Skip to main content

Community Discussions

Do you have a question about a Cribl product? look no further

767 Topics
P
Pawel KwiatkowskiInspiring
asked in Stream
Redis. How to use a Redis query in a code function?

I would like define a Readis connection at the beginning of pipeline and reuse by a code functions through all an event live-time.Something like "C.Lookup" expression.PS: A Redis function is not applicable for my needs :).

03
B
H
HT GoatKnown Participant
asked in General
Can't bootstrap Edge node from Leader

Hi ,I have been trying to add an edge node into my default fleet but being denied because of permission error . I have run the script provided by the leader into an Ubuntu EC2 instance with a userwith privileged access but still failing ( see Screenshot ) . Can anyone assist please ? Thanks in advance

12
H
H
HT GoatKnown Participant
asked in General
Can ' t set up AWS S3 destination in Cribl using Hybrid Workers

Hi ,I ' m looking to add AWS S3 as a destination in Cribl while using a set of Hybrid Workers.I have followed the below instructions but yet failing to successfully test the connection . https://cribl.io/blog/securely-connecting-aws-s3-destination-to-cribl-cloud-and-hybrid-workers/The logs are showing the following errors even though the AWS Roles / Permissions / Policies have been correctly applied . The resources also appear to be sufficient on the Hybrid Workers nodes . This has worked fine with the Cribl Cloud managed workers .Can anyone please advise ?

14
H
F
Fredrik PalmqvistNew Participant
asked in Stream
Syslog parsing

Hi I am having some problem to get the host name out of some sample log files, the format is RCF 3164. And thru the documentation it says Cribl will try to parse that itself, do I need to decelerate that it syslog as a source?

11
J
H
HT GoatKnown Participant
asked in General
Can 't add Hybrid workers to Cribl Cloud

I 'm trying to add AWS hosted Hybrid workers into our instance of Cribl cloud ( Leader ) .The Workers VMs have been built using the CriblPrivateBuild from Amazon Marketplace .All the firewall policies are in place already . As per the instruction , I invoked the script from the leader and pasted it into our Hybrid Worker nodes but getting the following error ?Can anyone advise please ?Much Appreciated

06
H
J
Jari WeststrateParticipating Frequently
asked in Stream
host in hec events

L.s.,Maybe easy answer for all of you . We have got an HEC input and when i capture the live data i see as host the Cribl worker which is recieving the data. Why is that host filled?In the message itself there is also a host, but the right one. So i send the message in _raw to Splunk and delete the rest (also the wrong host). But tadaa.. there are two host in Splunk. The reciever Cribl and the one from the message.Any clue why?Thanks in advanceJari

03
J
J
Jari WeststrateParticipating Frequently
asked in Stream
filter expresion in route with wildcard

Hi,Maybe a simple answer (i hope). For a route we want to filer the host.name, but there are a lot of host in the list so a wildcard is the best way to filter.So doing like 'drnms10*.dmz.somewhere.nl' in the filter for the servers matching with this wildcard. But with a filter 'host == 'drnms10*.dmz.somewhere.nl'' wil not work. What is the best way to do this?I tried with a C.lookup and a lookup file.. it wil work. But stil have top maintain a list. And is a C.lookup not very slow in a filter?Thanks for the answer :)greetsJari

36
J
H
HT GoatKnown Participant
asked in General
Verify connection to Destination host

Hi,I' m working on a solution that consist of Cribl sending logs to an Onprem syslog server . Is there a way to confirm whether Cribl has established communication with the destination endpoint ( like a ping feature) . The monitoring section in Cribl is showing data is flowing but we can't find anything on the syslog server . Any assistance will be greatly appreciated.

