Skip to main content

Knowledge Base
Discussions
Job Board
Developers
What's New?
Slack Channel

Discussions

Ask questions, get answers and engage with your peers

Home
Discussions

Community Discussions

Products

6 Categories
759 topics

Developers

3 Categories
5 topics

Other

1 Category
2 topics

Recently active
Unanswered questions

Jon RustEmployee

Cloning Events in Stream

This article will cover a few of the ways you can clone data, and what the advantages of the choices are. Cloning events can happen at the following places:In the Routing table (most common) Pre-processing Pipeline, before the events get to the Routing table In a Pipeline and/or Output Router destinationAs a refresher, the path an event takes through Cribl looks like this:Where in the stack you choose to clone will most often be dictated by your particular use case requirements. For this exercise, imagine we have two analysis destinations. All events will land in General SIEM. But events flagged as being from “bad guys” need to also be delivered to the Special SIEM. In order to identify the baddies, we'll assume we have a list of IPs in a file that we can use as a lookup table. Cloning In the Routing Table This is the most common place to clone your events. First, a refresher on how Routes work in Cribl Stream. Each event percolates through the Data Routes table rules in order. If the

cbreshearsCommunity Manager

Version 4.11 Release

The latest and greatest in Cribl 4.11 brings you a brand-new Lakehouse offering, turbocharged EPS ingest, and greater invoice breakdowns by product. But wait, there’s more! Here’s what else is making waves this release: LakeQuickly spin up dedicated datasets in Lakehouse to run fast, flexible searches on your freshest data for real-time analysis. No more compromising performance for budget, no complex schema management, and no data engineering expertise required. StreamEnhancements to Metrics UX include the new Metrics Pipeline Builder to simplify processing metrics, and automate aggregations. Goodbye excess noise, hello cleaner, more actionable metrics! Optimize data transmission with Splunk S2S Compression! Stream now supports compressed data transfers for Splunk TCP Source, Single Instance Destination, and Splunk LB Destination. Boost speed and efficiency with data flows while maintaining full compatibility with your Splunk setup. Optimized Kubernetes Performance for Strea

Jon RustEmployee

Using the Cribl API

Cribl’s interface is Super Neato: Reactive, beautiful, and easy to use. But sometimes you need to access settings and configurations programmatically. The good news is that interactive API docs are baked into your Cribl instance. The better news is that everything that happens in the GUI is making API calls. With your browser’s developer mode, you can easily take a peak behind the curtain to see exactly how the API was called and what the payload looked like.In this post, we’ll cover the basics of using the docs and the API to understand a few simple use cases. The Basics of Cribl’s API Docs We’re going to use the API to get a list of Worker Groups. Before we do, we should understand what’s required by the API. The best place to find the API documentation is right in the Cribl interface. Click Settings, Global Settings, and finally API Reference:On the resulting screen, you’ll see a dropdown menu to select which context you want the samples to work in. This is important to set before g

cbreshearsCommunity Manager

Community Projects

CriblUtilities by CINQ

The team at CINQ has open-sourced their new utility tool:More details

cbreshearsCommunity Manager

Version 4.10.1 ReleaseNews

See the latest updates at these links:Stream Release NotesEdge Release NotesSearch Release NotesLake Release Notes

cbreshearsCommunity Manager

Cyber Data Mesh Architect

Position Overview: As a Security Data Mesh Architect specializing in solving complex data challenges across multiple hyper-scaler clouds, you will be responsible for designing, implementing, and optimizing a microservices approach to security data generation, collecting, transformation, storage and analytics within cloud platforms like Google Cloud Platform (GCP), Amazon Web Services (AWS), and Microsoft Azure. You will play a key role in ensuring the scalability, reliability, and security of our growing data challenges including observability, providing expert guidance, and developing innovative solutions to enhance the value of large data sets.Apply Here

cbreshearsCommunity Manager

Sony Corporation of America is seeking an Director, Data , to join the CISD, GSIRT in Reston, VA.

Reporting to the Sr Director, this role sets the vision and strategy for the data platform, ensuring alignment with business goals and scalability. Responsibilities include overseeing data architecture, defining governance frameworks, and driving the development of scalable processes. Additionally, they will build and mentor a high-performing data team, raise data literacy, and ensure program execution aligns with enterprise architecture and security policies. This team is pivotal in securing Sony’s information assets, building trust with customers, and protecting privacy.Apply Here

jaycriblNew Participant

Is there a list of links for cribl upgrade files?

