The export operator does one of the following:

• Sends results generated by a search to an existing Cribl Lake Dataset. (You must create the Dataset first.)
• Sends results generated by a search to an existing Search Dataset. (You must create the Search Dataset first.)
• Writes aggregated search results to a metrics Dataset (logs to metrics).
• Creates or updates a lookup from search results.

Only Admin and Editor Search Members can run the export operator. See also specific limitations on exporting to Lake Datasets, to Search Datasets, to metrics Datasets, and to lookups.

Syntax ​

The export operator supports four destination keywords: lake, search, metrics, and lookup. Specify one keyword after to to pick the destination type.

If you don’t specify a keyword, export tries to write to a Cribl Lake Dataset, not to a Search Dataset or a metrics Dataset. To export to a Search Dataset, a metrics Dataset, or a lookup, you must use the search, metrics, or lookup keyword explicitly.

Export to Cribl Lake:

Scope | export [ suppressPreviews=Previews ] to [ lake ] LakeDatasetName [ tee=Tee ]

Export to a Search Dataset:

Scope | export [ suppressPreviews=Previews ] to search SearchDatasetID [ tee=Tee ]

Export to a metrics Dataset:

Scope | export [ suppressPreviews=Previews ] to metrics [ MetricsDatasetID ]
               [ tee=Tee ]
               [ nameField=NameField ]
               [ valueField=ValueField ]
               [ typeField=TypeField ]
               [ timeField=TimeField ]
               [ type=histogram ]
               [ labelFields=LabelFields ]

Export to a lookup:

Scope | export [ mode=Mode ]
               [ description=Description ]
               [ suppressPreviews=Previews ]
               [ fieldMapping=PairsToMap ]
               [ compress=Compress ]
               to lookup LookupName
               [ tee=Tee ]
               [ maxEvents=MaxEvents ]

Arguments ​

Arguments are case-insensitive.

lake: Export to a Cribl Lake Dataset ​

• Scope: The events to search.
• Previews: Boolean. If false (default), Cribl Search displays intermediate statistics (previews) during the export operation. If true (so, suppressPreviews=true), you’ll see only the final statistics, once the export operation completes.
• LakeDatasetName: The Cribl Lake Dataset to export results to. You must choose an already existing Dataset.
• Tee: Boolean. If set to true, the search results are shown as usual. If false (which is the default), instead of the results, Cribl Search displays statistics related to the export.

Dataset Limitations ​

Typically, you’re exporting data in which Cribl Search has already parsed field names and values. This makes the data compatible with Lakehouses. However, if you happen to send unparsed data, you won’t be able to search it at Lakehouse speed.

The export operator can’t send data to a Cribl Lake Dataset that is populated via Splunk Cloud Direct Access.

search: Export to a Cribl Search Dataset ​

This option exports results to a Search Dataset hosted on a Cribl-managed lakehouse engine.

• Scope: The events to search.
• Previews: Boolean. If false (default), Cribl Search displays intermediate statistics (previews) during the export operation. If true (so, suppressPreviews=true), you’ll see only the final statistics, once the export operation completes.
• SearchDatasetID: The ID of an existing Search Dataset to export results to. The Dataset must be hosted on a lakehouse engine that is in Ready status.
• Tee: Boolean. If set to true, the search results are shown as usual. If false (which is the default), instead of the results, Cribl Search displays statistics related to the export.

metrics: Export to a Metrics Dataset ​

Preview Feature ​

Cribl is still developing this Preview feature. We don’t recommend using it in a production environment, because the feature might not be fully tested or optimized for performance, and related documentation could be incomplete.

Please continue to submit feedback through normal Cribl support channels, but assistance might be limited while the feature remains in Preview.

Use export to metrics to turn aggregated search results into stored metrics. Typically, you start by filtering logs, summarizing them with operators such as summarize and bin, shaping name/value/type fields, and then exporting. This is a Search query path (ad hoc or scheduled), not a continuous stream-based logs-to-metrics pipeline.

