Cribl Search 4.19.0 (Coming Soon) ​

The following draft provides early access to release notes for the upcoming Cribl Suite product release. Features or functionality presented are not considered binding commitments and are subject to change at the discretion of Cribl at any time for any reason without notice. This information should not be relied upon in making purchasing decisions.

Summary ​

Cribl Search 4.19.0 adds an enhanced distinct operator, automatic jitter for scheduled searches, v2 Datatypes support in Search Packs, and several performance and results-display improvements. Dynamic search concurrency and token_search are now on by default, and Cribl AI is now embedded in Search by default. This release also expands Investigations (Preview) and introduces Metrics (Preview) for sending and exploring metrics in Cribl Search.

New Features ​

This release provides the following improvements:

Cribl.Cloud Release Channels ​

In Cribl.Cloud, Enterprise customers can assign each Workspace to the Regular or Slow release channel. The Regular release channel (default) follows the standard monthly release cadence. The Slow release channel also updates monthly, but stays one version behind Regular. Release channels give teams self-service control over the Cribl upgrade cadence on a per-Workspace basis, so you can validate new Cribl versions in pre-production Workspaces before deploying to production. The Slow release channel isn’t updated in November and December to accommodate holiday season change freezes.

Multi-Region Workspaces in Cribl.Cloud ​

In Cribl.Cloud, Admins can now add new Workspaces in any region, independently of the Organization region. This lets customers with global footprints locate Workspaces within the geographic and political boundaries they need to meet standards for compliance, data residency and sovereignty, and local processing.

Private Link ​

You can now configure AWS and Azure Private Link connections to Cribl.Cloud Workspaces directly through the Cloud portal. This keeps your traffic entirely off the public internet by routing it through your cloud provider’s backbone network.

Enhanced distinct Operator Supports Assignments and Expressions ​

The distinct operator now accepts inline assignment expressions. You can compute and deduplicate on a derived value in a single step, without a separate extend. For example:

dataset=myDataset level=error
| distinct x = strcat('ERROR: ', message)

Scheduled Search Jitter ​

Cribl Search now automatically applies jitter to scheduled searches to prevent simultaneous execution at predictable intervals. The jitter window is expressed as a maximum percentage of the schedule period and is configurable in Limits, with a per-search override in scheduled search settings.

v2 Datatypes Support in Search Packs ​

Search Packs now support v2 Datatypes. When you add a Datatype to a Pack, the Add Datatype modal offers both v1 and v2 options, and you can reference Pack-scoped v2 Datatypes in federated Dataset path filters using the packId.datatypeId format.

Dynamic Search Concurrency On by Default ​

Dynamic search concurrency is now on by default. Cribl Search automatically scales the allowed number of concurrent searches based on current load, replacing the static cap with a feedback loop that grows when there’s headroom and shrinks under pressure. Don’t change the dynamic concurrency settings unless Cribl Support or your Cribl account team asks you to. For more details, see dynamic search concurrency.

token_search Enabled by Default ​

The token_search SET option is now enabled by default, improving full-text search accuracy.

Control Query Sample Rate with a SET Option ​

The new sample_rate SET option sets a search’s sample rate in the query text, overriding the job’s rate. Use a decimal (0.5), percentage ("50%"), or fraction ("1:2").

Gemini as a Custom AI Provider ​

This release introduces Gemini as a custom AI provider and lets you easily reset BYOM tier assignments to their suggested defaults. Enhanced UI visibility makes verifying BYOM test results quick and seamless.

Apps (Preview): Capra in the App Scaffold ​

The Create App scaffold for Apps (Preview) now installs Capra, the Cribl design system, by default. New projects include a Capra-based sample UI, Capra packages from the public npm registry, and AGENTS.md guidance for AI-assisted development. You can use Capra components and design tokens, apply Capra styling with your own components, or replace Capra with another UI stack.

Experience Improvements ​

This release includes the following performance and usability improvements:

Cribl AI Embedded by Default ​

Cribl AI is now directly embedded into the suite by default, introducing AI-accelerated workflows across your Workspace. You can use natural language to build pipelines, query datasets with KQL, automatically generate commit messages, run dataset investigations via Notebooks, and mitigate privacy risks. These capabilities are supported by either Cribl-supplied models, or you can choose your own custom provider configurations, giving you full control over how AI processes your data.

Embedded MCP Server ​

You can now connect AI coding tools directly to the embedded MCP server in your Cribl Search Workspace – no separate container required. Enable it in AI Settings and use a bearer token to manage your environment via natural language, securely tied to your native Cribl permissions. The standalone Docker MCP server remains fully supported.

Dashboard Load Time Improvements ​

Dashboards with static panels now load lazily, so panels load on demand instead of all at once. This enhancement minimizes latency, letting you begin working with your data sooner.

Available Datasets Performance Improvement ​

The Available Datasets list on the Search page now loads quickly regardless of how many Datasets you have.

Accessibility Improvements ​

The sidebar, top bar, dialogs, tables, and login screens are now more accessible for screen readers and users who rely on their keyboards for navigation. We also updated icons and enhanced color contrast for users with impaired vision. These updates improve navigation consistency throughout the Cribl suite.

SSO Users on the Team Details Page ​

The Team Details page now lists SSO users under Team Members. SSO users are progressively added to the Team Members list as they log in.

FinOps Center Global Date Range Picker ​

In the FinOps Center, a new Global Date Range picker lets you set the date range for all of your billing graphs at one time, reducing the number of clicks and saving you just a little time for more important work.

Organization Roles in the Account Menu ​

Your Organization roles now appear under your name in the account menu, so you can see your role without navigating to Members & Teams.

Investigations (Preview) ​

This release expands AI-guided investigations with more control and deeper analysis:

• Investigation Plan: Cribl Search now presents a plan before running queries on complex requests. Review the proposed steps and recommended Datasets, adjust the time range, then select Confirm to begin.
• Start an Investigation from a Notebook: Select New Investigation from the notebook toolbar to launch a deep investigation seeded from that notebook. Cribl Search summarizes the notebook and confirms a goal with you before investigating.
• Deeper Investigations, Automatically: Cribl Search now determines when deeper analysis is needed and switches modes automatically, and it can run multiple queries in parallel to surface findings faster.

Metrics (Preview) ​

You can now send metrics to Cribl Search with Prometheus Remote Write and explore them in a dedicated metrics experience built for fast investigation. In this preview feature, you can:

• Query metrics visually in Metrics Explorer, and switch to raw PromQL when you need more control.
• Filter and analyze metric series by dimensions, with results shown as charts or tables.
• Add metric panels to Search Dashboards and Notebooks.
• Create monitors to track metric conditions and send alerts to your notification channels.
• Access metrics through a Prometheus-compatible query API for integration with existing PromQL-based workflows.

Corrections ​

SDK Changelogs ​

The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl SDKs in their GitHub repositories:

• Go SDK changelogs: control plane and management plane
• Python SDK changelogs: control plane and management plane
• Typescript SDK changelogs: control plane and management plane