Had a situation where the automatic upgrade was not working, so had to manually upgrade.From the logs it was trying to download ARM version not X64 version.Fortunately managed to figure out the correct weblink by changing the file name slightly: https://cdn.cribl.io/dl/4.10.1/cribl-4.10.1-45136dbb-linux-x64.tgz.Are these links listed anywhere on the cribl website, or how would we manually upgrade?

Jari WeststrateParticipating Frequently

filter expresion and route order

Hello,I noticed a strange thing maybey anyone can explain.I have 3 syslog sources: syslog:514: ,syslog:51402: and syslog:51403:Three routes for these sources, each with a different pipeline attached. The order off the routes are 514 then 51402 and at last 51403.The filter in de routes are __inputId.startsWith('syslog:514:') && __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51402:') && __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51403:')&& __srcIpPort.includes('10.10.1.112')(same host with different syslog outputs)In this order the 514 port gets a load off events, the 51402 lesser and teh 51403 nothing. That surpised me because when a check the source side i can capture 51403 events from this sourceip.For test i moved the 514 route after the 51403 route. Just a feeling. but what??.. the 51403 gets suddenly l the events it was missing. And here it gets strange. Just as if the 514 filter takes al the events from the 51403. But

Arnold JohnsonNew Participant

Bootstrap worker from cribl cloud leader UI access

HiI setup a worker node on premise by running the script captured from cribl leader cloud. I enabled UI access for worker node. I can open the link in browser but what will be the credentials for it ?Thanks

Jari WeststrateParticipating Frequently

filter expresion and route order

Hello,I noticed a strange thing maybey anyone can explain.I have 3 syslog sources: syslog:514: ,syslog:51402: and syslog:51403:Three routes for these sources, each with a different pipeline attached. The order off the routes are 514 then 51402 and at last 51403.The filter in de routes are __inputId.startsWith('syslog:514:') && __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51402:') && __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51403:')&& __srcIpPort.includes('10.10.1.112')(same host with different syslog outputs)In this order the 514 port gets a load off events, the 51402 lesser and teh 51403 nothing. That surpised me because when a check the source side i can capture 51403 events from this sourceip.For test i moved the 514 route after the 51403 route. Just a feeling. but what??.. the 51403 gets suddenly l the events it was missing. And here it gets strange. Just as if the 514 filter takes al the events from the 51403. But

Arnold JohnsonNew Participant

Bootstrap worker from cribl cloud leader UI access

HiI setup a worker node on premise by running the script captured from cribl leader cloud. I enabled UI access for worker node. I can open the link in browser but what will be the credentials for it ?Thanks

a.pietersen@eremote.nlParticipating Frequently

Cribl Edge (standalone): Windows Metrics - Splunk, do not result in actionable information

I am new with Cribl.Cribl Edge (standalone, installed on Windows 10 laptop for test/evaluation): Windows Metrics do not return actionable information when forwarding to a standalone Splunk Enterprise instance. What am I doing wrong or what I am missing here?Windows Eventlog cribl-source is correctly received in json. But adding the Windows Metrics cribl-source to the same (working) Splunk Destination (default forwarding to port 9997) it shows:All relevant metric_names seems to be received correctly, but no Values to find. Besides, do not understand the metric_type "g". I would expect a value-field in bytesI have tried many things sofar, including Cloud Stream, searching in the docs and and start some basic first lessons on Cribl Universty. Neither an overall and understandable Google search explanation about type g. Stuck now!Does somebody has a clue, suggestion, tip or direction to search in other sources?ThanksAshleyP

Prabhat SharmaNew Participant

Best way to send logs from Cribl to OpenObserve

I am trying to send logs from cribl to OpenObserve.OpenObserve accepts data in a JSON array format.e.g.[ { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }, { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }]What is the best way to do this?

Angelo Michele PizziNew Participant

Distributed deployment planning with compressing g-zip Destination?

Hello everyone,I have the following problem. I'm designing a distributed deployment. I have to create an environment for data reduction but before that I need to send the data to a blob storage, for compliance reason, as you can imagine. Now, all of these is achieved but I have some doubts. When I use the Azure blob storage as only destination, all the 100% of the data goes in there but, the Monitoring Page, is telling me that the data that comes in are the same as the data that goes out (sometimes, the data that goes out are even more), even with compression enable. As said, I have the g-zip compression enabled on the Azure Destination page. I've checked the storage and I found out that the data are really compressed. So, my point is the following: when I try to estimates the possible number of workers and their capabilities, should I trust the monitoring page and consider DATA IN = DATA OUT (since the data is not processed by any pipeline at all) or I can consider the quantity of byt

jbos@svb.nlNew Participant

Updating Windows Agents Through the UI

Hi,We are currently working on updating our Cribl Edge Agents. While our Linux agents successfully auto-update through the UI, we are encountering issues with our Windows agents. Specifically, the Windows agents display an error during the download process and fail to update.Manual updates are possible by logging into the system and running the update script; however, the UI-based update consistently fails. We have confirmed that port 4200 is open, and there are no indications of blocked or dropped traffic. Additionally, all platform-specific packages, including the corresponding hash files, have been prepared and placed in the appropriate Cribl temporary directory.Given these conditions, what could be causing this issue?

