Create a search job.
External DocumentationTo learn more, visit the Cribl documentation.

​
Parameters

ParameterDescription
EarliestStart time for the search query time range in the format of [+|-]<time_integer><time_unit>@<time_unit> or now.

Examples:
* -15m - 15 minutes ago.
* -1h - 1 hour ago.
* 1d@d - start of today.
* now - current time.

For more information regarding the time format, visit Cribl documentation.
LatestEnd of query time range in the format of [+|-]<time_integer><time_unit>@<time_unit> or now.

Examples:
* -15m - 15 minutes ago.
* -1h - 1 hour ago.
* 1d@d - start of today.
* now - current time.

For more information regarding the time format, visit Cribl documentation.
Search QueryThe search query specifying the data to search and the functions and operators to run.

For example: dataset=* | limit 100

For more information regarding building a search query, visit Cribl documentation.
TypeThe type of the search job.

​
Example Output

{
	"count": 0,
	"items": [
		{
			"aliasOfOriginalJobId": "string",
			"chartConfig": {
				"applyThreshold": true,
				"axis": {
					"xAxis": "string",
					"yAxis": [
						"string"
					]
				},
				"color": "string",
				"colorPalette": 0,
				"colorPaletteReversed": true,
				"colorThresholds": {
					"thresholds": [
						{
							"color": "string",
							"threshold": 0
						}
					]
				},
				"customData": {
					"connectNulls": "string",
					"dataFields": [
						"string"
					],
					"isPointColor": true,
					"limitToTopN": 0,
					"lines": true,
					"nameField": "string",
					"pointColorPalette": 0,
					"pointColorPaletteReversed": true,
					"pointScale": "string",
					"pointScaleDataField": "string",
					"seriesCount": 0,
					"splitBy": "string",
					"stack": true,
					"summarizeOthers": true,
					"trellis": true
				},
				"decimals": 0,
				"label": "string",
				"legend": {
					"position": "string",
					"truncate": true
				},
				"mapDetails": {
					"latitudeField": "string",
					"longitudeField": "string",
					"mapSourceID": "string",
					"mapType": "string",
					"nameField": "string",
					"pointScale": "string",
					"valueField": "string"
				},
				"onClickAction": {
					"search": "string",
					"selectedDashboardId": "string",
					"selectedInputId": "string",
					"selectedTimerangeInputId": "string",
					"type": "string"
				},
				"prefix": "string",
				"series": [
					{
						"color": "string",
						"map": "string",
						"name": "string",
						"type": "area",
						"yAxisField": "string"
					}
				],
				"style": true,
				"suffix": "string",
				"type": "string",
				"xAxis": {
					"dataField": "string",
					"inverse": true,
					"labelOrientation": 0,
					"name": "string",
					"offset": 0,
					"position": "string",
					"type": "string"
				},
				"yAxis": {
					"dataField": "string",
					"interval": 0,
					"max": 0,
					"min": 0,
					"position": "string",
					"scale": "string",
					"splitLine": true,
					"type": "string"
				}
			},
			"compatibilityChecks": {
				"datatypes": true,
				"stageIds": [
					"string"
				]
			},
			"completionInfo": "string",
			"correlationId": "string",
			"cpuMetrics": {
				"totalCPUSeconds": 0,
				"totalExecCPUSeconds": 0
			},
			"datatypeOverrides": {
				"breakerRulesets": [
					{
						"id": "string",
						"lib": "custom",
						"description": "string",
						"tags": "string",
						"minRawLength": 256,
						"rules": [
							{
								"name": "string",
								"condition": "true",
								"type": "regex",
								"timestampAnchorRegex": "/^/",
								"timestamp": {
									"type": "auto",
									"length": 150,
									"format": "string"
								},
								"timestampTimezone": "local",
								"timestampEarliest": "-420weeks",
								"timestampLatest": "+1week",
								"maxEventBytes": 51200,
								"fields": [
									{
										"name": "string",
										"value": "string"
									}
								],
								"disabled": false,
								"parserEnabled": false,
								"shouldUseDataRaw": false
							}
						]
					}
				],
				"disableBreakers": true
			},
			"disableNotifications": true,
			"displayUsername": "string",
			"earliest": "string",
			"earliestEpoch": 0,
			"errorStateConfig": {
				"coordinated": true,
				"errorMessages": [
					"string"
				]
			},
			"group": "string",
			"id": "string",
			"isPrivate": true,
			"latest": "string",
			"latestEpoch": 0,
			"metadata": {},
			"numEventsAfter": 0,
			"numEventsBefore": 0,
			"query": "string",
			"queryWithMacrosResolved": "string",
			"sampleRate": 0,
			"savedQueryName": "string",
			"searchParameterDeclarations": [
				{
					"defaultValue": "string",
					"name": "string",
					"type": "string"
				}
			],
			"searchParameterValues": "string",
			"stages": [
				{
					"executionWarnings": [
						{
							"text": "string",
							"type": "string"
						}
					],
					"filter": "string",
					"id": "string",
					"resolvedDatasetIds": [
						"string"
					],
					"searchConfig": {
						"canComputeMetadataDistributively": true,
						"datasets": [
							"string"
						],
						"hasSendOperator": true,
						"orderedFieldNames": [
							"string"
						],
						"referencedFieldNames": [
							"string"
						],
						"searchTerms": [
							{
								"isCaseSensitive": true,
								"term": "string"
							}
						],
						"sortFields": [
							{
								"direction": "ascending",
								"fieldName": "string",
								"nullPosition": "nullsFirst"
							}
						],
						"useFormattedVisualization": true
					},
					"status": "new",
					"subQueryText": "string"
				}
			],
			"status": "new",
			"tableConfig": {
				"columnFilterSettings": {
					"contains": "string"
				},
				"columnFormatSettings": {
					"palette": "string",
					"precision": "string",
					"prefix": "string",
					"suffix": "string"
				},
				"columnOrderSettings": {
					"order": "string"
				},
				"columnSortSettings": {
					"sort": "string"
				},
				"rowNumberColumnWidth": 0,
				"showColumnTotals": true,
				"showColumnTotalsPinned": true,
				"showRowNumbers": true,
				"showRowTotals": true,
				"showRowTotalsPinned": true,
				"viewMode": "table"
			},
			"targetEventTime": 0,
			"timeCompleted": 0,
			"timeCreated": 0,
			"timeStarted": 0,
			"timeToFirstByte": 0,
			"totalEventCount": 0,
			"type": "command",
			"usageGroupId": "string",
			"user": "string"
		}
	]
}

​
Workflow Library Example

Create Search Job with Cribl and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop