Discussions

Recently active
Unanswered questions

Known issue page(s) updated: SEARCH-8539 | IP functions might return incorrect results for invalid inputs SEARCH-9228 | DateTime functions might return numbers for `null` SEARCH-9366, SEARCH-9628 | Different `extract type=regex overwrite` behavior wi

5 days ago

palamorianNew Participant

asked in Job Postings

Senior Cribl Engineer / Security Data Engineer

Senior Cribl Engineer / Security Data EngineerLocation: Charlotte, NC preferred. Candidates in New York City, Los Angeles, Southern California, and other locations may also be considered.Work Model: Flexible hybrid or remotePosition OverviewWe are se

200

6 days ago

ProductUpdatesCommunity Manager

New known issue page(s) added:Known Issue

New known issue page(s) added: SEARCH-16124 | Aggregation queries with previews enabled can return an extra row

7 days ago

ProductUpdatesCommunity Manager

New known issue page(s) added:Known Issue

New known issue page(s) added: SEARCH-16017 | Cloned Datatypes not carrying over original Datatype schema maps

11 days ago

Jessica BrackenCommunity Manager

published in Stream

Cribl Stream Datagen Fails to Replace eventTime Timestamps

SymptomWith Datagen timestamp extraction set to auto, Timestamp anchor unset, and Length at 150:Events with eventTime within the first 150 characters show the timestamp template in _raw during Live Capture instead of the generated timestamp. Events w

100

11 days ago

Jessica BrackenCommunity Manager

published in Stream

New Workers Can't Join a Cribl Stream Leader Over TLS/mTLS Because cribl.secret Is Missing From the Config Bundle

SymptomA new worker joins a Leader, exchanges its first config sync, then disconnects after a few seconds and never comes back online. cribl.log on the worker shows:{"channel":"criblsecret","level":"error","message":"Secret decrypt failed","confType"

170

12 days ago

ProductUpdatesCommunity Manager

New known issue page(s) added:Known Issue

New known issue page(s) added: SEARCH-15495, SEARCH-16061 | Searches on v2 SmartStore Datasets run slowly and keep running after returning results

12 days ago

cbreshearsCommunity Manager

Version 4.20.3Update

This release is heavy on Azure, with some AI help for Pipelines and more OCSF support for security data.PlatformAPI rate limiting: Protects your deployment from overload and tells integrations when to retry. Cribl MCP for Pack Pipelines: Update Pipel

340

13 days ago

ProductUpdatesCommunity Manager

New known issue page(s) added:Known Issue

New known issue page(s) added: CRIBL-46216 | File Monitor Source with load balancing drops unbroken events SEARCH-15921 | Search v2 may misdecode Splunk journal stream offsets

13 days ago

ProductUpdatesCommunity Manager

Known issue page(s) updated:Known Issue

Known issue page(s) updated: CRIBL-43375, CRIBL-44399 | Parser Function set to Auto lowers throughput and can parse the same event twice CRIBL-44852 | Load-balanced Sources fail to initialize after configuration changes in single-instance mode CRIBL-

13 days ago

Show more activity

palamorianNew Participant

asked in Job Postings

Senior Cribl Engineer / Security Data Engineer

200

6 days ago

tfordusmufgjpNew Participant

asked in Stream

Blocked staging filesystem on Cloud Worker

I have an issue where my cloud worker nodes were unable to send data to my S3 buckets and as a result, the data backed up. The issue with the connection to S3 appears to be resolved but the nodes are still errored out:Error: Unable to write to the fi

281

27 days ago

LeeDVSNew Participant

asked in Stream

(CC Admin - Stream | Stream Projects and Security Lab issue

I am currently stuck on the lab (CC Admin - Stream | Stream Projects and Security Lab), specially task 3.2 and 3.3. I was unable to add the team to the project with the Editor role because permissions field was grayed out and did not allow me to sel

251

1 month ago

mohamedelsheikhrenosystemsNew Participant

asked in General

issue with Cribl Admin Stream

Hi,I’m a certified Cribl Admin user and finished all the admin user labs and course.currently working on Cribl Stream certification, I’m stuck with an issue I cant complete "Stream | Stream Projects and Security Lab” as it mentions that” In order to

942

1 month ago

johankellermansciberioNew Participant

asked in Stream

Splunk Cloud license usage differs between Cribl Splunk LB S2S and Cribl HEC destinations — date_*/timepos fields to blame?

We've noticed that when sending data to Splunk Cloud that originates from an on-prem Splunk Heavy Forwarder (e.g. syslog and API), the Splunk license cost differs depending on whether we send the data via Splunk LB (S2S) or Splunk HEC destiantions. W

1382

2 months ago

NilkanthNew Participant

asked in Edge

Looking for reusable parser/pack guidance for standard Linux log sources collected via File Monitor

We are currently working on a Linux log onboarding use case using Cribl Edge/File Monitor and forwarding the processed events to ADX/Sentinel.We have already built a pipeline that can parse some common Linux authentication events, especially from aut

700

2 months ago

louisNew Participant

asked in Stream

Unable to create new Cribl Lake destination after deleting datasets

I was cleaning my Cribl.Cloud instance, and deleted datasets that I no longer needed, unaware that these datasets were still being used by destinations in Stream. When going back to Stream afterwards, I could not load the Lake destination page and wo

533

2 months ago

Pawel KwiatkowskiInspiring

asked in Stream

An import/export of code to a yml format

An export of code is done to a json fromat only while on servers is used a yml fromat.IMHO, it should be possible to do import/export also in yml format. :)

752

5 months ago

itsjustjordynEmployee

asked in General

Does Cribl have any documentation for pulling Workday report logs?

3062

5 months ago

Andrew LathamNew Participant

asked in Stream

Debugging POST Body for HTTP REST Collector

I'm getting 400 responses on a POST Body that I'm trying to pass through the state.latestTime within the POST body. I would like to know what is being posted.I don't seem to be able to get a debug log out of my REST Collector to see what it is POSTin

2092