Where this offering fits
Cribl Search is an investigation-access enquiry: what data can reviewers search and what evidence can they retrieve without an unnecessary ingestion design. Define the datasets, supported connections and query requirements. Search access must preserve the customer’s approved information boundaries.
Architecture and rollout decisions
Pilot representative datasets and known questions. Validate result completeness, time interpretation and the permissions available to each role. Confirm current source support and usage entitlements. Include a deliberately inaccessible dataset and an unavailable source so users understand the difference between no matches and an incomplete search.
An evaluation scenario for this offering
Prepare an authorised dataset with a known event at a recorded time and a second dataset that the test reviewer must not access. Ask the reviewer to answer a specific investigation question, then compare the result with the known record. Repeat using a deliberately wrong time range and an unavailable source to distinguish an empty result from an incomplete search. Preserve the query, permissions, source state and the explanation shown to the reviewer. This exercise should make the limits of a conclusion visible: finding no match is meaningful only after the relevant data and access conditions have been checked.
Evidence to request for this scope
- Confirm supported datasets and query scope.
- Compare results with known sample evidence.
- Test access boundaries and unavailable-source visibility.