CriblSearch
Cribl Search allows you to query, retrieve, and manage search jobs, datasets, and saved searches across your Cribl Cloud deployment.
IT Services · Cribl
Details
| ID | CriblSearch |
|---|---|
| Provider | Cribl |
| Category | IT Services |
| From Version | 6.10.0 |
| Docker Image | demisto/fastapi:0.125.0.10158186 |
README
Cribl Search is a search solution that allows you to query, retrieve, and manage search jobs, datasets, and saved searches across your Cribl Cloud deployment.
This integration was integrated and tested with version 4.17.0 of Cribl API.
Configure CriblSearch in Cortex
| Parameter | Description | Required |
|---|---|---|
| Base URL | The base URL assigned to your organization: https://${workspaceName}-${organizationId}.cribl.cloud | True |
| Client ID | True | |
| Client Secret | True | |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cribl-search-query
Runs a search query against Cribl Search and returns results.
Base Command
cribl-search-query
Input
| Argument Name | Description | Required |
|---|---|---|
| query_id | The ID of a saved query to execute. | Optional |
| job_id | The ID of an existing search job to retrieve results from. | Optional |
| query | The search query string to execute. | Optional |
| earliest | The start time for the search, in relative time or epoch seconds. | Optional |
| latest | The end time for the search, in relative time or epoch seconds. | Optional |
| sample_rate | The probability (0-1) of including each matching event (for example, 0.1 returns ~10%). If omitted, no sampling is applied. | Optional |
| force | Whether to force execution of a scheduled query. | Optional |
| page | The page number for pagination. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cribl.SearchQuery.events | Unknown | The list of events returned by the search (parsed from the NDJSON response). May be empty when the job is still queued/running. |
| Cribl.SearchQuery.isFinished | Boolean | Whether the search query has finished executing. |
| Cribl.SearchQuery.job | Object | The search job metadata associated with this query. |
| Cribl.SearchQuery.job.id | String | The unique identifier of the search job that produced these results. |
| Cribl.SearchQuery.job.query | String | The search query string executed by the job. |
| Cribl.SearchQuery.job.status | String | The current status of the search job (for example, queued, running, completed). |
| Cribl.SearchQuery.job.timeCreated | Number | The epoch (ms) when the search job was created. |
| Cribl.SearchQuery.offset | Number | The offset within the result set used for pagination. |
| Cribl.SearchQuery.persistedEventCount | Number | The number of events persisted in the result set. |
| Cribl.SearchQuery.totalEventCount | Number | Total number of events matched by the query. |
Command example
!cribl-search-query query="dataset=\"cribl_search_sample\" | project method, source, status, url | take 5" earliest="-24h" latest="now" limit=3
Context Example
{
"Cribl": {
"SearchQuery": {
"events": [],
"isFinished": false,
"job": {
"earliest": "-24h",
"id": "1777447153600.MgWe3v",
"latest": "now",
"query": "dataset=\"cribl_search_sample\" | project method, source, status, url | take 5",
"status": "queued",
"timeCreated": 1777447153600
},
"limit": 3,
"offset": 0,
"persistedEventCount": 0,
"totalEventCount": 0
}
}
}
Human Readable Output
Search Query - Job Info
Is Finished Job ID Status Query Earliest Latest Total Events false 1777447153600.MgWe3v queued dataset=”cribl_search_sample” | project method, source, status, url | take 5 -24h now 0
cribl-search-status
Retrieves the status of a specific search job.
Base Command
cribl-search-status
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The unique identifier of the search job. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Cribl.SearchStatus.pendingComputeNodeStatuses | Object | The counts of pending compute nodes (warm/cold) for the job. |
| Cribl.SearchStatus.status | String | The current status of the search job (for example, queued, running, completed). |
| Cribl.SearchStatus.timeCreated | Number | The epoch (ms) when the search job was created. |
| Cribl.SearchStatus.timeStarted | Number | The epoch (ms) when the search job started executing. This is only set once the job leaves the queued state. |
| Cribl.SearchStatus.timeCompleted | Number | The epoch (ms) when the search job completed. This is only set after the job finishes. |
Command example
!cribl-search-status job_id="1777207943198.pb0ZZ0"
Context Example
{
"Cribl": {
"SearchStatus": {
"cacheStatusesByStageId": {
"root": {
"cribl_search_sample": {
"cacheStatus": "miss",
"computeType": "v1",
"reason": "Not a Lake Dataset",
"usedCache": false
}
}
},
"pendingComputeNodeStatuses": {
"countCold": 0,
"countWarm": 0
},
"status": "completed",
"timeCompleted": 1777207949675,
"timeCreated": 1777207943198,
"timeNow": 1777447157205,
"timeStarted": 1777207943675
}
}
}
Human Readable Output
Search Job 1777207943198.pb0ZZ0 Status
Status Time Started Time Created Time Completed completed 1777207943675 1777207943198 1777207949675
cribl-search-result
Retrieves the results of a completed search job.
Base Command
cribl-search-result
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The unique identifier of the search job. | Required |
| lower_bound | The lower time bound for results (inclusive, epoch). | Optional |
| upper_bound | The upper time bound for results (exclusive, epoch). | Optional |
| page | The page number for pagination. | Optional |
| limit | The maximum number of results to return. Default is 50. | Optional |
| all_results | Whether to return all results. If true, overrides the limit argument. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cribl.SearchResult.events | Unknown | The list of events returned by the search (parsed from the NDJSON response). Each element is a free-form event object whose shape depends on the dataset and the query’s projection. |
| Cribl.SearchResult.isFinished | Boolean | Whether the search job has finished executing. |
| Cribl.SearchResult.job | Object | The search job metadata associated with these results. |
| Cribl.SearchResult.job.id | String | The unique identifier of the search job. |
| Cribl.SearchResult.job.query | String | The search query string executed by the job. |
| Cribl.SearchResult.job.status | String | The current status of the search job (for example, queued, running, completed). |
| Cribl.SearchResult.job.timeCreated | Number | The epoch (ms) when the search job was created. |
| Cribl.SearchResult.offset | Number | The offset within the result set used for pagination. |
| Cribl.SearchResult.persistedEventCount | Number | The number of events persisted in the result set. |
| Cribl.SearchResult.totalEventCount | Number | The total number of events matched by the search job. |
Command example
!cribl-search-result job_id="1777207943198.pb0ZZ0" limit=5
Context Example
{
"Cribl": {
"SearchResult": {
"events": [
{
"source": "s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-0RRoVn.2.raw.gz"
},
{
"source": "s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-0ZBHzD.2.raw.gz"
},
{
"source": "s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-2w9JEP.2.raw.gz"
},
{
"source": "s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-0RRoVn.2.raw.gz"
},
{
"source": "s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-0ZBHzD.2.raw.gz"
}
],
"isFinished": true,
"job": {
"earliest": "-24h",
"id": "1777207943198.pb0ZZ0",
"latest": "now",
"query": "dataset=\"cribl_search_sample\" | project method, source, status, url | take 5",
"status": "completed",
"timeCompleted": 1777207949675,
"timeCreated": 1777207943198,
"timeStarted": 1777207943675
},
"limit": 5,
"offset": 0,
"persistedEventCount": 5,
"totalEventCount": 5
}
}
}
Human Readable Output
Search Job 1777207943198.pb0ZZ0 Results - Job Info
Is Finished Job ID Status Query Earliest Latest Total Events true 1777207943198.pb0ZZ0 completed dataset=”cribl_search_sample” | project method, source, status, url | take 5 -24h now 5 Search Job 1777207943198.pb0ZZ0 Results - Events
source s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-0RRoVn.2.raw.gz s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-0ZBHzD.2.raw.gz s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-2w9JEP.2.raw.gz s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-0RRoVn.2.raw.gz s3://cribl-search-example/data/vpcflowlogs/2026/04/26/12/CriblOut-0ZBHzD.2.raw.gz
cribl-search-job-create
Creates a new search job in Cribl Search.
