Community Discussions

In a Cribl source could be added fields https://docs.cribl.io/stream/sources-tcp-raw#fields.So just wondering if such option could be possible also in destinations.PS: yes, I know I can use post-processing pipelines.

This message originated from Cribl Community Slack.Click here to view the original link.I am shipping log data to an OTEL destination and I keep getting a RESOURCE_EXHAUSTED: gprc: received message after decompression larger than max 4194304 I am not really sure what I need to be tuning for this, in my pipeline I have my function set to batch in size of 4096 (see screenshot) and my destination is configured to have a body limit size of 4096 KB (see screenshot) - which should place me under that threshold per batch Has anyone encountered this or like error with an OTEL destination? any tips on what I can check out?Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Hey all. I'm relatively new to Stream so I might be missing some fundamental knowledge here, but I'm working through some data input consistency... can someone explain why I'm seeing drops in the Stream Home charts, but not when looking at cribl_metrics and total.in_bytes? What drives the Stream Home charts? I had a similar issue where my workers showed 0 free memory and CPU load average for a 90min window (and my route sparklines were flat), yet I have logs for that time period... I need to be sure that I haven't lost data and produce an accurate picture of what happened and why it looked like stuff went offline, or significant

This message originated from Cribl Community Slack.Click here to view the original link.IHAC that either wants us to write a data set(specific logs) to disk for an EFTU transfer to pick up from our workers, or for us to send to a windows file share. For the Filesystem destination Need clarification on output location. Not seeing clear details on configuring that in the docs. Does File system just write locally? Does file system write locally then you use file monitor from sources to pick up and send to a location? Is a shared windows folder an available destination? Thank you in advance, this is in PubSec very locked down environment

This message originated from Cribl Community Slack.Click here to view the original link.I have data that gets processed in STREAM that I want to send to LHE. Do I send it to search, destination or do I send it to something like a HEC destination and then plugin the endpoint that’s provided in the search sources?

This message originated from Cribl Community Slack.Click here to view the original link.can cribl search read splunk frozen buckets that I store in my own S3?

This message originated from Cribl Community Slack.Click here to view the original link.I've poked around a bit in the #channel history and didn't find a direct answer to this, so forgive me if I missed it. What is the simplest, most direct way to observe when a node becomes disconnected from the leader, preferably when it has been disconnected for x consecutive minutes? We're ingesting Cribl Stream logs into Splunk. Is this information in those? If not, which server-side logs might contain this information?

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone had their destinations drop off but only for the UI? I had about 8 Cribl TCP destinations drop off the UI but when I open an individual node that is on the current config, I can see all 8 destinations showing as green. Data is still flowing from those nodes too but I can't edit the destinations due to this issue. (empty screenshot is from fleet management, filled one is teleported inside a node in the same fleet, no pending commits)Links for this message:Screenshot 2026-04-28 at 12.05.05 PM.png

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone successfully used a lookup file to do Edge node mappings? I might be approaching this the wrong way but trying to move 100+ Edge nodes to a new fleet without having to re-deploy the nodes. Is there a better approach to what I am doing or are the only options: re-dploy edge nodes or use the world's longest mapping filter

I am seeking technical guidance on configuring a Database Collector to connect to a Windows SQL Server using Domain/Windows Authentication from a Linux-based Worker Node.We are currently running Cribl Stream version 4.17.Our Worker Nodes are running on Linux, and we need to authenticate against a remote MSSQL instance using a service account within our Active Directory domain. While standard SQL authentication (local DB users) works as expected, we are looking for the best practice to implement integrated Windows authentication in this cross-platform scenario.

Our current license is at 5 TB quota, and we ingest only 337 GBs/day. In the learning material of Cribl University, I saw a reference to a free license of up to 1 TB without distributed administration to the workers, is it possible for us to move from our current 5 TBs license to a free one?

This message originated from Cribl Community Slack.Click here to view the original link.Hi guys, I have workers running on-premises and data is being sent successfully from the source to the destination. I also have some workers running in AWS. These workers are able to receive data, but for some reason the Dynatrace destination keeps returning 401 Unauthorized, so the data is not being delivered to Dynatrace. I confirmed the following: If I SSH to any AWS worker, I can successfully send data to Dynatrace using curl with the same endpoint and auth token. Firewall connectivity is open. outputs.yml is synced correctly from the Leader to the AWS workers. The AWS workers are using a specific RHEL 8 image. I tried the suggested checks related to fapolicyd and SELinux, and I also tested with SELinux disabled, but the issu

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone set up HAProxy or some sort of load balancer up for their on prem stream worker nodes? Would appreciate any tips or lessons learned people may have.

