Manage Access to Cribl Search Resources
Grant fine-grained access rights on individual Datasets, search results, or Dashboards.
Cribl Search offers two layers of Permissions for Members, Teams, and API Credentials:
- Product-level Permissions: User, Editor, Admin, or No Access.
- Resource-level Permissions on Datasets and Dataset Providers, Dashboards, and Notebooks: Maintainer or Read Only.
You can grant resource-level Permissions on:
Resource Maintainers can assign access to:
- Members of an Organization and Teams that group Members together.
- API Credentials for service accounts that connect to Cribl Search via API.
Share Datasets, Dataset Providers, Dashboards, and Notebooks
Members, Teams, and API Credentials with the Search Editor or User Permission do not, by default, have access to view, edit, or search Datasets, Dataset Providers, Dashboards, or Notebooks. Admin Members, Teams, and API Credentials do have such access by default - they automatically inherit the Maintainer Permissions on resources at this level.
As a Maintainer, here is how to share a Dataset, Dataset Provider, Dashboard, or Notebook with a Member, Team, or API Credential whose Search Permission is User or Editor:
Select Data (for Datasets and Dataset Providers), Dashboards, or Notebooks from Cribl Search’s sidebar.
- For Datasets and Dataset Providers, select either the Datasets or Dataset Providers tab.
In the Actions column of the resource you want to share, select Share.
Under Add Members, Teams, and API Credentials:
- From the left drop-down menu, select the Member, Team, or API Credential that you want to share the Notebook with.
- From the right drop-down menu, select the Notebook Permission you want to grant: Read Only or Maintainer. For details, see Cribl Search Notebooks Permissions.
Select Add Access.
Select Save.
To modify or remove the resource-level Permission on a Dataset, Dataset Provider, Dashboard, or Notebook, find the Member, Team, or API Credential in the list on the Sharing pane. Select the desired Permission from the drop-down menu in the Permission column and save. Selecting No Access removes all access rights on the resource.
Revoke Dataset Access
If a Maintainer un-shares a Dataset from a Member or Team, or removes a Member from an authorized Team, the Member’s past interaction with the Dataset determines their remaining access.
If a Member has performed a search against the Dataset, they retain access to its data and search results in the search history.
However, the Dataset itself is no longer visible to the Member, and the Member cannot re-run searches against that Dataset.
Share Search Results
You can set search results as either Private (the default) or All Members. Private results are visible only to you, and are hidden from other Members and Teams.
After running a search and viewing its results, you can open the Actions drop-down to change the search’s Results Access.
You can also change the visibility of your searches with a set statement, using the
job_visibility option.
The Actions menu provides more options on the Fields and Charts tab than are displayed in the above screenshot, which is from the Events tab.
Share Scheduled Search Results
Open a scheduled search’s configuration modal to adjust its Results Access setting. Your saved setting applies to any subsequently created result sets from this search.
Share Search Results via URL
You can share displayed search results by copying the URL from your browser’s address bar.
This URL will encapsulate the search’s details and state - the query string, time-range selection, sample-ratio selection, and any chart and table settings applied in aggregated results.
Another Search Member, with appropriate Permissions, can paste this URL into their browser’s address bar to reload the search. This is equivalent to loading a cached search from History, so it consumes no additional credits.