Base Command
cribl-search-job-create
Input
| Argument Name | Description | Required |
|---|---|---|
| query | The search query string. | Required |
| earliest | The start time for the search, in epoch seconds. | Optional |
| latest | The end time for the search, in epoch seconds. | Optional |
| sample_rate | The probability (0-1) of including each matching event (for example, 0.1 returns ~10%). If omitted, no sampling is applied. | Optional |
| num_events_before | The number of events to include before the target event. | Optional |
| num_events_after | The number of events to include after the target event. | Optional |
| target_event_time | The target event time (epoch seconds). | Optional |
| is_private | Whether the search job is private. Default is True. | Optional |
| set_options | A JSON string of additional search options. | Optional |
| expected_output_type | The expected output type for the search. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cribl.SearchJob.id | String | The unique identifier of the search job. |
| Cribl.SearchJob.user | String | The user identifier (client ID) that created the job. |
| Cribl.SearchJob.displayUsername | String | The display name of the user who created the job. |
| Cribl.SearchJob.group | String | The search group the job belongs to. |
| Cribl.SearchJob.query | String | The search query string executed by the job. |
| Cribl.SearchJob.status | String | The current status of the search job (for example, queued, running, completed). |
| Cribl.SearchJob.timeCreated | Number | The epoch (ms) when the search job was created. |
| Cribl.SearchJob.type | String | The type of search job (for example, standard, dashboard). |
| Cribl.SearchJob.usageGroupId | String | The identifier of the usage group the job is billed against. |
| Cribl.SearchJob.isPrivate | Boolean | Whether the search job is marked private. |
| Cribl.SearchJob.accelerated | Boolean | Whether the search job uses acceleration. |
| Cribl.SearchJob.earliest | String | The start time for the search, in relative time or epoch seconds. |
| Cribl.SearchJob.latest | String | The end time for the search, in relative time or epoch seconds. |
| Cribl.SearchJob.compatibilityChecks | Object | The compatibility check flags evaluated for the job. |
| Cribl.SearchJob.metadata | Object | The metadata about the query (for example, datasets, providers, operators, and functions). |
| Cribl.SearchJob.setOptions | Object | The additional search options provided when creating the job. |
| Cribl.SearchJob.stages | Unknown | The stages of the search job’s execution plan. |
| Cribl.SearchJob.internal | Object | The internal job state (compiled policies, role-derived limits, preprocessed query, etc.). Returned on create; not normally returned by list/update. |
| Cribl.SearchJob.userDetails | Object | The details about the user/credential that created the job. |
| Cribl.SearchJob.userDetails.email | String | The email address of the user who created the job. |
| Cribl.SearchJob.userDetails.username | String | The username of the user (or client ID, for API-credential users) who created the job. |
| Cribl.SearchJob.userDetails.displayUsername | String | The display name of the user who created the job. |
| Cribl.SearchJob.userDetails.type | String | The type of user identity (for example, apiCredential, sso). |
| Cribl.SearchJob.userDetails.roles | Unknown | The roles assigned to the user. |
Command example
!cribl-search-job-create query="dataset=\"cribl_search_sample\" | summarize cnt=count() by srcaddr"
Context Example
{
"Cribl": {
"SearchJob": {
"accelerated": false,
"compatibilityChecks": {
"datatypes": false
},
"displayUsername": "example.user@example.com",
"earliest": "-1h",
"group": "default_search",
"id": "1777447149939.xPWbOm",
"internal": {
"compiledPolicies": [
{
"actions": [
"*"
],
"object": "*"
},
{
"actions": [
"GET"
],
"object": "/system/users/EXAMPLECLIENTID0000000000000000@clients"
},
{
"actions": [
"PATCH"
],
"object": "/system/users/EXAMPLECLIENTID0000000000000000@clients/info"
}
],
"detectedKeyAccesses": {},
"email": "example.user@example.com",
"maxExecutors": 50,
"maxResultsPerSearch": 50000,
"maxRunningTimeRange": {
"maxSec": 86400
},
"preprocessedQuery": "dataset=\"cribl_search_sample\" | summarize cnt=count() by srcaddr",
"roles": [
"search_user",
"org_user",
"ws_user"
]
},
"isPrivate": true,
"latest": "now",
"metadata": {
"arguments": {},
"cloudProvider": "aws",
"computeTypes": {
"v1": 1
},
"datasets": {
"cribl_search_sample": 1
},
"functions": {
"count": 1
},
"operators": {
"dataset=\"cribl_search_sample\"": 1,
"summarize": 1
},
"providerTypes": {
"s3": 1
},
"providers": {
"cribl_s3sample_provider": 1
}
},
"query": "dataset=\"cribl_search_sample\" | summarize cnt=count() by srcaddr",
"setOptions": {},
"stages": [
{
"dependencies": [],
"filter": "(dataset == 'cribl_search_sample')",
"id": "root",
"resolvedDatasetIds": [
"cribl_search_sample"
],
"searchConfig": {
"canComputeMetadataDistributively": false,
"datasets": [
"cribl_search_sample"
],
"hasSendOperator": false,
"logicalPlans": {
"Combined": {
"root:0:2uw2": [
{
"condition": {
"caseSensitive": false,
"lhs": {
"columnPath": [
"dataset"
],
"type": "identifier"
},
"operator": "==",
"rhs": {
"literal": "cribl_search_sample",
"type": "literal"
},
"type": "binaryOperation"
},
"type": "filter"
}
],
"root:1:tTTC": [
{
"aggregates": [
{
"assignee": {
"columnPath": [
"cnt"
],
"type": "identifier"
},
"operation": {
"functionType": "aggregation",
"name": "count",
"parameters": [],
"type": "function"
},
"type": "assign"
}
],
"aggregationType": "summarize",
"canDistributeAggregation": false,
"groupBy": [
{
"columnPath": [
"srcaddr"
],
"type": "identifier"
}
],
"isPreviewableOperation": true,
"location": "coordinated",
"type": "aggregate"
}
],
"root:3:uDgk": [
{
"type": "noop"
}
]
},
"Coordinated": {
...