23
J
E
emmanuel.manu@edwardjones.comNew Participant
asked in Stream
Getting an error message:Validation error (WrongType@[events])

I am getting the following error in stream from REST Collection. message:Validation error (WrongType@[events]) : argument 'between.startTime' with value 'StringValue{value='`${C.Time.strftime(new Date((earliest * 1000.toISOString()}`'}' is not a valid 'DateTime'Here is the schema for GraphSQL and Collect POST body i am using. What am i doing wrongly? can any help with setting the correct time value.GraphSQLbetween: { startTime: "`${C.Time.strftime(new Date((earliest * 1000.toISOString()}`" endTime: "`${C.Time.strftime(new Date((latest * 1000.toISOString()}`"}Collect POST bodybetween: { startTime: \"`${C.Time.strftime(new Date((earliest * 1000.toISOString()}`\" endTime: \"`${C.Time.strftime(new Date((latest * 1000.toISOString()}`\" }

01
J
M
Martin ZivnyNew Participant
asked in Stream
Statistic data from Zabbix event streaming to mysql reporting server

Hi, i'd like know what is recommended method to save Zabbix event data (source) to mysql (destination). I understand that mysql is not typical and preffered destination but thats my use case. Thank you

21
J
S
Srinath DayalaKnown Participant
asked in Stream
we are removing some fields using Eval function but the bytes_in and bytes_out are still the same.

we are removing some fields using Eval function but the bytes_in and bytes_out are still the same. But, in the pipeline statistics we can see the bytes_out is reduced but it is not reflecting in the Monitoring → Flows.

03
J
N
Norman MorrisNew Participant
asked in Search
Best way to repopulate S3 data into Splunk?

We are wanting to use Cribl to repopulate cloud trail logs from S3 into Splunk on-demand for review/audit/analysis purposes. Ideally, we would be able to request from within Splunk, but we could also query within Cribl to pull the data if necessary. Are there any best practices or use-cases that you can provide?

11
J
S
Srinath DayalaKnown Participant
asked in Stream
what is the equivalent of Splunk should_linemerge in Cribl?

I am getting data into Cribl and it is by default breaking on each line (also when there is no timestamp). So, i have added manual event breaking based on timestamp. But it still the same behavior. Is there a way to disable line breaking on each line?

17
S
S
Srinath DayalaKnown Participant
asked in General
Data to TCP JSON source it not captured

I am trying to send data to Cribl stream→ TCP Json source using curl command, and i can see the data is coming to Cribl worker node on the given port ( verified with tcpdump) but the same data is not being captured in the TCP JSON source. Any settings i am missing here?

010
S
H
HT GoatKnown Participant
asked in General
How to Protect Syslog data !!!!

Hi I'm in the process of setting up Cribl to send data from a syslog source ( AWS hosted Cisco FTDs) to Amazon S3 .Although the firewall rules are locked down to source and destination , I'm concerned about transmitting unprotected data over the Internet .Can you please advise on the best way to protect the traffic ?Thanks

210
H
H
Henri BülteNew Participant
asked in General
How does "teleporting" work in Cribl Stream and Edge?

How does the 'teleporting' function work on a technical level? Based on the documentation on ports (https://docs.cribl.io/stream/ports/), it seems no inbound ports need to be opened on worker or edge nodes for the feature to work. The leader node handles teleport functionality via port 4200. When teleporting to a node, does it simply stream the UI data to the leader, essentially mirroring the node's interface rather than establishing a direct session? I couldn’t find detailed documentation on this, and tools like TCP dump/Wireshark or internal logs haven’t provided further insights.Thank you :) https://docs.cribl.io/stream/ports/

43
J
D
Dinesh RajaNew Participant
asked in Stream
Configure REST Collector to fetch SIEM events from Akamai

Akamai has the SIEM API which allows to capture security events generated on the Akamai platform. We have been getting these events to Splunk via Splunk Add-on earlier https://splunkbase.splunk.com/app/4310/ and decided to try Cribl REST collector. After giving collect URL's & required credentials in collector's config, I can't see the events from Akamai and getting 400 error. not sure what's getting missed. "type": "https://problems./-/pep-authn/request-error", "title": "Bad request", "status": 400, "detail": "Authorization header missing",

184
A
F
FeGNew Participant
asked in Stream
log and sourcetype reporting in splunk

I want to report on logs ingested with Cribl in the Splunk environment. The logs will remain stored on the Cribl side, but the reporting will be done in Splunk. How can I achieve this?The logs are NOT forwarded to Splunk.thank you in advance for your answers

