Cribl Search Jobs API

openapi: 3.2.0
info:
  title: Cribl Search Search Jobs API
  description: The Cribl Search API provides programmatic access to Cribl Search, a tool for exploring and querying both live and stored observability data in real time. Developers can use the API to execute search queries, manage datasets, configure search jobs, and integrate federated search capabilities into their own applications and workflows. Cribl Search supports federated search across multiple data sources, enabling organizations to gain insights without needing to move or duplicate data into a single location.
  version: '1.0'
  contact:
    name: Cribl Support
    url: https://cribl.io/support/
  termsOfService: https://cribl.io/terms-of-service/
servers:
- url: https://{workspaceName}-{organizationId}.cribl.cloud/api/v1
  description: Cribl Cloud
  variables:
    workspaceName:
      default: default
      description: The name of the Cribl Cloud workspace
    organizationId:
      default: org-id
      description: The Cribl Cloud organization identifier
- url: https://{hostname}:{port}/api/v1
  description: On-Premises Deployment
  variables:
    hostname:
      default: localhost
      description: The hostname of the Cribl instance
    port:
      default: '9000'
      description: The port of the Cribl instance
security:
- bearerAuth: []
tags:
- name: Search Jobs
  description: Execute and manage search queries across live and stored observability data with support for federated search across multiple data sources.
paths:
  /search/jobs:
    get:
      operationId: listSearchJobs
      summary: List all search jobs
      description: Retrieves a list of all running and completed search jobs including their query, status, and result metrics.
      tags:
      - Search Jobs
      parameters:
      - name: status
        in: query
        description: Filter jobs by status
        schema:
          type: string
          enum:
          - running
          - completed
          - failed
          - cancelled
      - name: limit
        in: query
        description: Maximum number of jobs to return
        schema:
          type: integer
          default: 50
      responses:
        '200':
          description: Successfully retrieved search jobs
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/SearchJob'
                  count:
                    type: integer
                    description: Total number of search jobs
        '401':
          description: Unauthorized
    post:
      operationId: createSearchJob
      summary: Execute a new search query
      description: Creates and executes a new search job with the specified query and parameters. The search runs asynchronously and results can be retrieved when the job completes. Supports Cribl Search query language for filtering, aggregating, and transforming results across federated data sources.
      tags:
      - Search Jobs
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchJobRequest'
      responses:
        '200':
          description: Search job created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchJob'
        '400':
          description: Invalid search query or parameters
        '401':
          description: Unauthorized
  /search/jobs/{id}:
    get:
      operationId: getSearchJob
      summary: Get a search job by ID
      description: Retrieves the status, progress, and metadata of a specific search job. When the job is complete, includes result summary information.
      tags:
      - Search Jobs
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Successfully retrieved search job
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SearchJob'
        '401':
          description: Unauthorized
        '404':
          description: Search job not found
    delete:
      operationId: cancelSearchJob
      summary: Cancel a search job
      description: Cancels a running search job. Completed or already cancelled jobs cannot be cancelled.
      tags:
      - Search Jobs
      parameters:
      - $ref: '#/components/parameters/resourceId'
      responses:
        '200':
          description: Search job cancelled successfully
        '401':
          description: Unauthorized
        '404':
          description: Search job not found
  /search/jobs/{id}/results:
    get:
      operationId: getSearchJobResults
      summary: Get search job results
      description: Retrieves the results of a completed search job. Results are returned as an array of events matching the search query with support for pagination.
      tags:
      - Search Jobs
      parameters:
      - $ref: '#/components/parameters/resourceId'
      - name: offset
        in: query
        description: The offset for pagination
        schema:
          type: integer
          default: 0
      - name: limit
        in: query
        description: Maximum number of results to return
        schema:
          type: integer
          default: 100
      responses:
        '200':
          description: Successfully retrieved search results
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      type: object
                      description: A search result event
                  count:
                    type: integer
                    description: Total number of matching events
        '401':
          description: Unauthorized
        '404':
          description: Search job not found
components:
  parameters:
    resourceId:
      name: id
      in: path
      required: true
      description: The unique identifier of the resource
      schema:
        type: string
  schemas:
    SearchJobRequest:
      type: object
      required:
      - query
      properties:
        query:
          type: string
          description: The search query in Cribl Search query language
        dataset:
          type: string
          description: The dataset to search against
        earliest:
          type: string
          description: The earliest time for the search range in relative or absolute format
        latest:
          type: string
          description: The latest time for the search range in relative or absolute format
        timezone:
          type: string
          description: The timezone for time range interpretation
    SearchJob:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the search job
        query:
          type: string
          description: The search query that was executed
        status:
          type: string
          description: The current job status
          enum:
          - running
          - completed
          - failed
          - cancelled
        dataset:
          type: string
          description: The dataset being searched
        startTime:
          type: integer
          description: Job start time as a Unix timestamp
        endTime:
          type: integer
          description: Job end time as a Unix timestamp
        numResults:
          type: integer
          description: Number of results found
        numScanned:
          type: integer
          description: Number of events scanned
        error:
          type: string
          description: Error message if the job failed
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer token obtained via OAuth 2.0 client credentials grant (Cribl Cloud) or the /auth/login endpoint (on-premises).
externalDocs:
  description: Cribl Search Documentation
  url: https://docs.cribl.io/search/