},
"Federated": {
...
}
},
"orderedFieldNames": [
"srcaddr",
"cnt"
],
"pipelines": {
"Combined": {
"conf": {
"asyncFuncTimeout": 1000,
"description": "Pipeline, generated from Kalipso query",
"functions": [
{
"canFullyPushToFederated": true,
"conf": {},
"description": "dataset=\"cribl_search_sample\"",
"disabled": false,
"filter": "!(dataset == 'cribl_search_sample')",
"final": false,
"functionInstanceId": "root:0:2uw2",
"id": "drop"
},
{
"canFullyPushToFederated": false,
"conf": {
"aggregations": [
"count().as(cnt)"
],
"cumulative": true,
"flushOnInputClose": false,
"groupbys": [
"srcaddr"
],
"metricsMode": false,
"preserveGroupBys": true,
"printUndefineds": true,
"searchAggMode": "Coordinated",
"sufficientStatsOnly": false,
"timeWindow": "1s"
},
"description": "summarize cnt=count() by srcaddr",
"disabled": false,
"filter": "true",
"final": false,
"functionInstanceId": "root:1:tTTC",
"id": "aggregation"
},
{
"canFullyPushToFederated": true,
"conf": {
"keep": [
"cnt",
"cnt.*",
"srcaddr",
"srcaddr.*"
],
"printUndefineds": true,
"remove": [
"*"
]
},
"description": "summarize cnt=count() by srcaddr",
"disabled": false,
"filter": "true",
"final": false,
"functionInstanceId": "root:3:uDgk",
"id": "eval"
}
]
},
"id": "root"
},
"Coordinated": {
...
},
"Federated": {
...
}
},
"referencedColumnPaths": [
[
"cnt"
],
[
"srcaddr"
]
],
"searchTerms": [],
"useFormattedVisualization": true
},
"searchVersionByDatasetId": {},
"status": "new",
"subQueryText": "dataset=\"cribl_search_sample\" | summarize cnt=count() by srcaddr"
}
],
"status": "queued",
"timeCreated": 1777447149939,
"type": "standard",
"usageGroupId": "default",
"user": "EXAMPLECLIENTID0000000000000000@clients",
"userDetails": {
"apiCredential": {
"clientId": "EXAMPLECLIENTID0000000000000000@clients",
"createdBy": "example.user@example.com",
"name": "example.user@example.com"
},
"displayUsername": "example.user@example.com",
"email": "example.user@example.com",
"roles": [
"search_user",
"org_user",
"ws_user"
],
"ssoGroups": [],
"type": "apiCredential",
"username": "EXAMPLECLIENTID0000000000000000@clients"
}
}
}
}
Human Readable Output
Search Job Created
User ID Is Private Type Status EXAMPLECLIENTID0000000000000000@clients 1777447149939.xPWbOm true standard queued
cribl-search-job-list
Retrieves a list of search jobs or details of a specific search job.
Base Command
cribl-search-job-list
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The unique identifier of a specific search job to retrieve. | Optional |
| limit | The maximum number of results to return. Default is 10. | Optional |
| all_results | Whether to return all results. If true, overrides the limit argument. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cribl.SearchJob.id | String | Unique identifier of the search job. |
| Cribl.SearchJob.user | String | User identifier (client ID) that created the job. |
| Cribl.SearchJob.displayUsername | String | Display name of the user who created the job. |
| Cribl.SearchJob.group | String | Search group the job belongs to. |
| Cribl.SearchJob.query | String | The search query string executed by the job. |
| Cribl.SearchJob.status | String | Current status of the search job (e.g., queued, running, completed). |
| Cribl.SearchJob.timeCreated | Number | Epoch (ms) when the search job was created. |
| Cribl.SearchJob.timeStarted | Number | Epoch (ms) when the search job started executing. |
| Cribl.SearchJob.timeCompleted | Number | Epoch (ms) when the search job completed. |
| Cribl.SearchJob.type | String | Type of search job (e.g., standard, dashboard). |
| Cribl.SearchJob.isPrivate | Boolean | Whether the search job is marked private. |
| Cribl.SearchJob.accelerated | Boolean | Whether the search job uses acceleration. |
| Cribl.SearchJob.earliest | String | Earliest time boundary for the search (relative time string or epoch seconds). |
| Cribl.SearchJob.earliestEpoch | Number | Resolved earliest time boundary in epoch milliseconds. |
| Cribl.SearchJob.latest | String | Latest time boundary for the search (relative time string or epoch seconds). |
| Cribl.SearchJob.latestEpoch | Number | Resolved latest time boundary in epoch milliseconds. |
| Cribl.SearchJob.cpuMetrics | Object | CPU usage metrics for the executed job (billable seconds, per-executor breakdown, totals). |
| Cribl.SearchJob.compatibilityChecks | Object | Compatibility check flags evaluated for the job. |
| Cribl.SearchJob.metadata | Object | Metadata about the query (datasets, providers, operators, functions, etc.). |
| Cribl.SearchJob.setOptions | Object | Additional search options provided when creating the job. |
| Cribl.SearchJob.stages | Unknown | Stages of the search job’s execution plan, including per-stage cache status and search config. |
Command example
!cribl-search-job-list limit=3
Context Example
{
"Cribl": {
"SearchJob": [
{
"accelerated": false,
"compatibilityChecks": {
"datatypes": false
},
"cpuMetrics": {
"billableCPUSeconds": 24.78200000000004,
"executorsCPUSeconds": {
"23ywr3HV": 0.621,
"2C3c5u1h": 0.619,
"2G7pjwPk": 0.6,
"COORDINATOR": 5.817,
...
