpression is required.

BooleanOperator

​

not, or, and, in that order of precedence. This order differs from other operators. Use parentheses () to override this precedence.

Here, whitespace is equivalent to and. For example, foo and bar is the same as foo bar.

ComparisonExpression

​

Compare numbers, strings, and/or regular expressions; perform evaluations that evaluate to a boolean. Either a ComparisonExpression or a StringExpression is required.

Syntax: Key ComparisonOperator Value or Key in (ListOfValues) or TimeExpression

We break down these parameters below.

Key

​

This is a field name.

Comparison Operators in cribl

​

Formal comparison operators are =, ==, =~, !=, !==, >, >=, <, <=, =~, and !~. (For comparisons against regex literals, we support only the ==, =~, !=, and !~ operators.) See also String Operators below.

String Operators in cribl

​

The ComparisonOperator parameter also supports the following string operators.

Value

​

This is a StringExpression.

• in: in (or !in, or in~, or !in~) filters events with ListOfValues.

ListOfValues

​

This is a comma-separated list of one or more StringExpressions. For example:
(StringExpression, StringExpression, ...)

TimeExpression

​

Relative or absolute time range. Syntax: earliest=TimeString and/or latest=TimeString. earliest is inclusive >=, while latest is exclusive <. The limit of earliest is 90 days (7776000 seconds) ago. See time syntax for details.

RegularExpression

​

Regex literal. Syntax: /<regular expression>/<flags>. For syntax details, see Regex Examples, Regex Flags, and Disambiguating Regex Characters.

ComparisonExpression Examples

​

• foo=bar, foo23.4, bar42, foo!=bar*
• level in (INFO, DEBUG, ERROR)
• method in ("GET", "POST")
• earliest=-1h, latest=-42m, earliest=-42m@h latest=now, earliest=-2h@m latest=+2h@m, earliest=1700511360.123 latest=1700511420.123
• method == /ge*/i
• method =~ /ge*|p.*t/i
• method in ("GET", /^po.*/i)

(In the final example above, note that your ComparisonExpression can mix string and regex target values.)

Quotes in cribl Operator

​

You don’t need to enclose your StringExpression in double quotes "", as long as it’s made of the following characters only:

• a-z
• A-Z
• 0-9
• $ _ * . -

If your StringExpression contains any other character, you do need to enclose it in double quotes "", for example:

Cribl Search keywords, such as operator or function names, don’t need double quotes. The only the exceptions are dataset, earliest, and latest.

To escape double quotes, use the backslash \, for example: "style=\"goatee\""

Time Syntax

​

The TimeString used for earliest and latest can be one of the following:

• A relative timestamp, expressed in the human-readable format described below. For example, earliest=-3h.
• An absolute timestamp, expressed in Unix time. For example, earliest=1729290112.

For relative timestamps, use the following syntax:

[+|-]TimeNumberTimeUnit[@SnapToTimeUnit]

For absolute timestamps, use the following syntax:

TimeNumber

SnapToTimeUnit Syntax

​

The @ snap modifier always rounds down (backwards) from any specified time. This is true even in relative time expressions with + (future) offsets. For example:

• @d snaps back to the beginning of today, 12:00 AM (midnight).

• +128m@h looks forward 128 minutes, then snaps back to the nearest round hour. (If you specified this in the Latest field, and ran the Collector at 4:20 PM, collection would end at 6:00 PM. The expression would look forward to 6:28 PM, but snap back to 6:00 PM.)

Other options:

• @w or @w7 to snap back to the beginning of the week – defined here as the preceding Sunday.
• To snap back to other days of a week, use w1 (Monday) through w6 (Saturday).
• @mon to snap back to the 1st of a month.
• @q to snap back to the beginning of the most recent quarter – Jan. 1, Apr. 1, Jul. 1, or Oct. 1.
• @y to snap back to Jan. 1.

Examples

​

Simple term search over all events in the default Dataset:

"goats"

Looking only for records that match both terms:

"goats" and ("climb" or "rock climb")

Looking in the network field for “sector7”:

network in ("sector7")

Looking in the region field for values that start with us-:

region in (us-*)

Restricting the search to certain fields:

disk="f9" or process="index"

Specific time limit:

earliest=-2h@h latest=-1h@min

Searching Datasets that start with foo for specific terms and field values within a specified time range:

dataset=foo* (blocked or "access denied") method in (POST, GET) az !in (us-east*, us-west-2) host!=local* earliest=-2h@h latest=-1h@min

Return results that match “test event”.

dataset=$vt_dummy event<10
| extend _raw=iif(event%2>0, "This is a test event", "This is another event")
| cribl "test event"