Syntax

​

Export to Cribl Lake:

Scope | export [ suppressPreviews=Previews ] to [ lake ] LakeDatasetName [ tee=Tee ]

The lake keyword is optional and has no effect.

Export to a lookup:

Scope | export [ mode=Mode ]
               [ description=Description ]
               [ suppressPreviews=Previews ]
               [ fieldMapping=PairsToMap ]
               [ compress=Compress ]
               to lookup LookupName
               [ tee=Tee ]
               [ maxEvents=MaxEvents ]

Arguments

​

Export to a Cribl Lake Dataset

​

• Scope: The events to search.
• Previews: Boolean. If false (default), Cribl Search displays intermediate statistics (previews) during the export operation. If true (so, suppressPreviews=true), you’ll see only the final statistics, once the export operation completes.
• LakeDatasetName: The Cribl Lake Dataset to export results to. You must choose an already existing Dataset.
• Tee: Boolean. If set to true, the search results are shown as usual. If false (which is the default), instead of the results, Cribl Search displays statistics related to the export.

Export to a Lookup

​

• Scope: The events to search.
• Mode: Supports create, overwrite, and append. Defaults to create. If the lookup doesn’t exist, it defaults to create, simplifying scheduled searches. When using append mode, you can include description, fieldMapping, and compress parameters, and if the lookup exists, they are ignored. This streamlines the process of appending data to a lookup as part of scheduled searches, as the table is generated during the first scheduled run and continues to append new content in subsequent runs.
• Description: String. The description to give the lookup.
• Previews: Boolean. If false (default), Cribl Search displays intermediate statistics (previews) during the export operation. If true (so, suppressPreviews=true), you’ll see only the final statistics, once the export operation completes.
• PairsToMap: String. Comma-separated list of sourceName:targetName pairs to map event property names to CSV output names. Defaults to all of the last known list of projected fields.
• Compress: String. Defaults to auto where files larger than 16 KB are compressed. Set as true to compress no matter the size and false to not compress the file.
• LookupName: The lookup file name, without the file extension. For example: a file name of users.csv is entered as users.
• Tee: Boolean. Defaults to false where search results are not shown in Cribl Search. Instead, you get an event with the URL and the number of bytes and events sent or dropped. When true the search results are displayed and no stats are provided. For example: tee=true.
• MaxEvents: The maximum number of events that export will write to the table. Cribl Search will drop any events beyond this limit. Defaults to 10000 (10,000 rows). This is also the maximum number of events that this operator’s lookup mode can handle, so entering a higher MaxEvents still effectively sets a limit of 10000.

Rules

​

• You cannot use create mode on an existing lookup, an error is thrown.
• Arguments are not case-sensitive.

_raw in Exports to Cribl Lake

​

Exports to Cribl Lake Datasets include the _raw field. If you want to remove this field, use the project-away operator.

_time in Exports to Cribl Lake

​

Cribl Lake handles the _time field automatically, so Datatype timestamp settings in Cribl Search don’t apply.

If the source event has no _time field, Cribl Lake adds this field, setting its value to now() at write time.

Examples

​

Export search results to the myDataset Cribl Lake Dataset:

dataset="cribl_search_sample"
| export to lake myDataset

// you can also drop the `lake` keyword
dataset="cribl_search_sample"
| export to myDataset

Export search results to a Cribl Lake Dataset, and remove the _raw field:

dataset="cribl_search_sample"
| export to lake myDataset
| project-away _raw

Create a lookup named mylookup with the time and status fields.

dataset="cribl_search_sample" status="*"
| limit 5
| export description="My lookup" fieldMapping="_time:time,status:status" to lookup mylookup

You can verify the contents of the lookup with this command – replacing mylookup with the name of your own lookup file:

dataset="$vt_lookups" lookupFile="mylookup"

Export a lookup with two columns, method and cnt (identical to the lookup operator example).

dataset=$vt_dummy event<600
| extend _time=_time-rand(600), method=iif(event%2>0, "GET", "POST")
| summarize cnt=count() by method
| export mode=append description="Table with http methods count" to lookup mymethods

To verify that table was exported.

dataset="cribl_lookups" lookup_table=mymethods
| project method, cnt
| render table