Cribl Search 4.4.4 ​

New Features ​

Starting with Cribl Search 4.4.4, you can configure Splunk SmartStore faster than before, reuse your search results, and declutter your charts. Read on for details.

Configure Splunk SmartStore Faster ​

In Dataset Providers that support Splunk SmartStore, you can now select SmartStore as the partitioning scheme without having to specify further configuration. This applies to the following providers:

• Amazon S3
• Azure Blob Storage
• Cribl Edge
• Google Cloud Storage

Reuse Your Search Results ​

Your queries can now reuse the results of previous searches (with no need to rerun them), using the new virtual table: $vt_results.

Visualizations ​

• You can now choose to display only the larger (top N) values of a Dataset in area, bar, donut, funnel, and line charts.
• Search results are now sorted in descending time order by default, presenting the latest information at the top.