send
The send
operator forwards search results to a Cribl HTTP Source in a distributed Cribl Stream deployment where you can forward and route the results.
User Search Members can send only to the default URL.
Rules
- Aggregate results are sent once the search completes, so you won’t see results until then.
- By default, events are sent to the same Cribl.Cloud Organization’s Cribl HTTP Source.
- Use the Cribl HTTP Source to receive data in hybrid Workers.
- You can send events anywhere with a regular HTTP Source URL.
- Use the
centralize
operator when sending results from Edge Worker Nodes without access to the internet or your Cribl.Cloud Organization. - The
group
parameter is only for Cribl.Cloud Worker Groups and cannot be used in conjunction with theURL
argument.
Syntax
... | send [ tee=Boolean ] [ group=WorkerGroup | "URL" ]
Arguments
- Boolean: Defaults to
false
where search results are not shown in Cribl Search. Instead, you get an event with the URL, status, and the number of bytes and events sent or dropped. Whentrue
the search results are displayed and no stats are provided. E.g.,tee=true
. - WorkerGroup: The Cribl Stream Worker Group to send data to. Defaults to
default
. E.g.,group=default
. - URL: Your Cribl.Cloud instance’s global domain for inbound data, including the port. Defaults to your Cribl.Cloud ingress address and port
10200
, the default port of the Cribl HTTP Source. E.g.,"https://in.main-default-domain.cribl.cloud:10200"
.
Examples
Send events to the
default
Worker Group.dataset=myDataset | send
Send up to 100 events and display the results.
dataset=myDataset | limit 100 | send tee=true
Send events to a Worker Group named Goat.
dataset=myDataset | send group=goat
Send events to a hybrid Worker Group.
dataset=myDataset | send "https://in.your-tenant.com:10200"
Send aggregate results by specifying the URL to your Cribl Stream internal Cribl HTTP Source.
dataset=myDataset | summarize count() by action | send "https://in.main-default-domain.cribl.cloud:10200"
Send results to the Cribl.Cloud Stream default Worker Group.
Run in Cribl Searchdataset=$vt_dummy event<10 | extend _raw=iif(event%2>0, "This is a test event", "This is another event") | send
Last updated by: Dritan Bitincka