Discussions

SymptomA user needs permission to create, edit, and delete users without access to Fleet, Worker Group, node, or product configuration.Self-managed Cribl Stream does not provide a built-in role with this exact scope.EnvironmentCribl Stream 4.19.0 or

17 hours ago

PackDispensaryCommunity Manager

Cribl Identity CheckerApp

Stream, Search, Edge, Lake - Display an app user's identity details. View App

17 hours ago

johankellermansciberioNew Participant

Stream

Splunk Cloud license usage differs between Cribl Splunk LB S2S and Cribl HEC destinations — date_*/timepos fields to blame?

We've noticed that when sending data to Splunk Cloud that originates from an on-prem Splunk Heavy Forwarder (e.g. syslog and API), the Splunk license cost differs depending on whether we send the data via Splunk LB (S2S) or Splunk HEC destiantions. W

832

1 day ago

cbreshearsCommunity Manager

Webhooks

Discord Webhook Notifications Fail with an Invalid JSON Error

SymptomA Cribl Stream notification is created successfully, but the notification does not appear in the configured Discord channel.The Cribl notification service logs report an HTTP 400 response similar to the following:{ "level": "error", "message

3 days ago

cbreshearsCommunity Manager

Microsoft

Microsoft Teams Notifications Fail After Migrating to Workflows

SymptomCribl Stream notifications do not reach Microsoft Teams after migrating from an Office 365 Incoming Webhook Connector to a Microsoft Teams Workflow webhook.A manual curl request to the new webhook URL succeeds from the Leader, but notification

3 days ago

ProductUpdatesCommunity Manager

New known issue page(s) added:Known Issue

New known issue page(s) added: AI-4634 | Guard: \"Apply\" button adds all recommendations

3 days ago

johankellermansciberioNew Participant

Stream

Splunk Cloud license usage differs between Cribl Splunk LB S2S and Cribl HEC destinations — date_*/timepos fields to blame?

832

1 day ago

NilkanthNew Participant

Edge

Looking for reusable parser/pack guidance for standard Linux log sources collected via File Monitor

We are currently working on a Linux log onboarding use case using Cribl Edge/File Monitor and forwarding the processed events to ADX/Sentinel.We have already built a pipeline that can parse some common Linux authentication events, especially from aut

330

13 days ago

louisNew Participant

Stream

Unable to create new Cribl Lake destination after deleting datasets

I was cleaning my Cribl.Cloud instance, and deleted datasets that I no longer needed, unaware that these datasets were still being used by destinations in Stream. When going back to Stream afterwards, I could not load the Lake destination page and wo

233

13 days ago

Pawel KwiatkowskiInspiring

Stream

An import/export of code to a yml format

An export of code is done to a json fromat only while on servers is used a yml fromat.IMHO, it should be possible to do import/export also in yml format. :)

592

2 months ago

itsjustjordynEmployee

General

Does Cribl have any documentation for pulling Workday report logs?

2792

2 months ago

Andrew LathamNew Participant

Stream

Debugging POST Body for HTTP REST Collector

I'm getting 400 responses on a POST Body that I'm trying to pass through the state.latestTime within the POST body. I would like to know what is being posted.I don't seem to be able to get a debug log out of my REST Collector to see what it is POSTin

1652

2 months ago

ashuNew Participant

Stream

Parsing for nested Json

Hi all i am having issue parsing nested Json the event goes like { "records": [ { "time": "2025-12-18T17:25:46.3598689Z", "operationName": "Publish"}{"time": "2025-12-18T17:25:46.3598689Z", "operationName": "Publish"} ], "_time":

1061

2 months ago

scott.bossi856Inspiring

Do I Send It To Search, Destination Or Do I Send It To Something Like A HEC Destination And Then Plugin The Endpoint…

This message originated from Cribl Community Slack.Click here to view the original link.I have data that gets processed in STREAM that I want to send to LHE. Do I send it to search, destination or do I send it to something like a HEC destination an

673

3 months ago

dakotadabrowskiguidepointsecuNew Participant

Edge

Has Anyone Had Their Destinations Drop Off But Only For The UI

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone had their destinations drop off but only for the UI? I had about 8 Cribl TCP destinations drop off the UI but when I open an individual node that is on

785

3 months ago

niteshsharmahelpagcomNew Participant

Stream

Connecting a Linux-based Cribl Worker to a Windows SQL Server using Domain/Windows Authentication

I am seeking technical guidance on configuring a Database Collector to connect to a Windows SQL Server using Domain/Windows Authentication from a Linux-based Worker Node.We are currently running Cribl Stream version 4.17.Our Worker Nodes are running

1473