Get the results of a query out of Cribl Search, so you can reuse them elsewhere.

Highlights ​

• Download results as CSV or NDJSON.
• Use the export operator to write results to Cribl Lake, a Search Dataset, or a lookup.
• Use the send operator to forward results to Cribl Stream or any endpoint that accepts NDJSON over HTTP.

Cribl Search Export Methods ​

Pick a method based on where the results need to go and how much data you’re moving.

These methods cover everyday exports of reasonable data volumes. For a large-scale data migration, contact your Cribl account team.

Download Search Results ​

You can download the results of any search as a CSV or NDJSON file.

1. Run a search.
2. At the bottom right of the query box, select Actions.
3. Select Export, then either Export Results as CSV or Export Results as NDJSON.

Notebooks let you download the result sets of individual cells. See Export Notebook Search Results.

Export to Search Datasets ​

Use the export operator with the search keyword to write results to an existing Search Dataset hosted on a Cribl-managed lakehouse engine. Remember that you need to create the Search Dataset first.

dataset="cribl_search_sample"
| export to search mySearchDataset

For the full syntax and requirements, see Export to a Cribl Search Dataset.

Export to a Lookup ​

Use the export operator with the lookup keyword to save results as a lookup table, so you can reuse them to enrich later searches.

dataset="cribl_search_sample"
| export to lookup myLookup

Keep the following in mind:

• Only Search Admins and Editors can run the export operator.
• export writes at most 10,000 rows to a lookup. It drops any events beyond that, and raising maxEvents doesn’t lift the cap.
• The default create mode fails if the lookup already exists. Use overwrite or append mode to update one.
• You can’t create or update Pack lookups with export.

For the full syntax, modes, and arguments, see Export to a lookup.

Export to Cribl Lake ​

Use the export operator to write search results to an existing Cribl Lake Dataset for long-term, searchable storage in an open format.

dataset="cribl_search_sample"
| export to lake myDataset

Keep the following in mind:

• Only Search Admins and Editors can run the export operator.
• You need to create the Lake Dataset before you export to it.
• The Dataset’s format (JSON, Parquet, or DDSS) is set on the Dataset, not by your search.
• Exports to Lake include the _raw field. To drop it, append project-away _raw.
• Cribl Lake handles _time automatically. If an event has no _time, Lake sets it at write time.

For the full syntax, arguments, and more examples, see the export operator reference.

Send to Cribl Stream ​

Use the send operator to forward search results to Cribl Stream, where you can transform, route, and relay them to any destination Stream supports.

dataset="cribl_search_sample"
| send

By default, send forwards results to the Cribl HTTP Source on the default Worker Group in the same Workspace, with no extra ingest charges. Search Editors and Admins can also send to a named Worker Group.

For the full syntax, permissions, and more examples, see the send operator reference.

Send to a Custom URL ​

Search Admins (or higher) can use the send operator with a URL argument to send results directly to any endpoint that accepts a POST request with NDJSON content.

dataset="cribl_search_sample"
| send "https://example.com/events"

Keep the following in mind:

• The send operator sets the Content-Type: application/x-ndjson header.
• You can’t use a custom URL together with the group argument. Ingest charges might apply when you send outside the Cribl HTTP scenario described in Send to Cribl Stream.
• Ingest charges might apply when you send outside the Cribl HTTP scenario described in Send to Cribl Stream.

For the full syntax, permissions, and more examples, see the send operator reference.