• Scope: The events to search. Each result that you export should already look like a metric sample (name, numeric value, optional type, optional labels, and optional timestamp).
• Previews: Boolean. If false (default), Cribl Search displays intermediate statistics (previews) during the export operation. If true (so, suppressPreviews=true), you’ll see only the final statistics, once the export operation completes.
• MetricsDatasetID: Optional ID of the metrics Dataset to write to. Defaults to metrics. Cribl Search auto-provisions a metrics Dataset for each lakehouse engine: the first engine’s Dataset is named metrics, and each additional engine gets metrics_<engine_id>. See Review the Metrics Dataset.
• Tee: Boolean. If set to true, the search results are shown as usual. If false (which is the default), instead of the results, Cribl Search displays statistics related to the export (including events sent and events dropped). Use those stats to confirm the input shape: more than zero events sent and zero events dropped means the events were shaped correctly. Export is strict about the expected fields and values.
• NameField: Field that holds the metric name. Defaults to name. Empty or missing names are dropped.
• ValueField: Field that holds the numeric metric value. Defaults to value. Values must be finite numbers. Non-numeric or non-finite values are dropped.
• TypeField: Field that holds the scalar metric type for counter/gauge export. Defaults to type. Accepted values are default, counter, and gauge (case-insensitive). If the field is missing or empty, Cribl Search uses default. Other values are dropped. Ignored when type=histogram.
• TimeField: Field that holds the metric timestamp. Optional. If you set timeField and the operator can’t find or coerce that timestamp, the event is dropped. If you omit timeField, Cribl Search looks for _time on each event. If _time is also missing, it generates a timestamp at insertion time with now() as a Unix epoch millisecond value. For scalar export, each row gets its own generated timestamp. For histogram export, observations in the same flush batch share one generated timestamp. Supported inputs include epoch seconds, milliseconds, microseconds, and nanoseconds, ISO-style and Search-style datetime strings, JavaScript Date values, and structured timestamp objects.
• Type: Literal export type. The only accepted value is histogram. Use type=histogram for histogram export. When type=histogram is set, histogram mode takes precedence over typeField. Literal type=counter and type=gauge are not supported - set those types with typeField instead.
• LabelFields: Metric labels (dimensions). Pass a list of fields (labelFields=[host, service, status]) or a single object field whose keys become label names (labelFields=labels). In object mode, the field must be a flat object with no nested objects - for example {pod_name: "api-1", _123zone: "us-west-2"}. Label values are stringified. Null values and nested object values are dropped. Nested paths and quoted field names are supported in list mode (for example service.name, ["weird field"]). Wildcard field selectors are not supported. Label names are normalized for metric storage: characters outside a-z, A-Z, 0-9, and _ become _, and names that don’t start with a letter or _ get a leading _.

Metrics Limitations ​

• Export to metrics requires metrics export permission, or Maintainer access on the target metrics Dataset.
• Destination Datasets are the auto-provisioned metrics Datasets on a lakehouse engine (metrics or metrics_<engine_id>).
• For counters and gauges, set the type with typeField. Use the type= argument only for histogram.
• Invalid events are dropped during export. When tee=false, check export statistics for events sent and events dropped. Drop reasons can include missing_name, invalid_value, invalid_type, and invalid_timestamp.
• When you bin by time, assign the binned value back to _time (for example _time=bin(_time, 1m)). A bare bin(_time, ...) renames the column. If you set timeField and that timestamp is missing or invalid, export drops the data. If you omit timeField, export uses _time when present, otherwise it generates a timestamp with now().
• Metrics field parameters (nameField, valueField, typeField, timeField, type, labelFields) apply only to export to metrics. They are rejected on lake, search, and lookup exports.

Metric Types for Export ​

• Scalar (default path): One ingest row per event. Use for counts and gauges. Set the type with typeField (default, counter, or gauge).
• Histogram (type=histogram): Each input event is one numeric sample. Cribl Search groups samples that share the same name, timestamp, and labels, then assembles a native histogram. Pass many sample rows (same name/labels/time, different values) rather than pre-built histogram buckets.

Logs to Metrics Pattern ​

1. Run a search against a log Dataset.
2. Filter and summarize (for example, errors per minute per service).
3. Shape fields so each result has a metric name, a numeric value, and optional type and labels.
4. Pipe to | export to metrics with field mappings. If you used time binning, assign it as _time=bin(_time, ...) so export can find _time. To use a different timestamp field, set timeField to that field.
5. Run the search and check the export statistics: events sent should be greater than zero, and events dropped should be zero.
6. Save and schedule the search if you want metrics to keep updating.