},
"totalCPUSeconds": 24.78200000000004,
"totalExecCPUSeconds": 24.78200000000004
},
"displayUsername": "example.user@example.com",
"earliest": "-24h",
"earliestEpoch": 1777121543198,
"group": "default_search",
"id": "1777207943198.pb0ZZ0",
"isPrivate": true,
"latest": "now",
"latestEpoch": 1777207943198,
"metadata": {
"arguments": {},
"cloudProvider": "aws",
"computeTypes": {
"v1": 1
},
"datasets": {
"cribl_search_sample": 1
},
"functions": {},
"operators": {
"dataset=\"cribl_search_sample\"": 1,
"project": 1,
"take": 1
},
"providerTypes": {
"s3": 1
},
"providers": {
"cribl_s3sample_provider": 1
}
},
"query": "dataset=\"cribl_search_sample\" | project method, source, status, url | take 5",
"setOptions": {},
"stages": [
{
"cacheStatusByDatasetId": {
"cribl_search_sample": {
"cacheStatus": "miss",
"computeType": "v1",
"reason": "Not a Lake Dataset",
"usedCache": false
}
},
"dependencies": [],
"filter": "(dataset == 'cribl_search_sample')",
"id": "root",
"resolvedDatasetIds": [
"cribl_search_sample"
],
"searchConfig": {
"canComputeMetadataDistributively": false,
"datasets": [
"cribl_search_sample"
],
"hasSendOperator": false,
"logicalPlans": {
"Combined": {
"root:0:HEER": [
{
"condition": {
"caseSensitive": false,
"lhs": {
"columnPath": [
"dataset"
],
"type": "identifier"
},
"operator": "==",
"rhs": {
"literal": "cribl_search_sample",
"type": "literal"
},
"type": "binaryOperation"
},
"type": "filter"
}
],
"root:1:UBPo": [
{
"add": [
{
"columnPath": [
"method"
],
"type": "identifier"
},
{
"columnPath": [
"source"
],
"type": "identifier"
},
{
"columnPath": [
"status"
],
"type": "identifier"
},
{
"columnPath": [
"url"
],
"type": "identifier"
}
],
"removeOthers": true,
"type": "project"
}
],
"root:3:Xm06": [
{
"limit": 5,
"type": "limit"
}
]
},
"Coordinated": {
...
},
"Federated": {
...
}
},
"orderedFieldNames": [
"method",
"source",
"status",
"url"
],
"pipelines": {
"Combined": {
"conf": {
"asyncFuncTimeout": 1000,
"description": "Pipeline, generated from Kalipso query",
"functions": [
{
"canFullyPushToFederated": true,
"conf": {},
"description": "dataset=\"cribl_search_sample\"",
"disabled": false,
"filter": "!(dataset == 'cribl_search_sample')",
"final": false,
"functionInstanceId": "root:0:HEER",
"id": "drop"
},
{
"canFullyPushToFederated": false,
"conf": {
"limit": 5
},
"description": "take 5",
"disabled": false,
"filter": "true",
"final": false,
"functionInstanceId": "root:3:Xm06",
"id": "limit"
},
{
"canFullyPushToFederated": true,
"conf": {
"keep": [
"method",
"method.*",
"source",
"source.*",
"status",
"status.*",
"url",
"url.*"
],
"printUndefineds": true,
"remove": [
"*"
]
},
"description": "project method, source, status, url",
"disabled": false,
"filter": "true",
"final": false,
"functionInstanceId": "root:1:UBPo",
"id": "eval"
}
]
},
"id": "root"
},
"Coordinated": {
...
},
"Federated": {
...
}
},
"referencedColumnPaths": [
[
"method"
],
[
"source"
],
[
"status"
],
[
"url"
]
],
"searchTerms": [],
"useFormattedVisualization": true
},
"searchVersionByDatasetId": {},
"status": "completed",
"subQueryText": "dataset=\"cribl_search_sample\" | project method, source, status, url | take 5"
}
],
"status": "completed",
"timeCompleted": 1777207949675,
"timeCreated": 1777207943198,
"timeStarted": 1777207943675,
"type": "dashboard",
"user": "EXAMPLECLIENTID0000000000000000@clients"
},
...
]
}
}
Human Readable Output
Search Jobs List
User ID Is Private Type Status EXAMPLECLIENTID0000000000000000@clients 1777207943198.pb0ZZ0 true dashboard completed EXAMPLECLIENTID0000000000000000@clients 1777208015306.F0hxMo true dashboard completed EXAMPLECLIENTID0000000000000000@clients 1777208286161.tTkDeJ true dashboard completed
cribl-search-job-update
Updates a search job’s status or privacy setting. At least one of status or is_private must be provided.
Base Command
cribl-search-job-update
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The unique identifier of the search job to update. | Required |
| status | The new status for the search job (e.g., completed, canceled). | Optional |
| is_private | Whether the search job should be private. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cribl.SearchJob.id | String | Unique identifier of the search job. |
| Cribl.SearchJob.user | String | User identifier (client ID) that created the job. |
| Cribl.SearchJob.displayUsername | String | Display name of the user who created the job. |
| Cribl.SearchJob.group | String | Search group the job belongs to. |
| Cribl.SearchJob.query | String | The search query string executed by the job. |
| Cribl.SearchJob.status | String | Current status of the search job (e.g., queued, running, completed). |
| Cribl.SearchJob.timeCreated | Number | Epoch (ms) when the search job was created. |
| Cribl.SearchJob.timeStarted | Number | Epoch (ms) when the search job started executing. |
| Cribl.SearchJob.timeCompleted | Number | Epoch (ms) when the search job completed. |
| Cribl.SearchJob.type | String | Type of search job (e.g., standard, dashboard). |
| Cribl.SearchJob.isPrivate | Boolean | Whether the search job is marked private. |
| Cribl.SearchJob.accelerated | Boolean | Whether the search job uses acceleration. |
| Cribl.SearchJob.earliest | String | Earliest time boundary for the search (relative time string or epoch seconds). |
| Cribl.SearchJob.earliestEpoch | Number | Resolved earliest time boundary in epoch milliseconds. |
| Cribl.SearchJob.latest | String | Latest time boundary for the search (relative time string or epoch seconds). |
| Cribl.SearchJob.latestEpoch | Number | Resolved latest time boundary in epoch milliseconds. |
| Cribl.SearchJob.compatibilityChecks | Object | Compatibility check flags evaluated for the job. |
| Cribl.SearchJob.metadata | Object | Metadata about the query (datasets, providers, operators, functions, etc.). |
| Cribl.SearchJob.setOptions | Object | Additional search options provided when creating the job. |
| Cribl.SearchJob.stages | Unknown | Stages of the search job’s execution plan, including per-stage cache status and search config. |
| Cribl.SearchJob.userDetails | Object | Details about the user/credential that created the job. |
| Cribl.SearchJob.userDetails.email | String | Email address of the user who created the job. |
| Cribl.SearchJob.userDetails.username | String | Username of the user (or client ID, for API-credential users) who created the job. |
| Cribl.SearchJob.userDetails.displayUsername | String | Display name of the user who created the job. |
| Cribl.SearchJob.userDetails.type | String | Type of user identity (e.g., apiCredential, sso). |
| Cribl.SearchJob.userDetails.roles | Unknown | Roles assigned to the user. |
Command example
!cribl-search-job-update job_id="1777446985069.KSZQ5h" is_private=true
Context Example
{
"Cribl": {
"SearchJob": {
"accelerated": false,
"compatibilityChecks": {
"datatypes": false
},
"displayUsername": "example.user@example.com",
"earliest": "-1h",
"earliestEpoch": 1777443385069,
"group": "default_search",
"id": "1777446985069.KSZQ5h",
"isPrivate": true,
"latest": "now",
"latestEpoch": 1777446985069,
"metadata": {
"arguments": {},
"cloudProvider": "aws",
"computeTypes": {
"v1": 1
},
"datasets": {
"cribl_search_sample": 1
},
"functions": {
"count": 1
},
"operators": {
"dataset=\"cribl_search_sample\"": 1,
"summarize": 1
},
"providerTypes": {
"s3": 1
},
"providers": {
"cribl_s3sample_provider": 1
}
},
"query": "dataset=\"cribl_search_sample\" | summarize cnt=count() by srcaddr",
"setOptions": {},
"stages": [
{
"cacheStatusByDatasetId": {
"cribl_search_sample": {
"cacheStatus": "miss",
"computeType": "v1",
"reason": "Not a Lake Dataset",
"usedCache": false
}
},
"dependencies": [],
"filter": "(dataset == 'cribl_search_sample')",
"id": "root",
"resolvedDatasetIds": [
"cribl_search_sample"
],
"searchConfig": {
"canComputeMetadataDistributively": false,
"datasets": [
"cribl_search_sample"
],
"hasSendOperator": false,
"logicalPlans": {
"Combined": {
"root:0:R25N": [
{
"condition": {
"caseSensitive": false,
"lhs": {
"columnPath": [
"dataset"
],
"type": "identifier"
},
"operator": "==",
"rhs": {
"literal": "cribl_search_sample",
"type": "literal"
},
"type": "binaryOperation"
},
"type": "filter"
}
],
"root:1:TFOw": [
{
"aggregates": [
{
"assignee": {
"columnPath": [
"cnt"
],
"type": "identifier"
},
"operation": {
"functionType": "aggregation",
"name": "count",
"parameters": [],
"type": "function"
},
"type": "assign"
}
],
"aggregationType": "summarize",
"canDistributeAggregation": false,
"groupBy": [
{
"columnPath": [
"srcaddr"
],
"type": "identifier"
}
],
"isPreviewableOperation": true,
"location": "coordinated",
"type": "aggregate"
}
],
"root:3:zikB": [
{
"type": "noop"
}
]
},
"Coordinated": {
...
