Get the results of a query out of Cribl Search, so you can reuse them elsewhere.

Highlights ​

• Download results as CSV or NDJSON.
• Use the export operator to write results to Cribl Lake, a Search Dataset, a metrics Dataset, or a lookup.
• Use the send operator to forward results to Cribl Stream or any endpoint that accepts NDJSON over HTTP.

Cribl Search Export Methods ​

Pick a method based on where the results need to go and how much data you’re moving.

These methods cover everyday exports of reasonable data volumes. For a large-scale data migration, contact your Cribl account team.

Download Search Results ​

You can download the results of any search as a CSV or NDJSON file.

1. Run a search.
2. At the bottom right of the query box, select Actions.
3. Select Export, then either Export Results as CSV or Export Results as NDJSON.

Notebooks let you download the result sets of individual cells. See Export Notebook Search Results.

Export to Search Datasets ​

Use the export operator with the search keyword to write results to an existing Search Dataset hosted on a Cribl-managed lakehouse engine. Remember that you need to create the Search Dataset first.

dataset="cribl_search_sample"
| export to search mySearchDataset

For the full syntax and requirements, see Export to a Cribl Search Dataset.

Export to Metrics ​

Preview Feature ​

Cribl is still developing this Preview feature. We don’t recommend using it in a production environment, because the feature might not be fully tested or optimized for performance, and related documentation could be incomplete.

Please continue to submit feedback through normal Cribl support channels, but assistance might be limited while the feature remains in Preview.

Use the export operator with the metrics keyword to store aggregated search results as metrics. This is how you turn summarized logs into metrics in Cribl Search, so later queries and dashboards can read metrics instead of re-scanning raw events.

dataset="my_logs"
| where status >= 500
| summarize value=count() by _time=bin(_time, 1m), service, status
| extend name="http_errors_total", type="counter"
| export to metrics
    timeField=_time
    nameField=name
    valueField=value
    typeField=type
    labelFields=[service, status]

Keep the following in mind:

• Summarize first, then export. This is a Search query path (ad hoc or scheduled), not a continuous stream transform.
• Defaults write to the metrics Dataset and look for fields named name, value, and type. To target another lakehouse engine, export to that engine’s auto-provisioned Dataset (metrics_<engine_id>).
• Set counters and gauges with typeField. Use type=histogram on export for histograms.
• If you aggregate with bin, assign the result back to _time (for example _time=bin(_time, 1m)) so the column name stays _time. If you omit timeField, export uses _time when present, otherwise it generates a timestamp with now(). If you set timeField and that timestamp is missing or invalid, export drops the data. Supported timestamp inputs include epoch seconds through nanoseconds, ISO-style and Search-style datetime strings, JavaScript Date values, and structured timestamp objects.
• Leave tee at the default (false) and check the export statistics: events sent should be greater than zero, and events dropped should be zero. That means the events were shaped correctly.
• Export to metrics requires metrics export permission, or Maintainer access on the target metrics Dataset.

For full syntax, metric types, and more examples, see Export to a metrics Dataset.

Export to a Lookup ​

Use the export operator with the lookup keyword to save results as a lookup table, so you can reuse them to enrich later searches.

dataset="cribl_search_sample"
| export to lookup myLookup

Keep the following in mind:

• Only Search Admins and Editors can run the export operator.
• export writes at most 10,000 rows to a lookup. It drops any events beyond that, and raising maxEvents doesn’t lift the cap.
• The default create mode fails if the lookup already exists. Use overwrite or append mode to update one.
• You can’t create or update Pack lookups with export.

For the full syntax, modes, and arguments, see Export to a lookup.

Export to Cribl Lake ​

Use the export operator to write search results to an existing Cribl Lake Dataset for long-term, searchable storage in an open format.

dataset="cribl_search_sample"
| export to lake myDataset

Keep the following in mind:

• Only Search Admins and Editors can run the export operator.
• You need to create the Lake Dataset before you export to it.
• The Dataset’s format (JSON, Parquet, or DDSS) is set on the Dataset, not by your search.
• Exports to Lake include the _raw field. To drop it, append project-away _raw.
• Cribl Lake handles _time automatically. If an event has no _time, Lake sets it at write time.

For the full syntax, arguments, and more examples, see the export operator reference.

Send to Cribl Stream ​

Use the send operator to forward search results to Cribl Stream, where you can transform, route, and relay them to any destination Stream supports.

dataset="cribl_search_sample"
| send

By default, send forwards results to the Cribl HTTP Source on the default Worker Group in the same Workspace, with no extra ingest charges. Search Editors and Admins can also send to a named Worker Group.

For the full syntax, permissions, and more examples, see the send operator reference.

Send to a Custom URL ​

Search Admins (or higher) can use the send operator with a URL argument to send results directly to any endpoint that accepts a POST request with NDJSON content.

dataset="cribl_search_sample"
| send "https://example.com/events"

Keep the following in mind:

• The send operator sets the Content-Type: application/x-ndjson header.
• You can’t use a custom URL together with the group argument. Ingest charges might apply when you send outside the Cribl HTTP scenario described in Send to Cribl Stream.
• Ingest charges might apply when you send outside the Cribl HTTP scenario described in Send to Cribl Stream.

For the full syntax, permissions, and more examples, see the send operator reference.