Cribl Search 4.19.1 (Coming Soon) ​

The following draft provides early access to release notes for the upcoming Cribl Suite product release. Features or functionality presented are not considered binding commitments and are subject to change at the discretion of Cribl at any time for any reason without notice. This information should not be relied upon in making purchasing decisions.

Summary ​

Cribl Search 4.19.1 adds test ingest for lakehouse engines, new Kusto functions, MCP search, updated Dataset time defaults, and reliability improvements.

Important Changes

This release introduces deprecations and notices that require action if you use the affected features:

• Notice: Cribl as Code TypeScript and Go SDK Discontinuation
• Notice: Future Removal of CBC and RSA TLS Cipher Suites

Review the full list of important changes for additional critical updates.

New Features ​

Sample Data in Lakehouse Engines ​

Lakehouse engines now let you test the ingest pipeline without configuring a Source. Select Send Sample Data under the default in_cribl_http Source.

Splunk Journal Files in v2 Datasets ​

Cribl Search now lets you query Splunk Journal files in v2 federated Datasets, bringing this existing v1 capability to the v2 architecture. Apply the included Splunk Journal Datatype to parse journal files and populate standard Splunk fields, or clone the Datatype to customize timestamp extraction and event size limits.

take_any and take_anyif Aggregation Functions ​

Cribl Search now supports the standard Kusto take_any and take_anyif aggregation functions. Use them with summarize, eventstats, or timestats to return an arbitrary non-null value from each group when sort order does not matter.

Run Queries Through MCP ​

New search tools on the Leader MCP server let connected AI assistants discover Search Datasets and saved searches, run KQL queries with syntax guidance, and fetch results.

Updated Time Clamping Defaults for New Search Datasets ​

For new Search Datasets, the earliest timestamp now defaults to empty (no lower bound), and latest to 1d with a maximum of 7d. Existing Datasets keep their current time range settings.

Important Changes ​

Notice: Cribl as Code TypeScript and Go SDK Discontinuation ​

Cribl is stopping active development of the Cribl as Code Go and TypeScript SDKs, which were previously in preview. To give existing users a clear path forward, we are moving the SDKs from the criblio GitHub organization to the Cribl Community GitHub organization and open sourcing them as community resources. This allows customers and community members to continue using the SDKs and build on them, while Cribl steps back from active feature development and long-term support.

The SDKs will continue to be available through their new home in the Cribl Community GitHub organization, where users can keep using them, fork them, and extend them based on their own needs. Customers looking to stay on a supported integration should consider migrating to either the Python SDK, Terraform Provider, or direct Cribl API access. Cribl support will be limited to critical issues only, such as security vulnerabilities or P0 blockers, for the defined transition period. On October 1, 2026, the SDK repositories will be archived and marked read-only.

Notice: Future Removal of CBC and RSA TLS Cipher Suites ​

In an upcoming release, Cribl Cloud will remove support for CBC and RSA-based TLS cipher suites to strengthen the security and confidentiality of customer environments.

Why we’re making this change:

• CBC ciphers are susceptible to well-documented side-channel and padding oracle attacks.
• RSA key exchange does not provide forward secrecy. If a server’s private key were ever compromised, previously recorded sessions could be retroactively decrypted.

What could be affected:

This change applies to the TLS endpoints your workspaces expose and connect to for data movement, meaning the connections your own systems make into Cribl Stream, and the outbound connections Stream makes to your Destinations. Customers most likely to be affected are those with:

• Legacy or embedded data senders (older syslog forwarders, appliances, IoT/OT devices, or custom agents) pushing data into Stream sources.
• Third-party or on-prem systems whose TLS libraries have not been updated in several years and can only negotiate CBC or RSA-keyed cipher suites.
• Custom integrations built on outdated TLS stacks (older OpenSSL, legacy Java runtimes, end-of-life OS builds) that connect to Stream HTTP, TCP-TLS, or Kafka sources, or that Stream pushes to as a destination.

Corrections ​

SDK Changelogs ​

The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl SDKs in their GitHub repositories:

• Go SDK changelogs: control plane and management plane
• Python SDK changelogs: control plane and management plane
• Typescript SDK changelogs: control plane and management plane