Cribl Stream Cribl Edge Cribl Search Cribl Lake AppScope

Known Issues Release Notes Cribl Copilot

Sandbox GitHub Repos Docker Hub API

(Ctrl+K / Cmd+K)

No Results Try to type a different keyword or phrase

What are you looking for? Type a keyword or phrase above

All Results Press Enter

API Reference Cribl.Cloud

Search

Release Notes Search

About Cribl Search

Basic Concepts Quick Setup Cribl Search Tour

Connect to Data

Cribl Lake/Lakehouse Amazon S3 Cribl Edge

Grant Access to AWS Amazon Security Lake AWS API Data Lake Amazon S3

Azure Blob Storage Azure Data Explorer Azure API

Google Cloud Storage Google Cloud Platform API Google Workspace API

ClickHouse Elasticsearch Generic HTTP API Microsoft Graph API Okta API OpenSearch Prometheus Snowflake Tailscale API Zoom API

Datatypes Storage Classes Supported Data Formats

Search Your Data

Build a Search Write Your First Query Write Queries Using Cribl Copilot Common Query Examples Use Search Results Notebooks (Preview)

Example Searches by Provider

Searching Cribl Lake Searching Cribl Edge Cribl Edge Datasets Searching Amazon S3 Searching AWS API Searching Okta API Searching Zoom API Searching Multiple Providers

Dataset Acceleration (Deprecated)

Area Chart Column Chart Donut Chart Funnel Chart Gauge Chart Horizontal Bar Chart Line Chart Map Chart Scatter Chart Single Value Chart

Create a Dashboard Edit a Dashboard Add Interactions Add Visualizations Using Cribl Copilot Manage and Share Dashboards

Third-Party Visualization Tools

Scheduled Searches

Email Notifications AWS SNS Notifications PagerDuty Notifications Slack Notifications Webhook Notifications Notifications via Cribl Stream

Enrich and Automate

Lookups Parsers Regexes Grok Patterns Macros

Packs Publicaton Standards

Cribl.Cloud Access and Usage

Manage Cribl.Cloud Organizations Manage Members and Permissions Manage Billing in FinOps Center

Configure Workspaces Configure Workspace Teams

Usage Groups Limits

Sharing Search Resources

Optimize Cribl Search

Optimize Searches Optimize Paths Investigative Searching Productivity Tips Useful Queries (Analytic Cookbook)

Troubleshooting

Known Issues KQL Extensions Lakehouse Search Differences Search Details Share Diagnostics Common Issues and Resolutions

Language Reference

Language Reference Index

Aggregation Operators

count eventstats summarize timestats

centralize export extend externaldata extract foldkeys ip-lookup join lookup mv-expand mv-pull pivot send top-hitters union

Display Operators

limit order print project project-away project-rename range render sort take top

Filter Operators

dedup distinct search where

Logical Operators Numerical Operators

Search Operators

String Operators

==!==~!~contains !contains contains_cs !contains_cs endswith !endswith endswith_cs !endswith_cs has !has has_cs !has_cs has_all !has_all has_any !has_any hasprefix !hasprefix hasprefix_cs !hasprefix_cs hassuffix !hassuffix hassuffix_cs !hassuffix_cs in !in in~!in~matches regex startswith !startswith startswith_cs !startswith_cs

.cancel .clear options .generate stats .show objects .show options .show queries

Context Functions

Cribl Functions

findearliest findearliestif findfirst findfirstif findlast findlastif findlatest findlatestif list median medianif persecond persecondif rate rateif sumsq sumsqif values

Scalar Functions

Binary Functions

binary_and binary_not binary_or binary_shift_left binary_shift_right binary_xor from_binary_string to_binary_string

Conditional Functions

case coalesce iff iif max_of min_of

Conversion Functions

bin bin_auto floor gettype tobool todecimal todouble toint tolong toreal tostring

DateTime Functions

ago datetime_add datetime_diff datetime_part dayofmonth dayofweek dayofyear endofday endofmonth endofweek endofyear format_datetime format_timespan getmonth getyear hourofday make_datetime make_timespan monthofyear now startofday startofmonth startofweek startofyear strftime strptime todatetime totimespan unixtime_microseconds_todatetime unixtime_milliseconds_todatetime unixtime_nanoseconds_todatetime unixtime_seconds_todatetime week_of_year

Dynamic Functions

bag_has_key bag_keys bag_merge bag_pack bag_pack_columns bag_remove_keys bag_set_key bag_zip make_bag make_bag_if zip

hash hash_combine hash_many hash_md5 hash_sha1 hash_sha256 hash_xxhash64

ipv4_compare ipv4_is_in_range ipv4_is_in_any_range ipv4_is_match ipv4_is_private ipv4_netmask_suffix ipv6_compare ipv6_is_match format_bytes format_ipv4 format_ipv4_mask

Mathematical Functions

abs acos asin atan atan2 beta_cdf beta_inv beta_pdf ceil ceiling cos cot degrees exp exp2 exp10 gamma isfinite isinf isnan log log2 log10 loggamma not pi pow radians rand range round sign sin sqrt tan

String Functions

base64_decode_toarray base64_decode_tostring base64_encode_fromarray base64_encode_tostring countof extract extract_all extract_json has_any_index indexof isempty isnotempty isnotnull isnull match_regex parse_csv parse_ipv4 parse_ipv4_mask parse_ipv6 parse_ipv6_mask parse_json parse_url parse_urlquery parse_version replace_regex reverse split strcat strcat_delim strcmp strlen strrep substring tolower toupper translate trim trim_end trim_start url_decode url_encode

Statistical Functions

avg avgif count countif dcount dcountif max maxif min minif percentile stdev stdevif stdevp sum sumif variance varianceif variancep

Window Functions

next prev row_cumsum row_number row_rank_dense row_rank_min row_window_session

$vt_datasets $vt_dataset_providers $vt_dummy $vt_jobs $vt_list $vt_lookups $vt_results

bool datetime decimal double dynamic int long null real string timespan

Regex Matching API Reference

Known Issues Release Notes

On This Page

Home / Search/ Troubleshooting/Known Issues

Known Issues

View filterable Known Issues for Cribl Search. Check if issues are resolved or find temporary workarounds.

Previous

Previous

Next

Next

How can I help you today?

Common Resources

Copyright © 2017-2025 Cribl, Inc. All rights reserved.