Use Cribl Search with Grafana

Visualize your search results in Grafana, using the official Cribl Search plugin.

In addition to the Charts and Dashboards included in Cribl Search, you might want to present your search results using Grafana’s visualization tools. For that, use the official Cribl Search plugin for Grafana.

Once the plugin is configured, you can:

• Run any Cribl Search query directly in Grafana.
• Feed your Grafana dashboards with up-to-date data, using scheduled searches.

Connect Grafana to Cribl Search

​

To start using Cribl Search with Grafana, you need Organization administrator permissions in Grafana, and Owner or Admin permissions in Cribl.Cloud.

1. In Grafana, install the Cribl Search plugin.
2. In Cribl.Cloud, get a Cribl.Cloud credential.
3. In Grafana, add a Cribl Search data source.

Install the Cribl Search Plugin in Grafana

​

To install the Cribl Search plugin in Grafana:

1. Log in to Grafana as an Organization administrator.
2. Go to the Cribl Search plugin page, and select Install.

Create a Cribl.Cloud Credential for Grafana

​

To let Grafana pull data from Cribl Search, create an API Credential in Cribl.Cloud:

1. Log in to Cribl.Cloud, and select an Organization for which you’re an Owner or Admin.
2. Go to Account > Organization > API Management.
3. Select Add Credential, and follow the steps to create an API Credential.
4. Once you created the credential, keep the following at hand:
   • Client ID.
   • Client Secret.
   • The URL of your Cribl.Cloud Organization (for example, https://<workspaceName>-<organizationId>.cribl.cloud).

Add a Cribl Search Data Source in Grafana

​

With the Cribl Search plugin installed, and your Cribl.Cloud credential ready, add a Cribl Search data source in Grafana:

1. Log in to Grafana as an Organization administrator.

2. In Grafana, follow Grafana’s instructions for adding a new data source. Select the Cribl Search plugin as the data source type.

3. On the Cribl Search plugin page:

   • In Cribl Organization URL, enter the URL of your Cribl.Cloud Organization (for example, https://<workspaceName>-<organizationId>.cribl.cloud).
   • In Cribl Client ID, enter the Client ID of the Cribl.Cloud credential.
   • In Cribl Client Secret, enter the Client Secret of the Cribl.Cloud credential.

4. Select Save & test.

Run a Cribl Search Query in Grafana

​

Once you set up the Cribl Search plugin, you can run any Cribl Search query right there in Grafana:

1. In Grafana, go to your Cribl Search data source.
2. In Query Type, select adhoc.
3. In Query, enter your Cribl Search query.

   Your query can include Grafana variables.

4. At the top right, adjust the time range.
5. Select Run query.

Schedule Searches to Load Grafana Dashboards Faster

​

To render your Grafana dashboards faster, keep them up to date by automatically pulling the latest results of scheduled searches from Cribl Search.

First, get the ID of the scheduled search that you want to visualize in Grafana:

1. From the Cribl Search sidebar, select Saved Searches.
2. Open an existing saved search, or select Add Search to save a new one.
3. Set up your scheduled search, by following this section: Schedule a Search.
4. At the top, copy the scheduled search ID (for example, cribl_search_finished_1h).

With the scheduled search ID ready, go to Grafana:

1. In Grafana, go to your Cribl Search data source.
2. In Query Type, select saved.
3. In Saved Search, enter the ID of your Cribl Search scheduled search.
4. Select Run query.

Now, Grafana will automatically fetch the latest results of your scheduled search. When you open Grafana, the dashboard dependent on your search will load immediately, since your Cribl Search results are already there.

Get Grafana Alerts Based on Cribl Search Results

​

You can create Grafana alert rules based on results produced by Cribl Search. For example, you can get Grafana alerts when the number of your Cribl Search results crosses a certain threshold, or when a result set contains a specific value.

1. Make sure your Grafana instance is connected to Cribl Search.
2. When configuring an alert rule in Grafana, select a Cribl Search data source, and add your ad-hoc or scheduled Cribl Search query.

For more information on setting up alerts, see Grafana’s documentation.