Cribl Search 4.9.3 ​

With Cribl Search 4.9.3, you gain access to new string operators, wider support for regex literals, simpler time extraction in Cribl Lake exports, and more.

New String Operators: !has_all and !has_any ​

The existing has_all and has_any string operators now have their negative counterparts: !has_all and !has_any.

matches regex Gets Support for Regex Literals ​

In addition to strings ("K.\*S"), the matches regex operator now also accepts ECMA-style regular expressions (/K.*S/). This allows you to use flags, for example, to specify case sensitivity:

dataset="cribl_internal_logs" method=*
 | limit 1000
 | where method matches regex /^po.*/i

New History Filtering ​

On the Search Home page, a new drop-down enables Search Admins to filter the displayed history by My History (the default) versus All History.

Simpler Time Extraction For Cribl Lake Events ​

When exporting from Cribl Search to Cribl Lake, _time data is now handled more predictably and consistently:

• Since _time is handled automatically, Datatype timestamp settings no longer apply to Cribl Lake events.
• If the source event has no _time field, Cribl Lake adds this field, setting its value to now() at write time.

Corrections ​

This release includes numerous fixes to various areas of Cribl Search, most notably: