Discussions

Recently active
Unanswered questions

ProductUpdatesCommunity Manager

Known issue page(s) updated:Known Issue

Known issue page(s) updated: CRIBL-45369 | Worker Process memory leaks while Collection jobs run

1 hour ago

Jessica BrackenCommunity Manager

Other Guides

SSO: Members & Teams Roles May Not Align With Roles Granted by IDP Group MembershipF.A.Q.

QuestionWhy does Members & Teams show the Admin role for users that I've granted the Owner role via group membership in my SSO IDP?Environment Cribl environment with SSO configured for login AnswerFor SSO users, the role in the Cribl UI is update

3 hours ago

Jessica BrackenCommunity Manager

Using Available Fields for Initial Datatype Rule Filters in Cribl Search Lakehouse

ObjectiveWrite an initial Getting Data In (GDI) datatype rule filter in Cribl Search Lakehouse using the correct available fields.EnvironmentCribl Search 4.17.0 (Lakehouse engines) Search > Data > Getting Data In Initial Datatype / Dataset rule

3 hours ago

ProductUpdatesCommunity Manager

New known issue page(s) added:Known Issue

New known issue page(s) added: CRIBL-45369 | Worker Process memory leaks while Collection jobs run

4 hours ago

Jessica BrackenCommunity Manager

Stream

Cribl Stream Packs: Deleting a Default-Layer Resource Does Not Persist

SymptomWhen a destination, pipeline, or route is deleted from within a pack in the Cribl Stream UI, the resource appears to be removed. However, after a Commit & Deploy the resource reappears. Exporting the pack with local changes and re-importin

5 hours ago

Jessica BrackenCommunity Manager

Stream

Cribl Stream Kubernetes Workers Show High CPU at Low Ingest and Are OOMKilled

SymptomCribl Stream Worker pods deployed in Kubernetes show unexpectedly high CPU and memory usage even though processing and log-ingestion volume is low. One or more pods may later restart with OOMKilled.The two symptoms can have different causes. C

6 hours ago

Jessica BrackenCommunity Manager

Stream

Cribl Stream Leader Does Not Listen on Port 4200 After Restart Due to Insufficient Memory

SymptomAfter a Cribl Stream Leader restart or configuration change, port 4200 is not listening and Workers or Edge Nodes cannot reconnect to the Leader.The Leader logs can include:Shutdown:CB:Failed name: SocketRouter Error: Cannot read properties of

6 hours ago

ProductUpdatesCommunity Manager

New known issue page(s) added:Known Issue

New known issue page(s) added: CRIBL-45296 | Outpost TLS distributed setting failing on validation due to presence of lakeAzure entry in the payload

18 hours ago

ProductUpdatesCommunity Manager

New known issue page(s) added:Known Issue

New known issue page(s) added: CRIBL-45296 | Outpost TLS distributed setting failing on validation due to presence of lakeAzure entry in the payload

18 hours ago

LeeDVSNew Participant

Stream

(CC Admin - Stream | Stream Projects and Security Lab issue

I am currently stuck on the lab (CC Admin - Stream | Stream Projects and Security Lab), specially task 3.2 and 3.3. I was unable to add the team to the project with the Editor role because permissions field was grayed out and did not allow me to sel

111

1 day ago

LeeDVSNew Participant

Stream

(CC Admin - Stream | Stream Projects and Security Lab issue

111

1 day ago

mohamedelsheikhrenosystemsNew Participant

General

issue with Cribl Admin Stream

Hi,I’m a certified Cribl Admin user and finished all the admin user labs and course.currently working on Cribl Stream certification, I’m stuck with an issue I cant complete "Stream | Stream Projects and Security Lab” as it mentions that” In order to

742

3 days ago

johankellermansciberioNew Participant

Stream

Splunk Cloud license usage differs between Cribl Splunk LB S2S and Cribl HEC destinations — date_*/timepos fields to blame?

We've noticed that when sending data to Splunk Cloud that originates from an on-prem Splunk Heavy Forwarder (e.g. syslog and API), the Splunk license cost differs depending on whether we send the data via Splunk LB (S2S) or Splunk HEC destiantions. W

1322

1 month ago

NilkanthNew Participant

Edge

Looking for reusable parser/pack guidance for standard Linux log sources collected via File Monitor

We are currently working on a Linux log onboarding use case using Cribl Edge/File Monitor and forwarding the processed events to ADX/Sentinel.We have already built a pipeline that can parse some common Linux authentication events, especially from aut

600

1 month ago

louisNew Participant

Stream

Unable to create new Cribl Lake destination after deleting datasets

I was cleaning my Cribl.Cloud instance, and deleted datasets that I no longer needed, unaware that these datasets were still being used by destinations in Stream. When going back to Stream afterwards, I could not load the Lake destination page and wo

493

1 month ago

Pawel KwiatkowskiInspiring

Stream

An import/export of code to a yml format

An export of code is done to a json fromat only while on servers is used a yml fromat.IMHO, it should be possible to do import/export also in yml format. :)

752

3 months ago

itsjustjordynEmployee

General

Does Cribl have any documentation for pulling Workday report logs?

2942

3 months ago

Andrew LathamNew Participant

Stream

Debugging POST Body for HTTP REST Collector

I'm getting 400 responses on a POST Body that I'm trying to pass through the state.latestTime within the POST body. I would like to know what is being posted.I don't seem to be able to get a debug log out of my REST Collector to see what it is POSTin

1942

3 months ago

ashuNew Participant

Stream

Parsing for nested Json

Hi all i am having issue parsing nested Json the event goes like { "records": [ { "time": "2025-12-18T17:25:46.3598689Z", "operationName": "Publish"}{"time": "2025-12-18T17:25:46.3598689Z", "operationName": "Publish"} ], "_time":

1261

3 months ago

scott.bossi856Inspiring

Do I Send It To Search, Destination Or Do I Send It To Something Like A HEC Destination And Then Plugin The Endpoint…

This message originated from Cribl Community Slack.Click here to view the original link.I have data that gets processed in STREAM that I want to send to LHE. Do I send it to search, destination or do I send it to something like a HEC destination an

723

4 months ago

Don't see what you are looking for?

Ask a question