Cribl APM gives you an APM experience — service health, distributed traces, dependency maps, and AI-driven root-cause investigation — over OpenTelemetry data landing in Cribl Search. It runs as a sandboxed Cribl App Platform app inside your Cribl Cloud workspace.
Cribl APM is a UI over data you already have — it doesn't ingest or store anything. You point it at a Cribl Search dataset that's receiving OpenTelemetry traces, logs, and metrics.
Four steps from install to your services on screen.
Cribl APM reads from a dataset that already contains OTel data (default
name otel). The dataset needs:
- Spans — OTel span rows with
end_time_unix_nanopopulated - Logs — rows with a
bodyfield - Metrics — rows where
datatype == "generic_metrics"
No OTel data flowing yet? The companion repo
criblio/otel-demo-criblcloud
stands up the OpenTelemetry Demo and ships it into Cribl Cloud.
- Download
apm-<version>.tgzfrom the Releases page. - In your Cribl Cloud workspace, upload it via the Apps UI.
- The app appears in your workspace nav at
/apps/apm.
Open the app, go to the Configuration tab, and:
- Workspace → Dataset — set to the dataset receiving your OTel data
(default
otel). - Setup → Scheduled searches — click Preview plan, then Apply. This creates the cached searches the pages read from.
- Setup → Dataset acceleration — click Apply to index the fields the queries filter on.
The Setup status card at the top of the page turns green once both provisioning steps are done.
Give the scheduled searches a few minutes to run, then open Overview — it fills with your services, golden-signal sparklines, and detected issues.
Alerting and incidents need no extra setup: the provisioned searches evaluate every service's health each cadence, firing alerts on error-rate spikes, latency regressions, traffic drops, and silent services — and related alerts collapse automatically into Incidents, the unit you drill into from the Alerts page.
With shared GoatTown configured, every fired alert gets an autonomous AI investigation. APM correlates the resulting root cause, evidence, remediation, and transcript with the incident. See docs/server-side-investigations.md for setup; without it, everything above still works and the Investigate page runs interactively in your browser session.
- Overview — system health at a glance: detected issues, golden signals, services needing attention.
- Services / Service Detail — the health catalog and per-service RED charts, top operations, instances, and spotlight diffs.
- Service Map — force-directed service dependency graph (RPC + messaging edges).
- Traces — Jaeger-style trace search; full waterfall span detail; structural diff between two traces (Compare).
- Logs / Metrics — log search scoped to your services; metric discovery and charting over the wide-column store.
- Alerts & Incidents — server-evaluated alerts (error rate, latency regression, traffic drop, silent service) rolling up into incidents; each incident has a warroom page with the summary narrative, AI investigation findings, member services, and a timeline humans annotate directly (notes, status, severity, close/reopen).
- Errors — error-class rollup with noise filtering.
- Investigate — the AI investigator: seed a symptom (or launch from an alert or incident) and it walks the data — and optionally the service's source code — to a root cause. Runs in GoatFarm when server-side investigations are configured, in-browser otherwise.
- Shareable URLs: the host router flattens externally-pasted deep
links (e.g.
/apps/apm/trace/abc) to the default page. Navigate inside the app instead — tabs, clicks, and back/forward all work.
Building or contributing to Cribl APM? See docs/development.md for the local dev loop, architecture, deploy-from-source, and project layout — plus AGENTS.md (platform reference) and CLAUDE.md (repo conventions).