Community Discussions

Is there an easy way to view all the HEC tokens in a HEC source? Sometimes we have someone give us a HEC token that they say they were given and we need to search for it

What's the best practice when adding event breakers to sources with different teams using the same source? E.g. suppose I have a splunk tcp input, and several teams are sending data to it. When I need non-default line breaking, I need to add them to the Event Breakers under Processing Settings. There, I can either add one rule set per team, and each rule set could have any number of rules (e.g. one for this sourcetype, another one for a second sourcetype). I could also add one rule set per sourcetype however. I feel like the Event Breaker rulesets exist to logically group the line breaking rules, e.g. by team - correct?

Hi All,Does Cribl have a checkpoint feature, similar to Splunk's fishbucket feature?Eg. Ingesting from a source like kafka(doesn't know what it has sent) via Cribl to Splunk, but Cribl for some reason is down for a period of time, how does Cribl know what it's ingested already and what it hasn't.

Before I build something, is there a function that works with tabular data, like `top` output from linux? Could not find anything with google, but new to the product so maybe I don't know what to search for yet.

Hi Team, quick question. How do the Windows Edge Nodes extract Windows Event logs and forward them to Cribl? Does it spin a powrshell process and send logs up in batches?

I have a TCP JSON stream with massively long lines… i suspect Cribl is truncating them. Are there default limits for JSON processing? and are they tunable?

i am using parser function in extract mode for a key value pair data source. What I noticed is that, some of the events have two values for the same field `rule_uid = "1234556" | rule_uid = "78938794"` . Cribl seem to be keeping the second value for rule_uid field. What is a right way to preseve both the values for a field? I wonder if parser is the right choice for this.

Hi AllRegarding global variables, specifically string/array types, do they need to use/compare against values from an event, or can they maintain a static value from the definition of the global variable itself?Our use case:We have the three Redis hosts in our Sentinel config.We want to implement the Cribl Redis function across multiple sources in the environment, but to manage the host list/credentials in all of those separate Redis functions would be a nightmare.Can we use global variables to store the host list (either multiple string variables or an array that can be accessed based on index value), and then reference it in the Redis function's host fields using something akin to the below?`C.vars.prod_list[0] <-- first host value``C.vars.prod_list[1] <-- second host value``C.vars.prod_list[2] <-- third host value`Example in Redis (doesn't work, even with all the types of access I tried, in this example the array global variable type):

Hello guys,i applied a scheduler but it's not working:can you please help me to figure out the mistake.

does cribls collector for rest api support jwt?I need to generate an api key, then use this key for authorization (bearer) and then i can collect data but i've to set some dynamic fields like date in the body to collect the datahttps://platform.secutix.com/backend/dataexport/how_to

:question: - I have two branches. `master` is my production and `staging` is my staging/dev environment. I also have two redis servers for production (`production-redis`) and staging (`non-prod-redis`) Cribl. Now in redis function, how can I use `C.env.CRIBL_GIT_BRANCH` variable to specify either `production-redis` OR `non-prod-redis`?

A few question about PQ:Customer is performing a data center move. There backend will be unavailable for a few hours. Therefore, the customer wants to utilize PQ in Cribl. He needs to enable PQ first.Is there an option to globally enable or disable PQ? (There doesn't seem to be a button, but perhaps a simple API solution?)Is there an option to enable or disable PQ for all sources under the same "technology"? For example, all Syslog sources.What is better, source PQ or dest PQ? For destination PQ it is set once (he has only one destination for all sources), will it have an impact when destination comes back online? Would Source PQ be better for Cribl? Should both be set?What happens when PQ will be disabled? Will the data still in PQ be sent, or will it stay there forever?

Hey team! Looking into some dropped events when sending to one of my splunk sources. Heavy throughput, sending a large number of events, but trying to figure out why some are missing.I caught an instance where I had the live data stream open so I saw the event come in, and it never made it through. No error logs in Cribl stating the destination was having issues, no error logs in Splunk stating it did something bad with the event. Running it through the full preview and it looks like it should come out as expected on the Splunk side.Trying to understand after those steps where I might even be able to start looking for a miniscule number of dropped events.

I am new here and don't know where to start or ask this question.But, is there a way to add a function to the pipeline to drop for windows event logs that are sent via syslog to a separate SIEM that only collects logs via syslog?Below is an example of how the logs are post-processed in syslog.`Process Information: Process ID:`

Does anyone have experience using cribl to send prometheus metrics?In the OTEL destination doc, it describes that events must conform to otel protobuf spec, but doesn't describe how this would happen exactly: https://docs.cribl.io/stream/destinations-otel/#protocol-and-transport-supportIs there any automatic translation that can be applied, either on the source, some pipeline function, or a destination?

Is it possible to use Cribl to analyse network traffic in a similar way to Splunk Stream App? Can we ingest data off the wire into Cribl?

Does cribl had an agent that will run on IBM iseries? If so is it supported?

I have a collector I've setup to replay data from s3, but it's not honoring the original timestamp in the data, even though the pipeline I'm sending it to sets the timestamp as the original :c any ideas? (example, I'm replaying data from 5th Feb, and the timestamp is being set to today, even though my autotimestamp function sets _time to the epoch for 2nd feb). Example in thread

Hi Team,[Urgent]As per the best practices, we created a non-sudo user called Cribl and enable the boot-start. In our environment, we can't use other than 514 ports for syslog receiving but we are getting the Error: "bind EACCES 0.0.0.0:514". as per the Cribl documentation we did the below.systemctl edit cribl[Service]AmbientCapabilities=CAP_NET_BIND_SERVICEBut we are getting the attached error and we are still not able to add the 514 ports in syslog source.

Hello Guys,when i trying to pushing data inside the Elasticsearch. that time data take place inside the elastic with current timestamp. but i wanna set event in the elastic with given time.for achieving this i try this one. but didn't get success:

Hello!Has anyone made it to get data from InfluxDB to Cribl? Is it even possible?

Hi! I was looking into using cribl for sending in data from amazon kinesis firehose into cribl. But there is no format for the data to be send mentioned in the documentation. And there is no event breaker support also. So what format should be followed? is it ndjson or is there anything I'm missing?

I need to replace an existing leader instance with a new instance, the new instance has Cribl installed but not configured for anything. The current leader has remote git enabled, from my understanding the easiest way to migrate to the new leader is by following this procedure given here https://docs.cribl.io/stream/version-control/#restoring-master-from-remote-repo . The question i have is, is it okay if the Cribl was started after installing? Can I stop it and proceed with the steps? Asking this because of this line in the documentation`"Important: In a directory of choice, untar the same Cribl Stream version that you're trying to restore, but do not start it."`

Hello!I am using HTTP Discover and Collect with Login Authentication, to take the notifications.log.Then I pass them to a route and send them to Splunk.Question: Does Collect has a checkpoint option? Currently, every run on collect, gets the entire file every time, so getting duplicates.

Hi there,Question about encryption keys: would it be possible to use the same encryption key in an Edge fleet and in a Stream worker group ?I have a use case where we need to encrypt data at the source (Edge) and send it to a S3 compatible storage. Then I should be able to retrieve data from the S3 bucket using a collector Job that would be ran from a Stream worker group and then use a pipeline for decryption. Does it make sense ?For those of you who are going to tell me to forward data from Edge to Stream and then use Encrypt function before sending to S3 I would answer to them that the Sec team insists to encrypt data the closest to the source