},
"Federated": {
...
}
},
"orderedFieldNames": [
"srcaddr",
"cnt"
],
"pipelines": {
"Combined": {
"conf": {
"asyncFuncTimeout": 1000,
"description": "Pipeline, generated from Kalipso query",
"functions": [
{
"canFullyPushToFederated": true,
"conf": {},
"description": "dataset=\"cribl_search_sample\"",
"disabled": false,
"filter": "!(dataset == 'cribl_search_sample')",
"final": false,
"functionInstanceId": "root:0:R25N",
"id": "drop"
},
{
"canFullyPushToFederated": false,
"conf": {
"aggregations": [
"count().as(cnt)"
],
"cumulative": true,
"flushOnInputClose": false,
"groupbys": [
"srcaddr"
],
"metricsMode": false,
"preserveGroupBys": true,
"printUndefineds": true,
"searchAggMode": "Coordinated",
"sufficientStatsOnly": false,
"timeWindow": "1s"
},
"description": "summarize cnt=count() by srcaddr",
"disabled": false,
"filter": "true",
"final": false,
"functionInstanceId": "root:1:TFOw",
"id": "aggregation"
},
{
"canFullyPushToFederated": true,
"conf": {
"keep": [
"cnt",
"cnt.*",
"srcaddr",
"srcaddr.*"
],
"printUndefineds": true,
"remove": [
"*"
]
},
"description": "summarize cnt=count() by srcaddr",
"disabled": false,
"filter": "true",
"final": false,
"functionInstanceId": "root:3:zikB",
"id": "eval"
}
]
},
"id": "root"
},
"Coordinated": {
...
},
"Federated": {
...
}
},
"referencedColumnPaths": [
[
"cnt"
],
[
"srcaddr"
]
],
"searchTerms": [],
"useFormattedVisualization": true
},
"searchVersionByDatasetId": {},
"status": "completed",
"subQueryText": "dataset=\"cribl_search_sample\" | summarize cnt=count() by srcaddr"
}
],
"status": "completed",
"timeCompleted": 1777446992662,
"timeCreated": 1777446985069,
"timeStarted": 1777446985598,
"type": "standard",
"user": "EXAMPLECLIENTID0000000000000000@clients",
"userDetails": {
"apiCredential": {
"clientId": "EXAMPLECLIENTID0000000000000000@clients",
"createdBy": "example.user@example.com",
"name": "example.user@example.com"
},
"displayUsername": "example.user@example.com",
"email": "example.user@example.com",
"roles": [
"search_user",
"org_user",
"ws_user"
],
"ssoGroups": [],
"type": "apiCredential",
"username": "EXAMPLECLIENTID0000000000000000@clients"
}
}
}
}
Human Readable Output
The job 1777446985069.KSZQ5h has been successfully updated.
cribl-search-job-delete
Deletes a specific search job.
Base Command
cribl-search-job-delete
Input
| Argument Name | Description | Required |
|---|---|---|
| job_id | The unique identifier of the search job to delete. | Required |
Context Output
There is no context output for this command.
Command example
!cribl-search-job-delete job_id="1777446985069.KSZQ5h"
Human Readable Output
The job 1777446985069.KSZQ5h has been successfully deleted.
cribl-search-dataset-list
Retrieves a list of available datasets or details of a specific dataset.
Base Command
cribl-search-dataset-list
Input
| Argument Name | Description | Required |
|---|---|---|
| dataset_id | The unique identifier of a specific dataset to retrieve. | Optional |
| limit | The maximum number of results to return. Default is 10. | Optional |
| all_results | Whether to return all results. If true, overrides the limit argument. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cribl.SearchDataset.id | String | The unique identifier of the dataset. |
| Cribl.SearchDataset.type | String | The dataset provider type (for example, s3, azure_blob, gcs). |
| Cribl.SearchDataset.provider | String | The identifier of the provider configuration backing the dataset. |
| Cribl.SearchDataset.region | String | The cloud region where the dataset’s underlying storage resides (when applicable). |
| Cribl.SearchDataset.bucket | String | The bucket/path template that locates the dataset’s underlying objects. |
| Cribl.SearchDataset.description | String | The human-readable description of the dataset. |
| Cribl.SearchDataset.filter | String | The filter expression applied to events from the dataset; defaults to “true” (passes all events). |
| Cribl.SearchDataset.tags | Unknown | The tags assigned to the dataset (string or array of strings). |
| Cribl.SearchDataset.breakerRulesets | Unknown | The event breaker rulesets associated with the dataset. |
| Cribl.SearchDataset.storageClasses | Unknown | The storage classes the dataset is configured to read from. |
| Cribl.SearchDataset.staleChannelFlushMs | Number | The time in milliseconds after which a stale channel is flushed during ingestion. |
Command example
!cribl-search-dataset-list limit=3
Context Example
{
"Cribl": {
"SearchDataset": {
"breakerRulesets": [
"AWS Datatypes",
"Apache Datatypes",
"Syslog Datatypes",
"Cribl Search",
"Microsoft Windows Datatypes",
"Azure Datatypes",
"Microsoft O365 Datatypes",
"Microsoft Graph API Datatypes"
],
"bucket": "cribl-search-example/data/${dataSource}/${_time:%Y}/${_time:%m}/${_time:%d}/${_time:%H}",
"description": "Search Cribl provided public sample data",
"filter": "true",
"id": "cribl_search_sample",
"provider": "cribl_s3sample_provider",
"region": "us-west-2",
"staleChannelFlushMs": 10000,
"storageClasses": [
"STANDARD",
"INTELLIGEN",
"STANDARD_I",
"ONEZONE_IA",
"GLACIER_IR",
"REDUCED_RE",
"_RESTORED"
],
"tags": "cribl:default",
"type": "s3"
}
}
}
Human Readable Output
Datasets List
ID Provider Type Region cribl_search_sample cribl_s3sample_provider s3 us-west-2
cribl-saved-search-list
Retrieves a list of saved searches or details of a specific saved search.
