Community Discussions

We've noticed that when sending data to Splunk Cloud that originates from an on-prem Splunk Heavy Forwarder (e.g. syslog and API), the Splunk license cost differs depending on whether we send the data via Splunk LB (S2S) or Splunk HEC destiantions. We think that the date_* and timepos fields are responsible for the increase in license usage. If we strip these fields in a Cribl pipeline before sending to Splunk Cloud, license usage looks fine and in line with direct-to-Splunk ingestions, but the events are then missing these expected fields (whereas with native Splunk components, the fields are present). The raw event size doesn't differ (| eval raw_len=len(_raw)). Have you encountered this before, and if so, how did you solve it?

Hi Team,I'm currently facing issues accessing this lab environment for my lab work in order to become a cribl certified user. Been loading for hours ​​ 

**Environment:**- Cribl Version: 4.18.1- Leader: AWS eu-west-1, behind internal NLB (port 4200)- Outpost: On-prem Linux server Background: We are deploying Cribl Edge nodes on-prem. The generated bootstrap script points to the Outpost server on port 9000 (default). When we run the script as-is, the `/init/cribl-edge` endpoint returns an HTML page (the Cribl Web UI) instead of a shell script:But when we modified the bootstrap script to use port 4200 instead of 9000, pointing to the same Outpost server. With port 4200, the `/init/cribl-edge` endpoint returns the correct shell script, the Edge node installs successfully, and it connects and reports to the Leader as expected.Question:Is it expected/by design that the Edge bootstrap endpoint `/init/cribl-edge` only works on port 4200 (the distributed communications port) and not port 9000 (the web UI/API port) on an Outpost server?The default generated bootstrap script uses port 9000. Is this a bug in the script generation, a misconfigurati

This message originated from Cribl Community Slack.Click here to view the original link.What's the safest way to migrate a leader's configuration to a new host? Would there be many issues with moving the entire /opt/cribl directory over? Maybe just do /groups/?

This message originated from Cribl Community Slack.Click here to view the original link.Separate question about Cribl Lake destinations in Cribl Stream - what is the path for the "staging directory" for this destination?

This message originated from Cribl Community Slack.Click here to view the original link.Can I use a value calculated/extracted in a pre-processor pipeline to manage a collector's state?

This message originated from Cribl Community Slack.Click here to view the original link.Hi Team, Do we know if Adobe supports Cribl's RAW HTTP Source for webhook URL? Currently, Adobe's verification of the webhook URL is failing - we're seeing a 604 from Adobe's side although the uri path at the Cribl source is reachable & listening.

This message originated from Cribl Community Slack.Click here to view the original link.Trying to setup a brand new Windows 11 Splunk UF and point it at Cribl.Cloud Splunk TCP /w TLS, no client auth. Using the default cribl provided TLS certificates on the endpoint, following the directions at https://docs.cribl.io/stream/sources-splunk/#config-splunk-fwd but the UF won't connect, it repeats the following continously: 06-02-2026 16:00:49.883 -0500 ERROR TcpOutputFd [4296 TcpOutEloop] - Invalid payload_size=352518912 received while in parseState=1 06-02-2026 16:00:49.883 -0500 WARN AutoLoadBalancedConnectionStrategy [4296 TcpOutEloop] - Applying quarantine to ip=100.20.132.14 port=9997 connid=2 _numberOfFailures=2

This message originated from Cribl Community Slack.Click here to view the original link.Hi Team , from the Cribl side , which log gives us visibility into what is happening during PQ flushing

This message originated from Cribl Community Slack.Click here to view the original link.Hi Goaties, we are looking to activate IPv6 for certain sources. The source needs to receive via IPv4 alongside with IPv6. Can anybody assist please? I didnt find any info in regards to this topic in the docs.

This message originated from Cribl Community Slack.Click here to view the original link.Hello! Is there a method to have a destination that uses an event field to update the endpoint url? Event {"table_id": "40004930"} Destination https://erehwon:8080/api/v1/table/${table_id}

This message originated from Cribl Community Slack.Click here to view the original link.Can we use either Cribl HTTP or TCP for edge to stream routing? Are there any pros and cons to using one over the other?

