On This Page

Home / Search/ Search/Save Searches in Cribl Search

Save Searches in Cribl Search

Keep queries you want to reuse, schedule, or share so you don’t have to rebuild them from scratch.

Highlights
​
  • To save your current search, select Actions > Save Search.
  • Schedule saved searches to send Notifications on results.
  • Share saved searches through Packs.

Save Searches to Reuse, Schedule, and Share
​

When you find a query that might be useful again, save it to preserve the query text, sampling ratio and time range. Saving searches lets you:

  • Quickly rerun frequently used queries.
  • Schedule a search to run at regular intervals, and send Notifications on results.
  • Share proven searches with your team through Packs.
  1. Run a search, or open a past search from History.
  2. At the bottom right of the query box, select Actions > Save Search.
  3. Name and describe your search, adjusting the query, sampling ratio, and time range if needed.
  4. To share the search results with others, set the Results Access to All Members.
  5. To run the search at regular intervals, select Schedule. See Scheduled Searches for details.
  6. To get alerted on the scheduled search results, select Notifications. See Notifications for details.
  7. Select Save.

Your search now appears in Saved Searches.

View Saved Searches
​

From the Cribl.Cloud top bar, select Products > Search > Saved Searches.

On the Saved Searches page:

  • Select the column selector to show or hide columns.
  • Select Actions to clone a search, add it to a Dashboard or Notebook, or move it to a Pack.
  • Filter for Scheduled searches at the top right.
  • Select Add Search to save a new search.
  • Select check boxes to mark searches for deletion.
Changing Saved Search Ownership
​

If the creator of a saved search is no longer an active Cribl Search Member, Search Admins with access to the search can continue to run it ad hoc. (They will now appear as the user requesting the search.) However, they will be unable to schedule the search. The Admin will need to copy the search’s details, and to then re-create, save, and schedule the search under their ownership.