Base Command
cribl-saved-search-list
Input
| Argument Name | Description | Required |
|---|---|---|
| search_id | The unique identifier of a specific saved search to retrieve. | Optional |
| limit | The maximum number of results to return. Default is 10. | Optional |
| all_results | Whether to return all results. If true, overrides the limit argument. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cribl.SavedSearch.id | String | The unique identifier of the saved search. |
| Cribl.SavedSearch.name | String | The display name of the saved search. |
| Cribl.SavedSearch.query | String | The search query string defined by the saved search. |
Command example
!cribl-saved-search-list limit=3
Context Example
{
"Cribl": {
"SavedSearch": [
{
"description": "Searches finished in the last 1h",
"earliest": "-1h",
"id": "cribl_search_finished_1h",
"latest": "now",
"lib": "cribl",
"name": "cribl_search_finished_1h",
"query": "cribl dataset=\"cribl_internal_logs\" source=*searches.log message=\"search finished\" | summarize count(), elapsedMS=sum(stats.elapsedMs), eventsFound=sum(stats.eventsFound) by user=coalesce(stats.userDisplayName, stats.user)"
},
{
"description": "Searches started in the last 1h",
"earliest": "-1h",
"id": "cribl_search_started_1h",
"latest": "now",
"lib": "cribl",
"name": "cribl_search_started_1h",
"query": "cribl dataset=\"cribl_internal_logs\" source=*searches.log message=\"search started\" | summarize count() by user=coalesce(stats.userDisplayName, stats.user)"
}
]
}
}
Human Readable Output
Saved Searches List
ID Description Name Query cribl_search_finished_1h Searches finished in the last 1h cribl_search_finished_1h cribl dataset=”cribl_internal_logs” source=*searches.log message=”search finished” | summarize count(), elapsedMS=sum(stats.elapsedMs), eventsFound=sum(stats.eventsFound) by user=coalesce(stats.userDisplayName, stats.user) cribl_search_started_1h Searches started in the last 1h cribl_search_started_1h cribl dataset=”cribl_internal_logs” source=*searches.log message=”search started” | summarize count() by user=coalesce(stats.userDisplayName, stats.user)
Configuration parameters
url— Base URL (required)credentials— Client ID (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (9)
-
cribl-saved-search-listRetrieves a list of saved searches or details of a specific saved search.
-
cribl-search-dataset-listRetrieves a list of available datasets or details of a specific dataset.
-
cribl-search-job-createCreates a new search job in Cribl Search.
-
cribl-search-job-deleteDeletes a specific search job.
-
cribl-search-job-listRetrieves a list of search jobs or details of a specific search job.
-
cribl-search-job-updateUpdates a search job's status or privacy setting. At least one of status or is_private must be provided.
-
cribl-search-queryRuns a search query against Cribl Search and returns results.
-
cribl-search-resultRetrieves the results of a completed search job.
-
cribl-search-statusRetrieves the status of a specific search job.
category: IT Services commonfields: id: CriblSearch version: -1 provider: Cribl configuration: - defaultvalue: https://${workspaceName}-${organizationId}.cribl.cloud display: Base URL name: url required: true type: 0 additionalinfo: 'The base URL assigned to your organization: https://${workspaceName}-${organizationId}.cribl.cloud' section: Connect - name: credentials display: Client ID displaypassword: Client Secret type: 9 required: true section: Connect - display: Trust any certificate (not secure) name: insecure required: false type: 8 section: Connect - display: Use system proxy settings name: proxy required: false type: 8 section: Connect description: Cribl Search allows you to query, retrieve, and manage search jobs, datasets, and saved searches across your Cribl Cloud deployment. display: Cribl Search name: CriblSearch script: commands: - name: cribl-search-query description: Runs a search query against Cribl Search and returns results. execution: false arguments: - name: query_id required: false description: The ID of a saved query to execute. - name: job_id required: false description: The ID of an existing search job to retrieve results from. - name: query required: false description: The search query string to execute. - name: earliest required: false description: The start time for the search, in relative time or epoch seconds. - name: latest required: false description: The end time for the search, in relative time or epoch seconds. - name: sample_rate required: false description: The probability (0-1) of including each matching event (for example, 0.1 returns ~10%). If omitted, no sampling is applied. - name: force required: false defaultValue: false description: Whether to force execution of a scheduled query. - name: page required: false description: The page number for pagination. - name: limit required: false defaultValue: 50 description: The maximum number of results to return. outputs: - contextPath: Cribl.SearchQuery.events description: The list of events returned by the search (parsed from the NDJSON response). May be empty when the job is still queued/running. type: Unknown - contextPath: Cribl.SearchQuery.isFinished description: Whether the search query has finished executing. type: Boolean - contextPath: Cribl.SearchQuery.job description: The search job metadata associated with this query. type: Object - contextPath: Cribl.SearchQuery.job.id description: The unique identifier of the search job that produced these results. type: String - contextPath: Cribl.SearchQuery.job.query description: The search query string executed by the job. type: String - contextPath: Cribl.SearchQuery.job.status description: The current status of the search job (for example, queued, running, completed). type: String - contextPath: Cribl.SearchQuery.job.timeCreated description: The epoch (ms) when the search job was created. type: Number - contextPath: Cribl.SearchQuery.offset description: The offset within the result set used for pagination. type: Number - contextPath: Cribl.SearchQuery.persistedEventCount description: The number of events persisted in the result set. type: Number - contextPath: Cribl.SearchQuery.totalEventCount description: Total number of events matched by the query. type: Number - name: cribl-search-status description: Retrieves the status of a specific search job. execution: false arguments: - name: job_id required: true description: The unique identifier of the search job. outputs: - contextPath: Cribl.SearchStatus.pendingComputeNodeStatuses description: The counts of pending compute nodes (warm/cold) for the job. type: Object - contextPath: Cribl.SearchStatus.status description: The current status of the search job (for example, queued, running, completed). type: String - contextPath: Cribl.SearchStatus.timeCreated description: The epoch (ms) when the search job was created. type: Number - contextPath: Cribl.SearchStatus.timeStarted description: The epoch (ms) when the search job started executing. This is only set once the job leaves the queued state. type: Number - contextPath: Cribl.SearchStatus.timeCompleted description: The epoch (ms) when the search job completed. This is only set after the job finishes. type: Number - name: cribl-search-result description: Retrieves the results of a completed search job. execution: false arguments: - name: job_id required: true description: The unique identifier of the search job. - name: lower_bound required: false description: The lower time bound for results (inclusive, epoch). - name: upper_bound required: false description: The upper time bound for results (exclusive, epoch). - name: page required: false description: The page number for pagination. - name: limit required: false defaultValue: 50 description: The maximum number of results to return. - name: all_results required: