Cribl Search 4.20.3 ​

Summary ​

Cribl Search 4.20.3 adds standard schema mapping, v2 Datatype testing, Datadog Agent metrics, KQL filtering for live data, and more.

Important Changes

This release introduces a notice that requires action if you use the affected features:

• Notice: Future Removal of $token Input Syntax

Review the full list of important changes for additional critical updates.

New Features ​

Datadog Agent Metrics in Metrics Explorer (Preview) ​

The Datadog Agent Source can now store metrics directly in a metrics Dataset, without routing them through Cribl Stream. This includes metrics that Logstash sends using its datadog_metrics output. Datadog tags become metric dimensions, and you can query the metrics in Metrics Explorer.

Datatype v2 Parsing (Preview) ​

You can now test how a v2 Datatype parses events, similarly to v1 Datatypes. Paste sample data, import events from a Dataset, or capture live data, then review the output fields, including _raw and _time.

Search Multiple v2 Datasets at Once ​

A single search can now target more than one v2 Dataset, and Cribl Search merges the results. For example: dataset="myDatasetA" or dataset="myDatasetB". You can combine v2 Datasets with other v2 Datasets, v1 Datasets, or Search (lakehouse engine) Datasets, including Datasets in different regions. Multi-Dataset searches support filters, projections, and aggregations that Cribl Search can merge across Datasets, such as count. Searches with other operations, such as distinct counts, still need to target one Dataset.

Map Fields to a Standard Schema ​

Map fields in lakehouse engine data to OCSF, giving common fields consistent names across data sources.

Filter Live Data with KQL Expressions ​

Capture only the events you need during an investigation by writing a KQL filter expression. This works alongside the existing filters for Source, Datatype, Dataset, and event type in Live Data.

Prompt Cribl AI from Dashboards and Notebooks ​

You can now prompt Cribl AI about a specific Dashboard panel or Notebook cell. Cribl AI uses that item as context for your request.

MCP Server Connection Details ​

The Cribl MCP server setup experience now surfaces connection details directly in the UI, including the server URL, authentication requirements, and code snippets for connecting your MCP client. You no longer need to switch between the product UI and documentation to complete the setup.

Pack-Scoped Support for Leader MCP Pipeline Tools ​

Leader MCP Pipeline tools now support a packId parameter, allowing Pipelines defined inside Packs to be retrieved and modified through MCP. Previously, Pack-internal Pipelines appeared as opaque placeholders that couldn’t be read or updated.

Copilot Is Now Billy ​

The AI assistant formerly known as Cribl Copilot is now Billy. All user-facing text, including titles, tooltips, placeholders, and accessibility labels, now refer to Billy. Billy has the same capabilities as Copilot. Only the name has changed.

Fast Release Channel in Cribl.Cloud ​

In Cribl.Cloud, Enterprise customers can now assign each Workspace to the Fast release channel. Cribl publishes new features and services to the Fast release channel approximately weekly, so you can preview them and provide feedback before they become available on the Regular release channel.

Billing Reader Permission for API Credentials ​

Enterprise customers can now assign the Billing Reader Permission on an Organization to API Credentials in Cribl.Cloud. This lets you automate billing and usage reporting without granting broad administrative access to your Organization, Workspaces, or products.

Apps ​

The Cribl Marketplace now shows which Apps are Cribl Certified, and installed Apps get tighter control over who can open them and what they can call.

• Certified Apps: Find Apps that meet Cribl standards for business-critical use with a new Certified filter in the Cribl Marketplace. Publishers request certification once per App, and it carries to each newer version that Cribl approves for listing.
• App permission models: A newly installed App uses strict policy permissions and can call only the Cribl API endpoints declared in its policies.yml, including when an administrator uses the App. An App that is already installed keeps user-based permissions, where access follows each member’s product permissions and policies.yml can add actions, and you can switch that App to strict policy permissions.
• Private by default: Members and teams can open a newly installed App only after an administrator uses Share to assign them the App user access level. Upgrading an App keeps its existing Share assignments. See Share Access to Installed Apps.
• Ownership transfer: An App owner can transfer a published App to a new owner.

Experience Improvements ​

Simple Term Search for Email Addresses ​

Simple term searches now match email addresses, including the @ symbol. Cribl Search uses the has operator for these terms instead of a regular expression.

Faster Two-Argument countif Searches ​

When you use the two-argument form of countif, lakehouse engines now run the count where the data is stored, the same as the one-argument form. Before this change, a lakehouse engine could only do that with one argument, so two-argument searches took longer.

Generate UUIDs in Search Results ​

Use new_guid() or its alias uuid() to generate a unique UUID v4 value for each result.

More Accurate Queries in Investigations ​

During investigations, KQL generation now uses bounded, server-side samples from relevant Datasets when field statistics or Dataset Intelligence are unavailable. This gives you faster, more accurate queries grounded in real event fields and source patterns. Relevant context is retained for follow-up questions, while built-in safeguards keep the experience fast and reliable.

Save Investigations to a Notebook Template ​

When you save an investigation to a new Notebook, you can now choose one of your Organization’s Notebook templates.

Recents Covers More Object Types ​

Recents now includes Datasets, Dataset Providers, Datatypes, Engines, Lookups, Parsers, Regexes, Grok, and Macros, and keeps up to 30 items.

Resize the Cribl AI Sidebar ​

Drag the edge of the Cribl AI sidebar to change its width. Cribl Search keeps that width when you close and reopen the sidebar.

Undo a Change Cribl AI Made ​

When Cribl AI updates a Dashboard, Dashboard category, Notebook, saved search, lookup, or Macro, you can restore the previous version with a single button.

Keyboard Accessibility Improvements ​

We improved keyboard accessibility in popular areas of Cribl Stream, Edge, and Search. On targeted routes, keyboard users can now navigate, complete forms, and submit changes more reliably, with improved focus order, focus indicators, screen-reader markup, and color contrast.

Endpoint-Specific API Rate Limits ​

Cribl now applies endpoint-specific rate limits to prevent excessive traffic from interfering with normal operations. When a request exceeds the endpoint’s rate limit, the API returns the HTTP status code 429 Too Many Requests and a Retry-After header that specifies how many seconds to wait before retrying.

Edit, Clone, or Delete App Key-Value Pairs ​

On an App’s Key-Value Stores tab, you can now edit, clone, or delete individual key-value pairs from the Actions menu. Use this to keep an App’s seeded configuration and secrets up to date, and to duplicate an unencrypted pair instead of recreating it.

Important Changes ​

Notice: Future Removal of $token Input Syntax ​

Cribl Search will remove support for the $token Input syntax in Dashboards and Notebooks in the 4.21.1 release. Replace $token references in Dashboards and Notebooks with $token$. For example, replace $firstname with $firstname$. Although legacy $token syntax continues to function in this release, you should migrate all references to $token$ before version 4.21.1.

Cribl Terraform Provider No Longer in Preview Status ​

The Cribl Terraform provider is no longer in Preview status and is now generally available. Use the provider to manage Cribl resources as infrastructure as code across Organizations and Workspaces.

Cribl AI Model Tier Renaming ​

The model tiers for Cribl Managed Models and custom AI providers (Bring Your Own Model, or BYOM) are now named Fast, Balanced, and Deep. These names replace Small, Frontier, and Reasoning, respectively. This is a display update only, with no changes to model behavior or performance.

Corrections ​

SDK Changelogs ​

The Cribl SDKs help you integrate with Cribl and reduce the need for repetitive tasks. We maintain changelogs for each version of the Cribl Python SDKs in their GitHub repositories:

• Control plane
• Management plane