Set up a lakehouse engine so you can ingest data directly into Cribl Search, enabling fast searches and AI workflows.

Highlights

​

• Lakehouse engines host and accelerate your data for fast, schema-aware searches.
• Choose an engine tier that covers your daily ingest. Resize or add more engines as needed.
• Storage auto-scales with your data volume and retention settings.

Lakehouse Engines Host Data for Fast, AI-Native Search

​

A Lakehouse engine is a storage-plus-compute unit that ingests, stores, and accelerates your data inside Cribl Search. Use them for:

• High-speed search: Run queries much faster than federated searches.
• Data exploration: Inspect your Datasets before searching them.
• AI workflows: Run investigations with deep context derived from full schema discovery.

You don’t have to use Cribl Stream, Edge, or Lake. You can ingest your data directly into Cribl Search.

How a Lakehouse Engine Works

​

A lakehouse engine handles most of the work automatically, with a human-in-the-loop approach:

1. Ingests data from one or more supported Sources.
2. Recognizes, parses, and structures the data (we call it “Datatyping”).
3. Organizes the data into Search Datasets.
4. Drops expired data when its retention period is up.

Choose Engine Size by Daily Raw Ingest

​

Start with the amount of raw, uncompressed data you expect per day, then include headroom for spikes and growth.

If your ingest rate changes, or you experience ingest or search latency, you can resize your lakehouse engine. If the available sizes are not enough, you can add more lakehouse engines to distribute the workload.

Lakehouse Engine Sizes Available

​

The ingest rate limit applies only to raw incoming data, not to fields you add or transform during processing.

Estimate Lakehouse Engine Costs

​

Because engine size acts as a hard limit on ingest, your costs are bounded, with no surprises from traffic spikes. You can scale your lakehouse engine up or down at any time to match your actual data needs.

With each lakehouse engine, you’re charged for two things:

To estimate and optimize storage, set individual retention periods of your Search Datasets. See Plan Your Search Datasets for details.

To see how engine size and storage translate to costs, see Cribl Search Pricing.

Add a New Lakehouse Engine

​

Search Admins and above can add lakehouse engines from the Cribl Search Engines tab.

1. On the Cribl.Clud top bar, select Products > Search > Data.
2. Select the Engines tab, then Add Engine.
3. Give your engine an ID (for example, palo_alto_logs) unique across your Workspace. You won’t be able to change it later.

   The main ID is reserved.

4. Set the Lakehouse engine Size. You can resize it later if needed.

   See What Lakehouse Engine Size to Choose.

5. Confirm with Save.

When the lakehouse engine status is Ready, you can start connecting your Sources.

Check Lakehouse Engine Status

​

Select Refresh page to check for status updates.

Resize a Lakehouse Engine

​

Search Admins and above can resize lakehouse engines from the Cribl Search Engines tab.

1. On the Cribl.Cloud top bar, select Products > Search > Data > Engines.
2. Select the lakehouse engine you want to resize.
3. Set the new lakehouse engine Size. See What lakehouse engine Size to Choose.
4. Confirm with Save.

Wait until the lakehouse engine status changes from Resizing to Ready again.