false defaultValue: false description: Whether to return all results. If true, overrides the limit argument. outputs: - contextPath: Cribl.SearchResult.events description: The list of events returned by the search (parsed from the NDJSON response). Each element is a free-form event object whose shape depends on the dataset and the query's projection. type: Unknown - contextPath: Cribl.SearchResult.isFinished description: Whether the search job has finished executing. type: Boolean - contextPath: Cribl.SearchResult.job description: The search job metadata associated with these results. type: Object - contextPath: Cribl.SearchResult.job.id description: The unique identifier of the search job. type: String - contextPath: Cribl.SearchResult.job.query description: The search query string executed by the job. type: String - contextPath: Cribl.SearchResult.job.status description: The current status of the search job (for example, queued, running, completed). type: String - contextPath: Cribl.SearchResult.job.timeCreated description: The epoch (ms) when the search job was created. type: Number - contextPath: Cribl.SearchResult.offset description: The offset within the result set used for pagination. type: Number - contextPath: Cribl.SearchResult.persistedEventCount description: The number of events persisted in the result set. type: Number - contextPath: Cribl.SearchResult.totalEventCount description: The total number of events matched by the search job. type: Number - name: cribl-search-job-create description: Creates a new search job in Cribl Search. execution: false arguments: - name: query required: true description: The search query string. - name: earliest required: false description: The start time for the search, in epoch seconds. - name: latest required: false description: The end time for the search, in epoch seconds. - name: sample_rate required: false description: The probability (0-1) of including each matching event (for example, 0.1 returns ~10%). If omitted, no sampling is applied. - name: num_events_before required: false description: The number of events to include before the target event. - name: num_events_after required: false description: The number of events to include after the target event. - name: target_event_time required: false description: The target event time (epoch seconds). - name: is_private required: false defaultValue: true description: Whether the search job is private. - name: set_options required: false description: A JSON string of additional search options. - name: expected_output_type required: false description: The expected output type for the search. outputs: - contextPath: Cribl.SearchJob.id description: The unique identifier of the search job. type: String - contextPath: Cribl.SearchJob.user description: The user identifier (client ID) that created the job. type: String - contextPath: Cribl.SearchJob.displayUsername description: The display name of the user who created the job. type: String - contextPath: Cribl.SearchJob.group description: The search group the job belongs to. type: String - contextPath: Cribl.SearchJob.query description: The search query string executed by the job. type: String - contextPath: Cribl.SearchJob.status description: The current status of the search job (for example, queued, running, completed). type: String - contextPath: Cribl.SearchJob.timeCreated description: The epoch (ms) when the search job was created. type: Number - contextPath: Cribl.SearchJob.type description: The type of search job (for example, standard, dashboard). type: String - contextPath: Cribl.SearchJob.usageGroupId description: The identifier of the usage group the job is billed against. type: String - contextPath: Cribl.SearchJob.isPrivate description: Whether the search job is marked private. type: Boolean - contextPath: Cribl.SearchJob.accelerated description: Whether the search job uses acceleration. type: Boolean - contextPath: Cribl.SearchJob.earliest description: The start time for the search, in relative time or epoch seconds. type: String - contextPath: Cribl.SearchJob.latest description: The end time for the search, in relative time or epoch seconds. type: String - contextPath: Cribl.SearchJob.compatibilityChecks description: The compatibility check flags evaluated for the job. type: Object - contextPath: Cribl.SearchJob.metadata description: The metadata about the query (for example, datasets, providers, operators, and functions). type: Object - contextPath: Cribl.SearchJob.setOptions description: The additional search options provided when creating the job. type: Object - contextPath: Cribl.SearchJob.stages description: The stages of the search job's execution plan. type: Unknown - contextPath: Cribl.SearchJob.internal description: The internal job state (compiled policies, role-derived limits, preprocessed query, etc.). Returned on create; not normally returned by list/update. type: Object - contextPath: Cribl.SearchJob.userDetails description: The details about the user/credential that created the job. type: Object - contextPath: Cribl.SearchJob.userDetails.email description: The email address of the user who created the job. type: String - contextPath: Cribl.SearchJob.userDetails.username description: The username of the user (or client ID, for API-credential users) who created the job. type: String - contextPath: Cribl.SearchJob.userDetails.displayUsername description: The display name of the user who created the job. type: String - contextPath: Cribl.SearchJob.userDetails.type description: The type of user identity (for example, apiCredential, sso). type: String - contextPath: Cribl.SearchJob.userDetails.roles description: The roles assigned to the user. type: Unknown - name: cribl-search-job-list description: Retrieves a list of search jobs or details of a specific search job. execution: false arguments: - name: job_id required: false description: The unique identifier of a specific search job to retrieve. - name: limit required: false defaultValue: 10 description: The maximum number of results to return. - name: all_results required: false defaultValue: false description: Whether to return all results. If true, overrides the limit argument. outputs: - contextPath: Cribl.SearchJob.id description: Unique identifier of the search job. type: String - contextPath: Cribl.SearchJob.user description: User identifier (client ID) that created the job. type: String - contextPath: Cribl.SearchJob.displayUsername description: Display name of the user who created the job. type: String - contextPath: Cribl.SearchJob.group description: Search group the job belongs to. type: String - contextPath: Cribl.SearchJob.query description: The search query string executed by the job. type: String - contextPath: Cribl.SearchJob.status description: Current status of the search job (e.g., queued, running, completed). type: String - contextPath: Cribl.SearchJob.timeCreated description: Epoch (ms) when the search job was created. type: Number - contextPath: Cribl.SearchJob.timeStarted description: Epoch (ms) when the search job started executing. type: Number - contextPath: Cribl.SearchJob.timeCompleted description: Epoch (ms) when the search job completed. type: Number - contextPath: Cribl.SearchJob.type description: Type of search job (e.g., standard, dashboard). type: String - contextPath: Cribl.SearchJob.isPrivate description: Whether the search job is marked private. type: Boolean - contextPath: Cribl.SearchJob.accelerated description: Whether the search job uses acceleration. type: Boolean - contextPath: Cribl.SearchJob.earliest description: Earliest time boundary for the search (relative time string or epoch seconds). type: String - contextPath: Cribl.SearchJob.earliestEpoch description: Resolved earliest time boundary in epoch milliseconds. type: Number - contextPath: