Notebook templates are reusable layouts for Search investigations. Each template stores the same kinds of search cells and note cells as a Notebook, including saved queries and chart settings, so teams can start from a known structure for incidents, audits, or onboarding. You can treat a template as an operational runbook: a fixed sequence of steps your organization follows every time.

Templates are separate objects from Notebooks. Creating or editing a template does not write to a Notebook’s activity history the way collaborative investigation work does, and template editing is focused on maintaining the template itself rather than preserving job-by-job search lineage like a live investigation.

Open the Templates List ​

1. Go to the Notebooks page in Cribl Search: On the top bar, select Products > Search > Notebooks.
2. Select the Templates tab.

The table lists each template’s Name, Created By, Created, Last Modified, and Last Modified By so you can see ownership and freshness at a glance.

From the list you can open a template, use it to create a Notebook, or use row actions where your permissions allow. You can filter templates (for example, custom versus ready-made) using the controls above the table.

Create a Template ​

Add a New Template From Scratch ​

1. On the Templates tab, select Add Template. Cribl Search creates a template and opens it in edit mode.
2. Add or adjust search cells and note cells the same way you do in a Notebook. You need Maintainer-level access on the template to edit it.
3. Select Save when you are finished. Select Exit to leave edit mode, or confirm discarding changes if you exit without saving.

Save an Existing Notebook as a Template ​

1. Open the Notebook you want to capture.
2. In the top-right corner, select the Actions drop-down, then select Save as Template.
3. Cribl Search creates a new template from the Notebook and opens it in template edit mode. The template name starts from the Notebook name, and you can rename it from the header.

You can also start from a ready-made Cribl template (for example, one that walks through sample data) by choosing it from the Templates tab or from the Choose Template flow when you create a Notebook from a template.

View or edit a template ​

On the Templates tab, select a template row to open it.

Templates open in view mode first. If you have Maintainer access, select Edit Template to change cells, queries, notes, and chart settings. While you edit, use Save to keep changes or Exit to leave edit mode. If you exit with unsaved edits, confirm whether to discard them.

Read Only access on a template lets you review the layout and results-style content and use Use Template or Clone from the list or template header, but not change the template or share it. Maintainer access is required for Edit Template, Share Template, and Delete Template actions where those controls appear.

For how object-level permissions map to Read Only and Maintainer in Search, see Cribl Search Notebooks Permissions. Template sharing uses the same permission model as Notebooks at the object level.

Share a Template ​

If you are a Maintainer on a template:

1. Open the template in view or edit mode.
2. Select Share Template.
3. Under Add Members, Teams, and API Credentials, choose who to add and assign Read Only or Maintainer for the template, then select Add Access and Save.

Grant No Access to remove someone from the template. Members without access cannot open the template from the list.

Clone or Delete a Template ​

• Clone: From the Templates tab, open the row actions for a template you can access and select Clone. Cribl Search creates a copy whose name includes (Clone) so you can adapt it without changing the original.
• Delete: From the Templates tab, select one or more templates you maintain, then select Delete and confirm. You need Maintainer access on each template you remove.