This message originated from Cribl Community Slack.Click here to view the original link.If the index of a Syslog source isn't specified in the Fields panel, which index would it go to in Splunk?

Just curious. I find the lack of support and community to make it harder to work with Cribl compared to other services.

Every time we update openshift in azure, my cribl config is lost. since we have the free version, we cannot use git repository. would using persistent storage helps keep the config because the update process drains the node from the cluster and restart them on another node. I suspect this is why the config is not kept.

Is it possible to install cribl stream and use node-oracledb in thick mode or there is no way to let cribl stream know that there is an oracle instant client package installed available in the podman container? thanks

An export of code is done to a json fromat only while on servers is used a yml fromat.IMHO, it should be possible to do import/export also in yml format. :)

Does Cribl have any documentation for pulling Workday report logs?

Hi,I am facing an issue while using a REST API source (Cohesity audit logs).The API returns a valid JSON response in this format:However, in Cribl preview/capture, the data is not coming as a single complete JSON object. Instead:One event contains the correct full JSON Other events are split fragments (starting mid-string, not valid JSON)Example behavior:Event 1 → valid JSON object ({"auditLogs": [...]}) Event 2+ → partial JSON fragments (missing opening {, starting inside fields)Because of this:JSON.parse(_raw) fails or behaves inconsistently JSON Unroll cannot work reliably Derived fields (e.g., TimeGenerated) are null Parsing becomes impossible for many eventsObservations:cribl_breaker shows OData JSON:single-object Sometimes fallback behavior is applied Custom event breaker with JSON Array also did not produce consistent results Pipeline-level filtering/parsing only works partially because upstream data is already fragmentedQuestionHow can we ensure that the REST API response is tr

In a Cribl source could be added fields https://docs.cribl.io/stream/sources-tcp-raw#fields.So just wondering if such option could be possible also in destinations.PS: yes, I know I can use post-processing pipelines.

I'm getting 400 responses on a POST Body that I'm trying to pass through the state.latestTime within the POST body. I would like to know what is being posted.I don't seem to be able to get a debug log out of my REST Collector to see what it is POSTing. What it's deriving from state.latestTime.Anyone know where I can find this? The debug logs seem to only show the URL, not the POST Body

Hi all i am having issue parsing nested Json the event goes like {  "records": [    {      "time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}{"time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}  ],  "_time": 1766078828.252,  "index": "index",  "sourcetype": "sourcetype",  "source": "source"}so basically, records field have multiple Json event Nested in it  i want to extract to individual events with parent fields like metadata carried to each right now when i use event breaker i am getting no change can someone help me  

This message originated from Cribl Community Slack.Click here to view the original link.hello im having issues with JSON Unroll and I'm not sure why it's not working. I've tried everything imaginable path with quotes, without quotes, etc. but it still does not work. total.in_bytes is the name of the array every element of which should be extracted to a field test as a new event. But it is not workingLinks for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.We have 10 workers, do we normally put a load balancer in front of the workers, or the data is being routed straight to the workers?

This message originated from Cribl Community Slack.Click here to view the original link.We set up Cribl TCP destination to send logs to a Cribl TCP source in another Worker Group. We are sending a high-volume source (~1TB/day) and using Always On source persistent queuing. The Cribl TCP destination does not have persistent queuing enabled and is set to drop events when backpressure signals are received from the destination (the Cribl TCP source) as we felt that using PQ on both sides would be redundant and we don't want to place any additional load on the sending Worker Group. However, we are seeing events being dropped at the destination with this configuration, and it looks like the Cribl TCP source is constantly exerting backpressure, even in Always On mode with plenty of disk available to queue logs. Any ideas why this would happen? I would expect the queue disk to fill up for a Worker Process before the source would excerpt backpressure. I read this (https://docs.cribl.io/stream/p