Searching Cribl Lake

Learn how to search your Cribl Lake data.

This page provides example searches that you can run with Cribl Lake and Lakehouses.

Setting Up

​

To begin integrating Cribl Search with these data lakes, first see Connect to Cribl Lake.

Certain operators, functions, and data types behave differently when you search Cribl Lake Datasets with (versus without) Lakehouse caching. To avoid unexpected search results, see Lakehouse Search Differences.

Examples

​

Use these examples as starting points for your own searches.

Basic Search

​

This search specifies a Dataset (test_dataset) and limits the number of results.

dataset="test_dataset"
| limit 100

Lake Partition

​

This search uses a Lake partition named sourcetype that is configured for the partitioned Dataset to speed up retrieval:

dataset="partitioned" host="cribl-stream"

Exported Data

​

The export operator lets you export search results to a Cribl Lake Dataset. You can later search this Dataset to extract relevant data from it.

An efficient way to search exported data is to provide the search job ID to the where operator:

dataset="exported_data"
| where source contains "1713177481843.9AOqxI"

You can find the search job ID in search details after running it, or in History, in the Search ID column.

You can also label exported events using the extend operator and then include the added fields in your search. For example, during export you can include the user that performed the search:

dataset="cribl_search_sample"
| extend user = user()
| export to lake exported_data

You can then search for data by this user:

dataset="exported_data"
| where user == "John Doe"