Cribl Datasets API

openapi: 3.2.0
info:
  title: Cribl Datasets API
  version: '1.0'
  contact:
    name: Cribl Support
    url: https://cribl.io/support/
  termsOfService: https://cribl.io/terms-of-service/
  description: 'Operations tagged Datasets across 2 of this provider''s published API definitions: cribl-lake-api-openapi.yml, cribl-search-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
  description: Cribl Cloud
  variables:
    workspaceName:
      default: default
      description: The name of the Cribl Cloud workspace
    organizationId:
      default: org-id
      description: The Cribl Cloud organization identifier
- url: https://{hostname}:{port}/api/v1
  description: On-Premises Deployment
  variables:
    hostname:
      default: localhost
      description: The hostname of the Cribl instance
    port:
      default: '9000'
      description: The port of the Cribl instance
security:
- bearerAuth: []
tags:
- name: Datasets
  description: Manage Cribl Lake datasets that define storage buckets for observability and security data in open formats.
paths:
  /lake/datasets:
    get:
      operationId: listLakeDatasets
      summary: List all Lake datasets
      description: Retrieves a list of all Cribl Lake datasets including their storage configuration, retention policies, and data volume metrics. Available on Cribl Cloud only.
      tags:
      - Datasets
      responses:
        '200':
          description: Successfully retrieved Lake datasets
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/LakeDataset'
                  count:
                    type: integer
                    description: Total number of datasets
        '401':
          description: Unauthorized
    post:
      operationId: createLakeDataset
      summary: Create a Lake dataset
      description: Creates a new Cribl Lake dataset for storing observability data in open formats. Configure storage format, retention period, and access permissions.
      tags:
      - Datasets
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LakeDataset'
      responses:
        '200':
          description: Lake dataset created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LakeDataset'
        '400':
          description: Invalid dataset configuration
        '401':
          description: Unauthorized
    servers:
    - url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
      description: Cribl Cloud
      variables:
        workspaceName:
          default: default
          description: The name of the Cribl Cloud workspace
        organizationId:
          default: org-id
          description: The Cribl Cloud organization identifier
  /lake/datasets/{id}:
    get:
      operationId: getLakeDataset
      summary: Get a Lake dataset by ID
      description: Retrieves the configuration, retention policy, and storage metadata of a specific Cribl Lake dataset.
      tags:
      - Datasets
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved Lake dataset
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LakeDataset'
        '401':
          description: Unauthorized
        '404':
          description: Dataset not found
    patch:
      operationId: updateLakeDataset
      summary: Update a Lake dataset
      description: Updates the configuration of an existing Lake dataset including its retention policy and access settings.
      tags:
      - Datasets
      parameters:
      - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LakeDataset'
      responses:
        '200':
          description: Lake dataset updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LakeDataset'
        '400':
          description: Invalid dataset configuration
        '401':
          description: Unauthorized
        '404':
          description: Dataset not found
    delete:
      operationId: deleteLakeDataset
      summary: Delete a Lake dataset
      description: Deletes a Cribl Lake dataset and its associated data by its unique ID. This operation is irreversible and will permanently remove all stored data.
      tags:
      - Datasets
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Dataset deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Dataset not found
    servers:
    - url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
      description: Cribl Cloud
      variables:
        workspaceName:
          default: default
          description: The name of the Cribl Cloud workspace
        organizationId:
          default: org-id
          description: The Cribl Cloud organization identifier
  /search/datasets:
    get:
      operationId: listSearchDatasets
      summary: List all search datasets
      description: Retrieves all configured search datasets that define the data sources available for querying including Cribl Lake datasets, Splunk indexes, and other connected data stores.
      tags:
      - Datasets
      responses:
        '200':
          description: Successfully retrieved search datasets
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/SearchDataset'
                  count:
                    type: integer
                    description: Total number of datasets
        '401':
          description: Unauthorized
    post:
      operationId: createSearchDataset
      summary: Create a search dataset
      description: Creates a new search dataset that defines a data source available for querying in Cribl Search.
      tags:
      - Datasets
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchDataset'
      responses:
        '200':
          description: Search dataset created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchDataset'
        '400':
          description: Invalid dataset configuration
        '401':
          description: Unauthorized
    servers:
    - url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
      description: Cribl Cloud
      variables:
        workspaceName:
          default: default
          description: The name of the Cribl Cloud workspace
        organizationId:
          default: org-id
          description: The Cribl Cloud organization identifier
    - url: https://{hostname}:{port}/api/v1
      description: On-Premises Deployment
      variables:
        hostname:
          default: localhost
          description: The hostname of the Cribl instance
        port:
          default: '9000'
          description: The port of the Cribl instance
  /search/datasets/{id}:
    get:
      operationId: getSearchDataset
      summary: Get a search dataset by ID
      description: Retrieves the configuration and metadata of a specific search dataset.
      tags:
      - Datasets
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved search dataset
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchDataset'
        '401':
          description: Unauthorized
        '404':
          description: Search dataset not found
    patch:
      operationId: updateSearchDataset
      summary: Update a search dataset
      description: Updates the configuration of an existing search dataset.
      tags:
      - Datasets
      parameters:
      - $ref: '#/components/parameters/resourceId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchDataset'
      responses:
        '200':
          description: Search dataset updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchDataset'
        '400':
          description: Invalid dataset configuration
        '401':
          description: Unauthorized
        '404':
          description: Search dataset not found
    delete:
      operationId: deleteSearchDataset
      summary: Delete a search dataset
      description: Deletes a search dataset by its unique ID. Active search jobs referencing this dataset will not be affected.
      tags:
      - Datasets
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Search dataset deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Search dataset not found
    servers:
    - url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
      description: Cribl Cloud
      variables:
        workspaceName:
          default: default
          description: The name of the Cribl Cloud workspace
        organizationId:
          default: org-id
          description: The Cribl Cloud organization identifier
    - url: https://{hostname}:{port}/api/v1
      description: On-Premises Deployment
      variables:
        hostname:
          default: localhost
          description: The hostname of the Cribl instance
        port:
          default: '9000'
          description: The port of the Cribl instance
components:
  schemas:
    LakeDataset:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the Lake dataset
        name:
          type: string
          description: Display name of the dataset
        description:
          type: string
          description: A human-readable description of the dataset
        retentionDays:
          type: integer
          description: Number of days to retain data
          minimum: 1
        format:
          type: string
          description: The storage format for the dataset
          enum:
          - parquet
          - json
        totalSize:
          type: integer
          description: Total data size in bytes
        eventCount:
          type: integer
          description: Total number of stored events
        createdAt:
          type: string
          description: Dataset creation timestamp
          format: date-time
        updatedAt:
          type: string
          description: Dataset last update timestamp
          format: date-time
    SearchDataset:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the search dataset
        name:
          type: string
          description: Display name of the dataset
        description:
          type: string
          description: A human-readable description
        type:
          type: string
          description: The data source type
          enum:
          - cribl_lake
          - splunk
          - s3
          - elasticsearch
          - datadog
        connectionConfig:
          type: object
          description: Connection configuration specific to the data source type
          properties:
            host:
              type: string
              description: The data source host address
            port:
              type: integer
              description: The data source port
            index:
              type: string
              description: The index or bucket to search
  parameters:
    resourceId:
      name: id
      in: path
      required: true
      description: The unique identifier of the resource
      schema:
        type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token obtained via OAuth 2.0 client credentials grant for Cribl Cloud authentication. Tokens expire after 24 hours.
x-refined-from:
- cribl-lake-api-openapi.yml
- cribl-search-api-openapi.yml