Community Discussions

Hello,While configuring cribl edge source of type file monitor and setting discovery mode to manual, it keeps on telling me permission denied(attached) and the *.log files are not monitored, although the user running cribl have access to this directory and the underneath *.log files. Attached the configuration of the source.Any idea what could be causing this issue?

If I am reading the docs correctly, when converting from json to CSV, I have to define all the fields. Since all of the fields are really already known, is there a way to output all the fields first without having to define all of them? We are working on converting some Azure logs, and there are LOTs of properties.field(s). Hoping there is another way without us having to define all of these in the "Fields to serialize" field within the Serialize function.

is there a way to remove the metric event but still send it to splunk not as a metric (if i hover over it says metric event) i was trying to move _value to value and _metric to metric__name

Can I add a field that isn't added to _raw, like not show up in the JSON that is the event?

Has Cribl considered Panther as a new possible Destination?

We have a source coming in that consists of many different sourcetypes all under the same sourcetype, and we want to assign sourcetypes in a pipeline. E.g. an event starts with `2023-06-15T00:00` it's going to be sourcetype A, another one starts with `INFO 06/15/23` that's sourcetype B and so on. How would I best set up the functions in the pipeline, so that when one of the assignments was made the others aren't tried (for logical and performance reasons - an event can only ever have one sourcetype)? I guess we could make the function final, but then other functions (after the sourcetype has been assigned) aren't applied either, e.g. aggreations on some of these sourcetypes. Should I create two pipelines, one just for assigning the sourcetype with final functions, and then a follow up pipeline for further processing?

:question: Is there a way to do POST to Cribl api endpoint (`/api/v1/version/sync`) from pipeline/destination?

Is there an easy way to view all the HEC tokens in a HEC source? Sometimes we have someone give us a HEC token that they say they were given and we need to search for it

What's the best practice when adding event breakers to sources with different teams using the same source? E.g. suppose I have a splunk tcp input, and several teams are sending data to it. When I need non-default line breaking, I need to add them to the Event Breakers under Processing Settings. There, I can either add one rule set per team, and each rule set could have any number of rules (e.g. one for this sourcetype, another one for a second sourcetype). I could also add one rule set per sourcetype however. I feel like the Event Breaker rulesets exist to logically group the line breaking rules, e.g. by team - correct?

Hi All,Does Cribl have a checkpoint feature, similar to Splunk's fishbucket feature?Eg. Ingesting from a source like kafka(doesn't know what it has sent) via Cribl to Splunk, but Cribl for some reason is down for a period of time, how does Cribl know what it's ingested already and what it hasn't.

Before I build something, is there a function that works with tabular data, like `top` output from linux? Could not find anything with google, but new to the product so maybe I don't know what to search for yet.

Hi Team, quick question. How do the Windows Edge Nodes extract Windows Event logs and forward them to Cribl? Does it spin a powrshell process and send logs up in batches?

I have a TCP JSON stream with massively long lines… i suspect Cribl is truncating them. Are there default limits for JSON processing? and are they tunable?

i am using parser function in extract mode for a key value pair data source. What I noticed is that, some of the events have two values for the same field `rule_uid = "1234556" | rule_uid = "78938794"` . Cribl seem to be keeping the second value for rule_uid field. What is a right way to preseve both the values for a field? I wonder if parser is the right choice for this.

Hi AllRegarding global variables, specifically string/array types, do they need to use/compare against values from an event, or can they maintain a static value from the definition of the global variable itself?Our use case:We have the three Redis hosts in our Sentinel config.We want to implement the Cribl Redis function across multiple sources in the environment, but to manage the host list/credentials in all of those separate Redis functions would be a nightmare.Can we use global variables to store the host list (either multiple string variables or an array that can be accessed based on index value), and then reference it in the Redis function's host fields using something akin to the below?`C.vars.prod_list[0] <-- first host value``C.vars.prod_list[1] <-- second host value``C.vars.prod_list[2] <-- third host value`Example in Redis (doesn't work, even with all the types of access I tried, in this example the array global variable type):

Hello guys,i applied a scheduler but it's not working:can you please help me to figure out the mistake.

does cribls collector for rest api support jwt?I need to generate an api key, then use this key for authorization (bearer) and then i can collect data but i've to set some dynamic fields like date in the body to collect the datahttps://platform.secutix.com/backend/dataexport/how_to

:question: - I have two branches. `master` is my production and `staging` is my staging/dev environment. I also have two redis servers for production (`production-redis`) and staging (`non-prod-redis`) Cribl. Now in redis function, how can I use `C.env.CRIBL_GIT_BRANCH` variable to specify either `production-redis` OR `non-prod-redis`?

A few question about PQ:Customer is performing a data center move. There backend will be unavailable for a few hours. Therefore, the customer wants to utilize PQ in Cribl. He needs to enable PQ first.Is there an option to globally enable or disable PQ? (There doesn't seem to be a button, but perhaps a simple API solution?)Is there an option to enable or disable PQ for all sources under the same "technology"? For example, all Syslog sources.What is better, source PQ or dest PQ? For destination PQ it is set once (he has only one destination for all sources), will it have an impact when destination comes back online? Would Source PQ be better for Cribl? Should both be set?What happens when PQ will be disabled? Will the data still in PQ be sent, or will it stay there forever?

Hey team! Looking into some dropped events when sending to one of my splunk sources. Heavy throughput, sending a large number of events, but trying to figure out why some are missing.I caught an instance where I had the live data stream open so I saw the event come in, and it never made it through. No error logs in Cribl stating the destination was having issues, no error logs in Splunk stating it did something bad with the event. Running it through the full preview and it looks like it should come out as expected on the Splunk side.Trying to understand after those steps where I might even be able to start looking for a miniscule number of dropped events.

I am new here and don't know where to start or ask this question.But, is there a way to add a function to the pipeline to drop for windows event logs that are sent via syslog to a separate SIEM that only collects logs via syslog?Below is an example of how the logs are post-processed in syslog.`Process Information: Process ID:`

Does anyone have experience using cribl to send prometheus metrics?In the OTEL destination doc, it describes that events must conform to otel protobuf spec, but doesn't describe how this would happen exactly: https://docs.cribl.io/stream/destinations-otel/#protocol-and-transport-supportIs there any automatic translation that can be applied, either on the source, some pipeline function, or a destination?

Is it possible to use Cribl to analyse network traffic in a similar way to Splunk Stream App? Can we ingest data off the wire into Cribl?

Does cribl had an agent that will run on IBM iseries? If so is it supported?

I have a collector I've setup to replay data from s3, but it's not honoring the original timestamp in the data, even though the pipeline I'm sending it to sets the timestamp as the original :c any ideas? (example, I'm replaying data from 5th Feb, and the timestamp is being set to today, even though my autotimestamp function sets _time to the epoch for 2nd feb). Example in thread