send

The send operator forwards search results to a Cribl HTTP Source in a distributed Cribl Stream deployment where you can forward and route the results.

User Search Members can send only to the default URL.

Rules

  • Aggregate results are sent once the search completes, so you won’t see results until then.
  • By default, events are sent to the same Cribl.Cloud Organization’s Cribl HTTP Source.
  • Use the Cribl HTTP Source to receive data in hybrid Workers.
  • You can send events anywhere with a regular HTTP Source URL.
  • Use the centralize operator when sending results from Edge Worker Nodes without access to the internet or your Cribl.Cloud Organization.
  • The group parameter is only for Cribl.Cloud Worker Groups and cannot be used in conjunction with the URL argument.

Syntax

    ... | send [ tee=Boolean ] [ group=WorkerGroup | "URL" ]

Arguments

  • Boolean: Defaults to false where search results are not shown in Cribl Search. Instead, you get an event with the URL, status, and the number of bytes and events sent or dropped. When true the search results are displayed and no stats are provided. E.g., tee=true.
  • WorkerGroup: The Cribl Stream Worker Group to send data to. Defaults to default. E.g., group=default.
  • URL: Your Cribl.Cloud instance’s global domain for inbound data, including the port. Defaults to your Cribl.Cloud ingress address and port 10200, the default port of the Cribl HTTP Source. E.g., "https://in.main-default-domain.cribl.cloud:10200".

Examples

  • Send events to the default Worker Group.

    dataset=myDataset
    | send
  • Send up to 100 events and display the results.

    dataset=myDataset
    | limit 100 
    | send tee=true
  • Send events to a Worker Group named Goat.

    dataset=myDataset
    | send group=goat
  • Send events to a hybrid Worker Group.

    dataset=myDataset
    | send "https://in.your-tenant.com:10200"
  • Send aggregate results by specifying the URL to your Cribl Stream internal Cribl HTTP Source.

    dataset=myDataset
    | summarize count() by action
    | send "https://in.main-default-domain.cribl.cloud:10200"
  • Send results to the Cribl.Cloud Stream default Worker Group.

    dataset=$vt_dummy event<10 
    | extend _raw=iif(event%2>0, "This is a test event", "This is another event") 
    | send
    Run in Cribl Search
Last updated by: Dritan Bitincka