Language Reference

A comprehensive reference for the Cribl Search implementation of KQL.

Cribl Search is based on Kusto Query Language (KQL), which lets you delve into your data to discover patterns, identify anomalies and outliers, and create statistical models.

While the Cribl implementation of KQL mostly follows the original, there are certain differences (for example, the implicit cribl operator). To get the details right, follow the language reference presented in these sections:

• Operators
• Functions
• Statements
• Commands
• Virtual Tables

Operators

​

An operator in Cribl Search is a query component that processes data, performing actions such as filtering, counting, or transforming events. Operators can use functions, and are delimited by the pipe character |.

For example, the limit operator sets the maximum number of events returned from a search:

dataset="cribl_search_sample"
 | limit 100

To learn more, see: Operators.

Functions

​

A function in Cribl Search is a unit of logic that processes data based on arguments passed to it.

For example, the max function returns the maximum value of a field:

dataset="cribl_search_sample"
 | summarize LatestEvent=max(start)

To learn more, see: Functions.

Statements

​

A statement in Cribl Search is a special keyword that sets options (set) or assigns names to expressions (let).

For example, this statement sets the maximum number of events returned by the current search:

set max_results_per_search=1000;

To learn more, see: Statements.

Commands

​

A command in Cribl Search is an instruction used to manage searches directly from the query box. Unlike functions and operators, commands start with a period.

For example, the .cancel command can stop searches:

.cancel running queries

To learn more, see: Commands.

Virtual Tables

​

A virtual table in Cribl Search is a dynamically generated dataset that provides system information useful for troubleshooting, performance analysis, and testing.

For example, the $vt_dummy virtual table generates sample data:

dataset="$vt_dummy" event<10

To learn more, see: Virtual Tables.