Cribl Search - ResolveAI

Connect from ResolveAI to Cribl Search to give the agent read-only access to the data in your Cribl.Cloud workspace, in Cribl Lake, object stores and other datasets, for investigations. ResolveAI authenticates with a Cribl.Cloud API Credential and reads through the workspace’s Cribl Search API.

Prerequisite: in Cribl.Cloud, the Owner or Admin role, which is needed to create API Credentials. Per-credential permissions need a plan that includes Organization Permissions; without one, every API Credential has Admin access.

In Cribl.Cloud

1. Create an API Credential

Log in to Cribl.Cloud as an Owner or Admin. In the top bar choose Products → Cribl, then in the sidebar open Organization → API Credentials and click Add Credential. Give it a name (ex. ResolveAI). To keep the credential read-only, set Organization Permissions to User, then under Workspace Access give your workspace the Member permission with the User Cribl Search permission. Click Save and copy the Client ID and Client Secret.

2. Find the workspace name and organization ID

Open the workspace. Its URL has the form https://<workspace>-<organization>.cribl.cloud: the first part is the workspace name and the second the organization ID.

In ResolveAI

Resolve UI
Resolve Satellite

3. Add a Cribl Search connection

Open Integrations, click Cribl Search, then Add Connection. Give it a name (ex. Cribl Prod) and list its environments.

4. Add the workspace and the credential

Workspace name and Organization ID, from step 2
Client ID and Client secret, from step 1

5. Save and verify

Click Save, then Check Health. The check requests a token with the credential and lists the workspace’s search jobs.

The Resolve Satellite connects from inside your network, so the client secret never leaves your environment.

Prerequisites: the Resolve Satellite is installed, v1.1.62 or later.

3. Create a Kubernetes secret

cribl-search-credentials.yml

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: cribl-search-credentials
stringData:
  clientSecret: "<Client Secret>"

kubectl apply -f cribl-search-credentials.yml

4. Update your values file

resolve-values.yaml

integrations:
  cribl-search-main:
    type: criblSearch
    create: true
    secretName: cribl-search-credentials
    connection:
      workspaceName: "<workspace>"
      organizationId: "<organization>"
      clientId: "<Client ID>"

5. Apply and verify

helm upgrade --install resolve-satellite \
  oci://registry-1.docker.io/resolveaihq/satellite-chart \
  --values resolve-values.yaml

Verify with Check Health on the Cribl Search integration page.