51
R
B
BalaNew Participant
asked in General
Different between Azure log analytics workspace and Cribl

What is the difference between cribl and Azure log analytics workspace...What is the benefit when I use instead of Azure LAW

51
R
T
tpevelerParticipating Frequently
asked in General
Cribl is stopped, but pid file exists

HiI have 2 cribl workers (cribl worker 1 and cribl worker 2 )managed by the same manager; cribl worker 1 goes down every now and then and has to be started manually. Status checks return the following: 'Cribl is stopped, but pid file exists'; can any of you please help me troubleshoot or point me in the right direction

24
S
A
Amir DadonNew Participant
asked in APIs
Issue with Obtaining JSON Access Token Using API Key in Cribl

Hi,I'm working on code that uses an API key to access my data in Cribl. I started by creating API credentials (client_id and client_secret) and built a simple script to obtain an access token, which I plan to use for querying logs.Here’s the code I wrote:import requestsclient_id = 'XXX'client_secret = 'XXX'auth_url = 'https://XXX.cribl.cloud/api/v1/auth/token'payload = {'grant_type': 'client_credentials','client_id': client_id,'client_secret': client_secret,'audience': 'https://api.cribl.cloud'}headers = {'Content-Type': 'application/json'}response = requests.post(auth_url, data=payload, headers=headers)When I run this, I receive a 200 response, but the content is not in JSON format. Instead, the content is:you need to enable JavaScript to run this app.It seems to be returning the web application HTML rather than a JSON response with an access token. My goal is to use this token in a query to fetch logs.Could you please help me understand why the token request is returning HTML instead

32
A
N
nada28.7.1996@gmail.comNew Participant
asked in Stream
Split AZURE event Hub records into individual events

I have tried Event Breaker on this type of data but it didn't work, it can't separate the record into individual events note: this is the live data streamed from Azure event hub and this is the event breaker configuration but if I use the same pipeline or the event breaker at the knowledge with the data in that shape it works fine and splits every record into an event I tried to use unroll but also didn't work so any suggestion on how can i solve this issue?thanks,

1310
Y
E
Ezell EdwardsNew Participant
asked in Stream
Has anyone had experience integrating Proofpoint logs into Cribl Stream? If so, could you share any

I been trying to find some formal documentation on bringing Proofpoint logs into Cribl steam and wonder if anyone had some experience or documentation they could share. At the time of this writing, there's not a cribl available for proofpoint logging.

291
J
K
Kacper HuzarNew Participant
asked in Edge
Why are no results received from PowerShell script

We are running a PowerShell scrip to collect AD Computers using the Get-ADComputer cmdlet and we are receiving this type of response in Cribl which is not what we are expecting to receive:{"time":"2024-09-20T14:40:32.097Z","cid":"w0","channel":"input:test-retrieve_ad_computers","level":"error","message":"error from child process","data":{"0":65,"1":116,"2":32,"3":108,"4":105,"5":110,"6":101,"7":58,"8":49,"9":32,"10":99,"11":104,"12":97,"13":114,"14":58,"15":49,"16":53,"17":54,"18":13,"19":10}}

01
B
G
Govardhanen GopalParticipating Frequently
asked in General
Using VSCode + nodejs to write/debug your code function

TL;DR Use VSCode to test out javascript "code" function locally before attempting it in Cribl Stream/Edge.I wanted to first give a shout out to @Jon Rust for pointing me in this direction. Paying it forward to other Cribl users who would like to give the code function a shot.I am using the example from the following pagehttps://docs.cribl.io/stream/usecase-code-function/#building-a-new-arrayI had a pipeline with about 40 functions which was used to take a bunch of metrics together and publish it as a multi-metric into splunk. I wrote this with David Maislins help about 3-4 years ago, and it was getting to be a bear to maintain and upate. The code function was the perfect candidate for this. I took 36 functions and consolidated into 1 code function which was much easier to debug. Please note I have NO experience with JS and this is just something I came up over 2 days of grinding.Make sure you have VSCode + nodejs installed in your computer. Further take the full payload of your i

22
G

Badge winners

Show all badges
Terms & ConditionsCookie settings