Connect Cribl Search to Tailscale API

Configure Cribl Search to query a Tailscale API endpoint.

Tailscale VPN makes your devices and applications accessible from anywhere in the world, securely and easily.

In this guide, you’ll set up a Dataset Provider and a Dataset to search the acls and devices endpoints in your Tailscale account.

Add a Tailscale API Dataset Provider

​

A Dataset Provider tells Cribl Search where to query and contains access credentials. Here, you will add a Tailscale API Dataset Provider.

To add a new Dataset Provider, select Data, then Dataset Providers, then Add Provider.

Set the following configurations in the New Dataset Provider modal:

1. ID is a unique identifier for the Dataset Provider. This is how you’ll reference it when assigning Datasets to it. Start the ID with a letter; the rest of the ID can use letters, numbers, and underscores (for example, my_dataset_provider_1).
2. Description is optional.
3. Set Dataset Provider Type to Tailscale API.
4. Select Add Configuration to specify your Tailscale account. In the Account Configuration table, enter:
   • Account Name: Tailscale account name.
   • Client ID: Tailscale Client ID.
   • Client Secret: Tailscale Client Secret.
5. Select Save when finished.

For details on obtaining your Tailscale credentials, see Authentication.

Add a Tailscale API Dataset

​

Now you’ll add a Dataset that tells Cribl Search what data to search from the Dataset Provider.

To add a new Dataset, select Data, then Datasets, then Add Dataset.

Set the following configurations in the New Dataset modal:

1. ID is an identifier unique for both Cribl Search and Cribl Lake. You’ll use this to specify the Dataset in a query’s scope, telling Cribl Search to search the Dataset. Start the ID with a letter; the rest of the ID can use letters, numbers, and underscores (for example, my_dataset_1).
2. Description is optional.
3. Set Dataset Provider to the ID of a Tailscale Dataset Provider.
4. Select Add endpoint to select the endpoints for your Dataset.
5. Enabled endpoints: Select an endpoint from the drop-down menu. Your options are:
   • acls
   • devices
6. In Processing, you can apply rules for breaking data into discrete events. For more information, see Datatypes.
7. In Snapshots, you can set up API Snapshots.
8. Select Save when finished.

Search Tailscale API

​

Now that you have a Dataset Provider and Dataset, you’re ready to start searching.

Search results can start showing up within a second or two, but when the search completes depends on how much data there is in the account.