> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cribl Search

Connect from ResolveAI to Cribl Search to give the agent read-only access to the data in your Cribl.Cloud workspace, in Cribl Lake, object stores and other datasets, for investigations. ResolveAI authenticates with a Cribl.Cloud API Credential and reads through the workspace's Cribl Search API.

> [!NOTE]
>
> **Prerequisite:** in Cribl.Cloud, the **Owner** or **Admin** role, which is needed to create API Credentials. Per-credential permissions need a plan that includes Organization Permissions; without one, every API Credential has Admin access.

***

## In Cribl.Cloud

### 1. Create an API Credential

Log in to Cribl.Cloud as an Owner or Admin. In the top bar choose **Products → Cribl**, then in the sidebar open **Organization → API Credentials** and click **Add Credential**. Give it a name (ex. `ResolveAI`).

To keep the credential read-only, set **Organization Permissions** to **User**, then under **Workspace Access** give your workspace the **Member** permission with the **User** Cribl Search permission.

Click **Save** and copy the **Client ID** and **Client Secret**.

### 2. Find the workspace name and organization ID

Open the workspace. Its URL has the form `https://<workspace>-<organization>.cribl.cloud`: the first part is the workspace name and the second the organization ID.

***

## In ResolveAI

> [tab] Resolve UI
>
> ### 3. Add a Cribl Search connection
>
> Open [Integrations](https://agent.resolve.ai/integrations), click [**Cribl Search**](https://agent.resolve.ai/integrations/criblSearch/connect), then **Add Connection**. Give it a name (ex. `Cribl Prod`) and list its environments.
>
> ### 4. Add the workspace and the credential
>
> * **Workspace name** and **Organization ID**, from [step 2](#2-find-the-workspace-name-and-organization-id)
> * **Client ID** and **Client secret**, from [step 1](#1-create-an-api-credential)
>
> ### 5. Save and verify
>
> Click **Save**, then **Check Health**. The check requests a token with the credential and lists the workspace's search jobs.

> [tab] Resolve Satellite
>
> The [Resolve Satellite](https://docs.resolve.ai/resolve-satellite) connects from inside your network, so the client secret never leaves your environment.
>
> > [!NOTE]
> >
> > **Prerequisites:** the Resolve Satellite is installed, **v1.1.62** or later.
>
> ### 3. Create a Kubernetes secret
>
> ```yaml cribl-search-credentials.yml theme={null}
> apiVersion: v1
> kind: Secret
> type: Opaque
> metadata:
>   name: cribl-search-credentials
> stringData:
>   clientSecret: "<Client Secret>"
> ```
>
> ```shell theme={null}
> kubectl apply -f cribl-search-credentials.yml
> ```
>
> ### 4. Update your values file
>
> ```yaml resolve-values.yaml theme={null}
> integrations:
>   cribl-search-main:
>     type: criblSearch
>     create: true
>     secretName: cribl-search-credentials
>     connection:
>       workspaceName: "<workspace>"
>       organizationId: "<organization>"
>       clientId: "<Client ID>"
> ```
>
> ### 5. Apply and verify
>
> ```shell theme={null}
> helm upgrade --install resolve-satellite \
>   oci://registry-1.docker.io/resolveaihq/satellite-chart \
>   --values resolve-values.yaml
> ```
>
> Verify with **Check Health** on the [Cribl Search integration](https://agent.resolve.ai/integrations/criblSearch) page.