Bring Cribl Lake into Talon Search: connect Cribl.Cloud or an on-prem leader, switch on search access per connection, and its datasets appear in the guided picker alongside your SIEM data.
Cribl Lake
The point of a pipeline like Cribl is that high-volume, low-signal telemetry is deliberately not shipped to the SIEM; it lands in the lake instead. Data Lakes (/search/data-lakes) is where you make a lake searchable, so an analyst can pivot on the data you did not index, without moving or re-indexing it.
The page lists the Cribl connections visible to the active workspace, each with its status, mode and endpoint, and a Search switch. Once a lake is switched on, its datasets appear in the guided picker on /search next to your SIEM sourcetypes, and it becomes a source in the picker. Talon marks Cribl Lake search as beta: it has not yet been validated against a live Cribl instance.
Federation is Enterprise
Searching a single source — a SIEM or a lake — works on every edition. Searching more than one source at once is an Enterprise feature, and Enterprise is in development. The Community Edition is not barred from lakes, only from combining sources in one query.
Two connection modes, two ways to sign in
A Cribl.Cloud connection authenticates with OAuth client credentials (client ID and secret). An on-prem Cribl leader uses a username and password, or a static auth token.
Connecting a lake
Connecting is two steps: add the connection, then switch search access on. Until then the lake is connected but not searchable.
1
In Connect → Integrations, add a Cribl connection: Cribl.Cloud with a client ID and secret, or an on-prem leader with a username and password or an auth token.
2
Open /search/data-lakes with a workspace selected and switch on the connection's Search toggle.
3
Its datasets now appear in the guided picker on /search.
4
On Enterprise, choose All sources (federated) to run one query across the lake and every searchable SIEM; on the Community Edition, pick one source.
Talon Search → Data Lakes
Switch on Search for a connected Cribl Lake to make it a search source — until then it is connected but not searchable. Lakes are added under Connect → Integrations, not here.
This page only switches access
/search/data-lakes does not add or configure a Cribl connection. With none connected it links to Connect → Integrations; add the lake there first, then come back to switch it on.
Permission gate
Switching search access needs a role that can change Talon Connect settings. For a lake assigned to workspaces, you also need the engineer role in one of them. Each change is written to the audit log.