Somnath BhattacharyaNew Participant

Unable to perform Destination test with Splunk HEC

I am new to cribl and trying to setup Splunk HEC destination from cribl sanbox stream instance. I have provisioned a free splunk cloud instance and setup HEC. While I can send data via: curl -k "https://<host>:8088/services/collector" -H "Authorization: Splunk 38aa4a38-8fd5-4faa-afc4-9b3533ac39c7" -d "{"event": "Hello, world!", "sourcetype": "manual"}"I am unable to run destination test from cribl with the exact endpoint or with /services/collector/event. Everytime the request time out with error:2025-02-20T14:23:57.956αtime:2025-02-20T14:23:57.956Zαcid:w0αchannel:output:splunkαlevel:errorαmessage:error while flushingαioName:splunk_hecαioType:destination{}error:αmessage:request timeoutαstack:Error: request timeout at /opt/cribl/bin/cribl.js:15:9721630 at new Promise (<anonymous>) at p.doHttpRequest (/opt/cribl/bin/cribl.js:15:9721585) at runNextTicks (node:internal/process/task_queues:60:5) at process.processTimers (node:internal/timers:509:9) at async p.buildRecProm

Ashley PietersenNew Participant

Yesterday started Cribl-Cloud (stream), now my Splunk License is chocking with data from it

Hi Anyone/supportYesterday, started Cribl-Cloud (stream), just for testing, now my Splunk License is chocking with data from it Crible Cloud :-(.Tried to delete all things I could delelte, still chocking my Splunk license. Deactivating my subscriiption says: We're sorry to see you go!We are processing the cancellation of your Cribl.Cloud organization. This process takes up to 30 days and you will get an email 7 days before the cancellation is final. If you didn't mean to cancel or having second thoughts, contact support@cribl.io.How can I interrupt this data-stream. I had to stop my Splunk Enterprise instance for this…Hope someone can help out.Ashley Pietersen

Steve BennettParticipating Frequently

Full Read of S3 Bucket for only new items

I am trying to pull in DNS Logs from Cisco Umbrella. I have my S3 Connector configured to pull down the logs every 5 minutes. The problem is that it pulls down all the logs. I only want the new logs. I have tried adding the follow to my Conf section of the JSON configuration but it doesn't appear to work."trackProgress": true, "trackMode": "file", "trackField": "s3.object.etag", "useLastModifiedTime": true

jaycriblNew Participant

Having hard luck with parsing logs - tips?

Hi, I have gone through the cribl university user and admin courses and setting up the product is quite easy however am constantly stuck trying to parse or extract strings of data into fields so that we can search or use the information.For systems which send in JSON or CSV it is very simple, however most of ours are embedded Linux or network devices which give something like the following:<183> 02/06/2025:00:24:20 GMT NYDC1VPX01-DMZ 0-PPE-0 : default SSLLOG SSL_HANDSHAKE_SUCCESS 9838002 0 : SPCBId 33168208 - ClientIP 10.1.1.130 - ClientPort 57486 - VserverServiceIP 10.200.80.80 - VserverServicePort 443 - ClientVersion TLSv1.2 - CipherSuite "TLS1-AES-256-CBC-SHA" - Session New - HandshakeTime 47 msShowWhat combination of functions can split this out into fields such as hostname, clientip, clientport, etc.I have tried using ChatGPT to help and can get regex and grok expressions from the AI however these don't work when applying to cribl. I don't see many questions on this topic

Don't see what you are looking for?

User leaderboard

Badges

Jon Rusthas earned the badge Product expert
Chanda Pulliamhas earned the badge Goat of Goats
Shawn Cannonhas earned the badge Goat of Goats
xpac xpachas earned the badge Goat of Goats
jwroblewskihas earned the badge Innovator

Show all badges

Powered by Gainsight

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Username *

E-mail address *

Password *

I accept the terms & conditions

loginBox.register.email_repeat

Login to the community

No account yet? Create an account

Username or Email

Password

Remember me

Forgot password?

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK