Identify Cribl Search behavior that differs when you search a Cribl Lake/Lakehouse versus standard Cribl Lake Datasets.

This page covers Cribl Lake/Lakehouse caching for Cribl Lake Datasets. It doesn’t cover lakehouse engines, the Cribl-hosted storage that powers Search Datasets. For those, see Lakehouse Engines.

When you run Cribl Search queries against a Dataset assigned to a Cribl Lake/Lakehouse, some behavior and results differ from a corresponding search executed against a Cribl Lake Dataset without Cribl Lake/Lakehouse caching. This page identifies operators, functions, data types, and other details to keep in mind when searching a Cribl Lake/Lakehouse.

You can disable using a Cribl Lake/Lakehouse for a specific query by using the set statement with the lakehouse option set to off.

Unlimited Events with sort ​

The sort operator’s MaxNoOfOutputEvents parameter defaults to unlimited with a Cribl Lake/Lakehouse, rather than to 10000 events as in a regular search. However, you can set this limit parameter as desired.

Strict Boolean Comparisons ​

Boolean comparisons in Cribl Lake/Lakehouse searches are strongly typed. Assume a query condition like field1==field2, in which one field is a boolean, while the other is a boolean-compatible value (such as "yes", "y", "t", "true", or "1" for true; or "no", "f", "false", or "0" for false).

In a mixed comparison (for example, where field1’s value is true and field2’s value is "yes"), note that field1==field2 will not match. (When searching the same data without Cribl Lake/Lakehouse caching, looser typing allows these values to match.)

Statistical Aggregations with Booleans ​

A statistical aggregation that aggregates mathematically on a boolean value will return a null in Cribl Lake/Lakehouse searches. (Running the same aggregation without Cribl Lake/Lakehouse caching will return a numeric value: either 1 for true or 0 for false.)

This null return value applies to the following functions when their Expression argument takes a boolean value: avg, percentile, stdev, stdevp, sum, variance, and variancep. (A boolean value in these functions’ Predicate argument does not cause a null return value.)

The null return value also occurs with a boolean value in the following functions’ sole Expression argument: avgif, stdevif, sumif, and varianceif.

Extra null Column with timestats ​

Applying the timestats aggregation function to a search against a Dataset assigned to a Cribl Lake/Lakehouse might return a null column when only empty values are found. Searches without Cribl Lake/Lakehouse caching do not return this column.

Higher dedup and eventstats Result Counts ​

Applying the dedup or eventstats operator to a search against a Dataset assigned to a Cribl Lake/Lakehouse can return a higher result count, compared to searching the same data without Cribl Lake/Lakehouse caching. This is because dedup and eventstats in Cribl Lake/Lakehouse mode can process unlimited events, compared to the 50,000-event limit applied to dedup and eventstats in searches without caching.

Different extract type=regex overwrite Behavior ​

When using the extract operator with type=regex and the overwrite option for existing event fields, the behavior is different with and without Cribl Lake/Lakehouse caching. Without a Cribl Lake/Lakehouse, if overwrite is set to false, the extraction will convert any existing field values to an array. However, Cribl Lake/Lakehouse searches will omit any existing field values, regardless of whether overwrite is set to true or false.

For example, if you extract key src_ip with value 10.2.3.3, and the field already exists with value 10.1.2.2, a search without a Cribl Lake/Lakehouse with ow=false will yield a field value of ["10.1.2.2", "10.2.3.3"]. But a Cribl Lake/Lakehouse search will yield a field value of 10.2.3.3.

To consistently preserve the field’s original value, you can assign that value to a different variable earlier in the query.

Numeric Precision Limits for Large Integers ​

Numeric searches and computations in a Cribl Lake/Lakehouse are limited to the IEEE 754 safe integer range (±(2^53 - 1), or ±9,007,199,254,740,991). Numeric literals outside this range (including large negative integers, decimals with a large integer part, out-of-range exponential notation, and values that overflow to infinity) are automatically treated as strings to prevent precision loss.

To filter on a large numeric value such as a record ID, enclose it in quotes:

dataset="my_dataset" | where id=="10001900000009910000"

This automatic conversion applies to Cribl Lake/Lakehouse searches only. Federated searches without a Cribl Lake/Lakehouse do not convert large numeric literals to strings automatically, and comparisons outside the safe integer range may return imprecise results.