Cribl.SearchJob.latest description: Latest time boundary for the search (relative time string or epoch seconds). type: String - contextPath: Cribl.SearchJob.latestEpoch description: Resolved latest time boundary in epoch milliseconds. type: Number - contextPath: Cribl.SearchJob.cpuMetrics description: CPU usage metrics for the executed job (billable seconds, per-executor breakdown, totals). type: Object - contextPath: Cribl.SearchJob.compatibilityChecks description: Compatibility check flags evaluated for the job. type: Object - contextPath: Cribl.SearchJob.metadata description: Metadata about the query (datasets, providers, operators, functions, etc.). type: Object - contextPath: Cribl.SearchJob.setOptions description: Additional search options provided when creating the job. type: Object - contextPath: Cribl.SearchJob.stages description: Stages of the search job's execution plan, including per-stage cache status and search config. type: Unknown - name: cribl-search-job-update description: Updates a search job's status or privacy setting. At least one of status or is_private must be provided. execution: false arguments: - name: job_id required: true description: The unique identifier of the search job to update. - name: status required: false description: The new status for the search job (e.g., completed, canceled). - name: is_private required: false description: Whether the search job should be private. outputs: - contextPath: Cribl.SearchJob.id description: Unique identifier of the search job. type: String - contextPath: Cribl.SearchJob.user description: User identifier (client ID) that created the job. type: String - contextPath: Cribl.SearchJob.displayUsername description: Display name of the user who created the job. type: String - contextPath: Cribl.SearchJob.group description: Search group the job belongs to. type: String - contextPath: Cribl.SearchJob.query description: The search query string executed by the job. type: String - contextPath: Cribl.SearchJob.status description: Current status of the search job (e.g., queued, running, completed). type: String - contextPath: Cribl.SearchJob.timeCreated description: Epoch (ms) when the search job was created. type: Number - contextPath: Cribl.SearchJob.timeStarted description: Epoch (ms) when the search job started executing. type: Number - contextPath: Cribl.SearchJob.timeCompleted description: Epoch (ms) when the search job completed. type: Number - contextPath: Cribl.SearchJob.type description: Type of search job (e.g., standard, dashboard). type: String - contextPath: Cribl.SearchJob.isPrivate description: Whether the search job is marked private. type: Boolean - contextPath: Cribl.SearchJob.accelerated description: Whether the search job uses acceleration. type: Boolean - contextPath: Cribl.SearchJob.earliest description: Earliest time boundary for the search (relative time string or epoch seconds). type: String - contextPath: Cribl.SearchJob.earliestEpoch description: Resolved earliest time boundary in epoch milliseconds. type: Number - contextPath: Cribl.SearchJob.latest description: Latest time boundary for the search (relative time string or epoch seconds). type: String - contextPath: Cribl.SearchJob.latestEpoch description: Resolved latest time boundary in epoch milliseconds. type: Number - contextPath: Cribl.SearchJob.compatibilityChecks description: Compatibility check flags evaluated for the job. type: Object - contextPath: Cribl.SearchJob.metadata description: Metadata about the query (datasets, providers, operators, functions, etc.). type: Object - contextPath: Cribl.SearchJob.setOptions description: Additional search options provided when creating the job. type: Object - contextPath: Cribl.SearchJob.stages description: Stages of the search job's execution plan, including per-stage cache status and search config. type: Unknown - contextPath: Cribl.SearchJob.userDetails description: Details about the user/credential that created the job. type: Object - contextPath: Cribl.SearchJob.userDetails.email description: Email address of the user who created the job. type: String - contextPath: Cribl.SearchJob.userDetails.username description: Username of the user (or client ID, for API-credential users) who created the job. type: String - contextPath: Cribl.SearchJob.userDetails.displayUsername description: Display name of the user who created the job. type: String - contextPath: Cribl.SearchJob.userDetails.type description: Type of user identity (e.g., apiCredential, sso). type: String - contextPath: Cribl.SearchJob.userDetails.roles description: Roles assigned to the user. type: Unknown - name: cribl-search-job-delete description: Deletes a specific search job. execution: true arguments: - name: job_id required: true description: The unique identifier of the search job to delete. - name: cribl-search-dataset-list description: Retrieves a list of available datasets or details of a specific dataset. execution: false arguments: - name: dataset_id required: false description: The unique identifier of a specific dataset to retrieve. - name: limit required: false defaultValue: 10 description: The maximum number of results to return. - name: all_results required: false defaultValue: false description: Whether to return all results. If true, overrides the limit argument. outputs: - contextPath: Cribl.SearchDataset.id description: The unique identifier of the dataset. type: String - contextPath: Cribl.SearchDataset.type description: The dataset provider type (for example, s3, azure_blob, gcs). type: String - contextPath: Cribl.SearchDataset.provider description: The identifier of the provider configuration backing the dataset. type: String - contextPath: Cribl.SearchDataset.region description: The cloud region where the dataset's underlying storage resides (when applicable). type: String - contextPath: Cribl.SearchDataset.bucket description: The bucket/path template that locates the dataset's underlying objects. type: String - contextPath: Cribl.SearchDataset.description description: The human-readable description of the dataset. type: String - contextPath: Cribl.SearchDataset.filter description: The filter expression applied to events from the dataset; defaults to "true" (passes all events). type: String - contextPath: Cribl.SearchDataset.tags description: The tags assigned to the dataset (string or array of strings). type: Unknown - contextPath: Cribl.SearchDataset.breakerRulesets description: The event breaker rulesets associated with the dataset. type: Unknown - contextPath: Cribl.SearchDataset.storageClasses description: The storage classes the dataset is configured to read from. type: Unknown - contextPath: Cribl.SearchDataset.staleChannelFlushMs description: The time in milliseconds after which a stale channel is flushed during ingestion. type: Number - name: cribl-saved-search-list description: Retrieves a list of saved searches or details of a specific saved search. execution: false arguments: - name: search_id required: false description: The unique identifier of a specific saved search to retrieve. - name: limit required: false defaultValue: 10 description: The maximum number of results to return. - name: all_results required: false defaultValue: false description: Whether to return all results. If true, overrides the limit argument. outputs: - contextPath: Cribl.SavedSearch.id description: The unique identifier of the saved search. type: String - contextPath: Cribl.SavedSearch.name description: The display name of the saved search. type: String - contextPath: Cribl.SavedSearch.query description: The search query string defined by the saved search. type: String isfetch: false runonce: false script: '-' type: python subtype: python3 dockerimage: demisto/fastapi:0.125.0.10158186 fromversion: 6.10.0 tests: - No tests sectionorder: - Connect