Discussions

Unable to create new Cribl Lake destination after deleting datasets

I was cleaning my Cribl.Cloud instance, and deleted datasets that I no longer needed, unaware that these datasets were still being used by destinations in Stream. When going back to Stream afterwards, I could not load the Lake destination page and wo

2 days ago

rcalvertEmployee

Specialized Reference Architectures

The 2026 Guide to Advanced Cribl Deployments

This is an article to outline the highest standards of a Cribl deployment and to aid administrators and architects in building it. These recommendations are applicable to expansive or sophisticated deployments. This article has been produced in mid 2

530

3 days ago

cbreshearsCommunity Manager

Version 4.19.0Update

Platform• Cribl-managed MCP Server: Connect your AI tools to your Cribl environment straight from the Leader.• New release channel option: Switch to a "Slow" cadence if you need upgrades to line up with change windows.• Private Links: Self-service pr

120

Understanding the 'Status' tab of a Destination in Cribl Stream

Jason BuxtonKnown Participant

General

This message originated from Cribl Community Slack.Click here to view the original link.Is there a trick to understanding how to read the 'Status' tab of a 'Destination'? It's frustrating that the UI frequently gives very mixed signals. The below im

163

Field shading in Cribl Search indicates field coverage in data set

scott.bossi856Inspiring

This message originated from Cribl Community Slack.Click here to view the original link.I was asked this today and I have absolutely what the answer is - why are some fields shaded with a different color in search?Links for this message:image.png

154

Cribl Search: Exporting _time in CSV format using extend and strftime

jcartEntergyNew Participant

This message originated from Cribl Community Slack.Click here to view the original link.This may have been answered before but I cannot find it. Is there a way in Search if the _time value is visually represented as 2026-05-27 17:11:51.000 and I expo

112

Cribl Search: Differences between v1 and v2 workloads execution

xpacInspiring

This message originated from Cribl Community Slack.Click here to view the original link.As we had some debate about this today in a Cribl class... how does Search run its workloads? was it Lambda functions in the early times, and nowadays it's... a S

2811

Cribl Search: Support for compressed S3 objects but not password

Nick Kwiecien Nick KwiecienKnown Participant

This message originated from Cribl Community Slack.Click here to view the original link.Is there any way to use Cribl Search with an S3 object that is compressed and password protected?

LHE search considerations: focus on ingest volume, not search

scott.bossi856Inspiring

This message originated from Cribl Community Slack.Click here to view the original link.Should any consideration be given to how often a LHE will be searched when choosing a size? Where does search run? The leader? Instances that are spun up on de

122

louisNew Participant

Unable to create new Cribl Lake destination after deleting datasets

2 days ago

johankellermansciberioNew Participant

Splunk Cloud license usage differs between Cribl Splunk LB S2S and Cribl HEC destinations — date_*/timepos fields to blame?

We've noticed that when sending data to Splunk Cloud that originates from an on-prem Splunk Heavy Forwarder (e.g. syslog and API), the Splunk license cost differs depending on whether we send the data via Splunk LB (S2S) or Splunk HEC destiantions. W

580

1 month ago

Pawel KwiatkowskiInspiring

An import/export of code to a yml format

An export of code is done to a json fromat only while on servers is used a yml fromat.IMHO, it should be possible to do import/export also in yml format. :)

522

Does Cribl have any documentation for pulling Workday report logs?

itsjustjordynEmployee

General

2692

Andrew LathamNew Participant

Debugging POST Body for HTTP REST Collector

I'm getting 400 responses on a POST Body that I'm trying to pass through the state.latestTime within the POST body. I would like to know what is being posted.I don't seem to be able to get a debug log out of my REST Collector to see what it is POSTin

1512

ashuNew Participant

Parsing for nested Json

Hi all i am having issue parsing nested Json the event goes like { "records": [ { "time": "2025-12-18T17:25:46.3598689Z", "operationName": "Publish"}{"time": "2025-12-18T17:25:46.3598689Z", "operationName": "Publish"} ], "_time":

981

Do I Send It To Search, Destination Or Do I Send It To Something Like A HEC Destination And Then Plugin The Endpoint…

scott.bossi856Inspiring

This message originated from Cribl Community Slack.Click here to view the original link.I have data that gets processed in STREAM that I want to send to LHE. Do I send it to search, destination or do I send it to something like a HEC destination an

573

Has Anyone Had Their Destinations Drop Off But Only For The UI

dakotadabrowskiguidepointsecuNew Participant

Edge

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone had their destinations drop off but only for the UI? I had about 8 Cribl TCP destinations drop off the UI but when I open an individual node that is on

675

niteshsharmahelpagcomNew Participant

Connecting a Linux-based Cribl Worker to a Windows SQL Server using Domain/Windows Authentication

I am seeking technical guidance on configuring a Database Collector to connect to a Windows SQL Server using Domain/Windows Authentication from a Linux-based Worker Node.We are currently running Cribl Stream version 4.17.Our Worker Nodes are running

1333