lookup: Export to a Lookup ​

• Scope: The events to search.
• Mode: Supports create, overwrite, and append. Defaults to create. If the lookup doesn’t exist, it defaults to create, simplifying scheduled searches. When using append mode, you can include description, fieldMapping, and compress parameters, and if the lookup exists, they are ignored. This streamlines the process of appending data to a lookup as part of scheduled searches, as the table is generated during the first scheduled run and continues to append new content in subsequent runs.
• Description: String. The description to give the lookup.
• Previews: Boolean. If false (default), Cribl Search displays intermediate statistics (previews) during the export operation. If true (so, suppressPreviews=true), you’ll see only the final statistics, once the export operation completes.
• PairsToMap: String. Comma-separated list of sourceName:targetName pairs to map event property names to CSV output names. Defaults to all of the last known list of projected fields.
• Compress: String. Defaults to auto where files larger than 16 KB are compressed. Set as true to compress no matter the size and false to not compress the file.
• LookupName: The lookup file name, without the file extension. For example: a file name of users.csv is entered as users.
• Tee: Boolean. Defaults to false where search results are not shown in Cribl Search. Instead, you get an event with the URL and the number of bytes and events sent or dropped. When true the search results are displayed and no stats are provided. For example: tee=true.
• MaxEvents: The maximum number of events that export will write to the table. Cribl Search will drop any events beyond this limit. Defaults to 10000 (10,000 rows). This is also the maximum number of events that this operator’s lookup mode can handle, so entering a higher MaxEvents still effectively sets a limit of 10000.

Lookup Limitations ​

You can’t use the create mode on an existing lookup. This will trigger an error.

You can’t use the export operator to create or update Pack lookups. For example,
| export to lookup pack(packId).lookupId will not work.

_raw in Exports to Cribl Lake ​

Exports to Lake Datasets include the _raw field. If you want to remove this field, use the project-away operator.

_time in Exports to Cribl Lake ​

Cribl Lake handles the _time field automatically, so Datatype timestamp settings in Cribl Search don’t apply.

If the source event has no _time field, Cribl Lake adds this field, setting its value to now() at write time.

Examples ​

Export search results to the myDataset Lake Dataset:

dataset="cribl_search_sample"
| export to lake myDataset

// you can also drop the `lake` keyword
dataset="cribl_search_sample"
| export to myDataset

Export search results to a Lake Dataset, and remove the _raw field:

dataset="cribl_search_sample"
| export to lake myDataset
| project-away _raw

Export search results to the mySearchDataset Search Dataset:

dataset="cribl_search_sample"
| export to search mySearchDataset

Count log levels and export them as metrics (uses default name, value, and destination Dataset metrics):

dataset="cribl_internal_logs" level!=null
| summarize value=count() by level
| project name="log_level_count", level, value
| export to metrics labelFields=[level]

Export HTTP 5xx errors per minute as a counter metric:

A bare bin(_time, ...) in summarize renames the _time column. Preserve the name with _time=bin(_time, 1m) so export can find _time (or set timeField to your timestamp field). Otherwise, if you set timeField=_time and the column is missing, export drops the events.

dataset="my_logs"
| where status >= 500
| summarize value=count() by _time=bin(_time, 1m), service, status
| extend name="http_errors_total", type="counter"
| export to metrics
    timeField=_time
    nameField=name
    valueField=value
    typeField=type
    labelFields=[service, status]

Export to a non-default metrics Dataset on another lakehouse engine:

dataset="my_logs"
| summarize value=count() by _time=bin(_time, 1m), service
| extend name="requests_total", type="counter"
| export to metrics metrics_my_engine
    timeField=_time
    labelFields=[service]

Export request duration samples as a histogram:

dataset="my_logs"
| where isnotnull(duration_ms)
| project _time, service, value=duration_ms
| extend name="http_request_duration_ms"
| export to metrics
    type=histogram
    timeField=_time
    nameField=name
    valueField=value
    labelFields=[service]

Create a lookup named mylookup with the time and status fields.

dataset="cribl_search_sample" status="*"
| limit 5
| export description="My lookup" fieldMapping="_time:time,status:status" to lookup mylookup

You can verify the contents of the lookup with this command - replacing mylookup with the name of your own lookup file:

dataset="$vt_lookups" lookupFile="mylookup"

Export a lookup with two columns, method and cnt.

dataset=$vt_dummy event<600
| extend _time=_time-rand(600), method=iif(event%2>0, "GET", "POST")
| summarize cnt=count() by method
| export mode=append description="Table with http methods count" to lookup mymethods

To verify that table was exported.

dataset="cribl_lookups" lookup_table=mymethods
| project method, cnt
| render table

Enrich exported results with context about the search that produced them. Using jobID(), user(), and query() adds a provenance trail that lets you distinguish between different result sets in Lake and trace each record back to the search that created it:

dataset=myDataset
| extend search_id=jobID(), run_by=user(), source_query=query()
| export to lake myEnrichedDataset