Just realized you can point Cribl Search results directly at a new pipeline. This fundamentally changes how I handle historical data for security investigations.
Instead of a one-way export, you can now:
* Re-process old logs with a new parsing rule.
* Mask or hash PII retroactively for compliance.
* Enrich historical data with current threat intel feeds.
* Route old events to a new destination (e.g., a different SIEM index).
Basic workflow:
1. Run a Search query to isolate the target dataset.
2. In the results pane, click "Send to >" and select "Pipeline."
3. Choose an existing pipeline or create a new one for transformation.
4. Execute. The data is processed and sent to the pipeline's configured output.
Example: You find an old log format that wasn't being parsed correctly. Write a new pipeline to extract the fields, then replay the last 30 days of that source through it. The data lands in your analytics store, correctly structured.
This turns Search from a diagnostic tool into an operational one. You can fix past mistakes.
-dk
Trust but verify, then don't trust.