On This Page

Home / Search/ Language Reference/ Commands/options

options

The options literal can be used with:

  • .clear command to disable set-statement options.
  • .show command to list set-statement options configured for your account.

Show Options
​

Use .show options to get a list of set-statement options that you, or an Admin Search Member, have configured for your account. This command lets you:

  • See the values of the options.
  • Find out which options are active and which are overridden by other settings.
  • Identify which options were set by you and which were set the Search Admin.

Permissions
​

All Search Members can see all set-statement options that apply to their own account.

Syntax
​

.show [Scope] options
              [with(reason = "InvestigationReason")]`

Parameters
​

ParameterTypeDescription
ScopestringScope for listing the options:
  • all or *: List all options configured for your account.
  • active: List only those options that may affect your searches at the moment (that is, options that are not being overridden by other settings).
InvestigationReasonstringThe reason for running the .show options command, which is added to the Cribl Search audit log.

Returns
​

Returns a list of set-statement options configured for your account. The results include the following details:

FieldDescription
_timeExecution time of the .show options command.
successtrue if the .show options command was successful.
optionThe name of the set-statement option.
valueThe value of the option.
sourceThe scope in which the option was set.
activetrue if the option affects your searches. false if the option doesn’t affect you at the moment because it’s being overridden by another setting.

Examples
​

See all set-statement options that affect you at the moment.

.show active options
             with(reason = "Just checking options active for my account.")
Run in Cribl Search

Clear Options
​

Use .clear options to disable options that were configured by set statements.

To see which set-statement options affect your account at the moment before running .clear options, use the .show options command.

Permissions
​

Search Member TypePermissions
AdminCan disable any options configured for any scope.
Editor or UserCan disable only those options that they configured themselves.

Syntax
​

.clear [Scope] options
               [with(reason="DeactivationReason")]`

Parameters
​

ParameterTypeDescription
ScopestringScope of deactivation:
  • user (default): Deactivate all options that the current user set for their own account.
  • global (Admin only): Deactivate all options set for all users in the matching Usage Group.
  • all (Admin only): Deactivate according to both the user and global scopes.
DeactivationReasonstringA string that provides a reason for disabling the options, to add to the Cribl Search audit log.

Returns
​

Returns a single event that confirms the options are disabled.

Examples
​

Disable all set-statement options configured for your own account.

.clear user options
            with(reason = "Clearing all my options.")

Disable all set-statement options of all users in the Usage Group.

// Admin only
.clear global options
              with(reason = "Clearing all options for my users.")

Disable all set-statement options, both for your own account and for all users in the Usage Group.

// Admin only
.clear all options
           with(reason = "Clearing all options for me and my users.")