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, I'm looking to add multiple teams to the cribl console that I manage. I won't be needing multiple workspace, so I consider using Projects in Stream . The setup is pretty simple, every team can read every projets but editor only of their own. My question is, is there any recommendations or tips to switch from using routes to subscriptions? Should I put all my routes to one sub, then let the teams filter with pipelines? Or make 1 sub per route already there? The goal is to make them autonomous without admin access

This message originated from Cribl Community Slack.Click here to view the original link.Hi all we are having this issue on the monitoring sectionLinks for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, is this billing endpoint no longer supported? I'm getting a 404 response: https://github.com/criblio/collector-templates/tree/main/collectors/rest/cribl_billing_credits Also, was the default rule set CriblAPI removed at some point? I'm trying to ingest system/metrics but the default Cribl ruleset is not helping. I've built a custom ruleset with JSON Array and array field pointing to 'results.metrics' which then parses the event correctly, but I'd like to know if there is a better way. Thanks!

This message originated from Cribl Community Slack.Click here to view the original link.Is they any way to capture a full Splunk HEC payload coming into the Splunk HEC source before it breaks out the event into _raw? I have a source sending into /services/collector/event so I know event in the JSON is what gets stored as _raw. I would like to see the rest of the JSON outside of the event field when the data is sent. It is a cloud based source so I cannot check on that end. Is this possible?

This message originated from Cribl Community Slack.Click here to view the original link.Any general recommendations on using C.Lookup in an EVAL, versus using the Lookup function? I've always just used the C.Lookup in the eval, but I'm curious if / what are the benefits of using one over the other

This message originated from Cribl Community Slack.Click here to view the original link.Is there a restriction on what ports I can use for incoming syslog traffic in Stream? I created a new one today on port 9516 and it will not come up. I deleted it, cloned a working config changing just the port to 9516, and again it did not work. I thought perhaps there was a restriction to stop me from using it, but the UI doesn't indicate any problem.

This message originated from Cribl Community Slack.Click here to view the original link.Hello all, I'm trying to configure File monitor on a fleet of Ubuntu host. The error I'm getting s EACCES: permission denied, watch '/var/log/whatever.log' Would the fix just be granting the Cribl user permissions over that folder? Since I don't have access to those folders, I want to see if someone has a known solution to this, can't test it out since I don't have access to the host and want to minimize effort for the team managing those host.

This message originated from Cribl Community Slack.Click here to view the original link.I am considering how to tune noise out of a stream of data in a route. I started with: source == 'pan' && _raw.includes('THREAT,vulnerability') && !(_raw.includes('SMB: User Password Brute Force Attempt(40004)') && raw.includes('adm<user>')) However, I can forsee this getting to be pretty long and granular. There must be a better way to architect this. Any suggestions?

This message originated from Cribl Community Slack.Click here to view the original link.i have some data that is getting processed in stream and I want to send it to search LHE. Will search take the timestamp that has already been created for the event within the pipeline, or do I need to create an additional timestamp config via datatypes?

This message originated from Cribl Community Slack.Click here to view the original link.Hi! Do you know if there is any type of performance advantage on using quickconnect instead of routes besides the fact of avoiding filter testing for each route? In my mental model, a quickconnect entry is a route that takes the input id as filter, but i wonder if there is a non-negligible difference in terms of performance.

This message originated from Cribl Community Slack.Click here to view the original link.I'm starting to toy and mess around with Cribl Edge as a possible replacement for our Splunk UFs. I know it natively has the Windows Event Log collection. Is there a way to filter down specific EventCodes or even specific occurrences of EventCodes right within the Edge endpoint? Reading through this I'm not seeing it super clear as to how to do that: https://docs.cribl.io/edge/sources-windows-event-logs/. The other thing I'm exploring is if anyone has gone down the path of monitoring Windows Registry changes using Cribl Edge? I'm assuming we can do this utilizing the Exec source in some way, but didn't

This message originated from Cribl Community Slack.Click here to view the original link.Hello Team, have a weird issue with a token in a dashboard in Cribl Search. I have a dropdown input that is populated by a search, which is working fine, however it has a value being returned that is Software/Technology I am trying to use the value to filter results in a table in one of the visualizations however I am getting an error because of the / character in the value. The error is Search failed: mismatched input '/' expecting {<EOF>, ';'}; token: /; line: 1 column: 119 is there any way to sanitize the token so that it can just search on the text?