Community Discussions

When does the license clock start midnight my local timezone or GMT?

What exactly does a Syslog source do when it experiences backpressure? Does it close the receiving port?

I created a script source in a distributed environment that pulls past x mins of logs from an API. Does it run on multiple worker nodes? If yes, is there a way to make sure it only runs on one node at a time to avoid duplicates?

Does anyone else deal with a high rate of job failures for Office365 Message Trace logs? Do I need to adjust my poll interval? Right now its at 10 minutes

Hi, we have a requirement to push a copy of all data to AWS for storage which I have just completed and it is working perfectly. I am now looking into how we can effectively monitor and get alerted as soon as there is any issue with Cribl pushing data to AWS and I was wondering if anyone else has done this etc? Do you only use the Notifications in Cribl to alert or is there a way to monitor this with Cribl logs (currently pushed to Splunk) where we can create urgent alerts for someone to investigate. I want to make sure that we get alerted as soon as there are any problems as we cannot afford to loose any data etc.

Has anyone tried to pass two Collect parameters using the same name in a REST collector using a Get collect method? When I try this, only the 1st parameter is included in the URL passed to the API. The API I'm using only allows you to pass date parameters using one parameter called "f" and only supports "LT" and "GT". In order to limit the API to return results from yesterday, I need the URL to include "f=http://date.gt:2023-01-06&f=date.lt:2023-01-07|date.gt:2023-01-06&f=date.lt:2023-01-07". When I put in both collect parameters, only the 1st "f" parameter is included in the URL. If I try to craft both the LT and GT in one parameter by setting the parameter value to 'http://date.gt:2023-01-06&f=date.lt:2023-01-07|date.gt:2023-01-06&f=date.lt:2023-01-07', the included "f=" is encoded to "f%3D" in the URL and the API does not recognize it as a parameter.

I'm trying to serialize into JSON and just keep the _raw field left over after bringing all the fields together. How do I prevent the double underscore internal Cribl fields from being inserted into the _raw field I'm creating?

I think I know the answer to this, but I need to ask anyway.I have an aggregation that MUST run over the entire event stream.Is there any way to force a pipeline to ONLY run on a single worker.

Hello.  I have a basic CloudTrail bucket and would like to have the account number part of the bucket path be able to be specified in a Cribl Search.How would I format a search query that looks for “account” 12345 if the path is as follows. …/AWSLogs/${account}/CloudTrail/…

anyway to deal with unix epoch nanoseconds like this 1672784149796000000 in event breaker rules?

Anyone know the proper method to extract something prior to pipelines to use for filtering?Case: I'm looking to use kubernetes.namespace_name as a field to compare against to send through different routes. It's nested inside _raw and I can't seem to get it to be referenced without doing some nasty .search() or .match() that could match with other data streams coming through that source

Teach me, oh Pipeline Wizards....I have DNS Header Flag fields coming in that are boolean, like `aa: false`, `ra: true`, `rd: true`, `tc: false`, etc. I would like to convert this to ECS by just having one object (`dns.header_flags`) with an array of the header flag names show in an array if their above referenced field value is `true`. So the JSON would end up being structured like this.```"dns": { "header_flags": [ "rd","rd" ],```And the false fields would be dropped. I would also like to be able to do this in one function instead of a function with a filter for each potential Header Flag Field.

Hello All, Is there a way to debug a kafka input? The workers don't consume any data, but the status is "Green". I know that there are live data in the topic as I can see it when using the `bin/kafka-console-consumer.sh` command with the same settings from a worker.

gonna sound funny but a Popular vendor in our telecom world does support sending webhook notifications for alarms/alerts (but the problem it only sends to 80 / 443 / 8443 (no custom port) i dont think cribl cloud supports these ports (but is there a online proxy like ngrok or something that i can send/relay to cribl cloud (i dont wanna cloud ---> punch hole through FW to allow 443/8443 and then back to criblCloud at least in this simple POC approachOriginal Thread on https://cribl-community.slack.com/archives/C022FME74PM/p1695069411755299

Hello,In a Cribl Distributed Deployment, with one Worker Group, and 2 Worker Nodes in this Worker Group, with a Source Splunk TCP enabled, and TLS enabled from Leader Node, It is not possible to use a unique certificate and passphrase for each Worker Node.It is possible, to have each Worker Node in a different Worker Group. But that means all the settings must be the same (Sources, Destination, Routes, Pipelines). That means in the end that the use of Leader Node is useless.Is that correct?Can we improve that? Or make an enhancement?Thank you!Best regards,Vali

There is an Exec source. Is it possible to have a similar function as a destination, ie. execute a command?

Hello,GivenSuccessful DB connection config (attached)DB collector config (attached)I get no results when i run the collector (attached)What is wrong or what is missing? Appreciate your support.

hello,Using REST Collector source and putting multiple URLs in the collect URL field, is there a way to mark the each event from which URL it was retrieved

I am seeing the below error messages:error: { [-]message: Unspecified GSS failure. Minor code may provide more information: No credentials cache found (filename: /tmp/krb5cc_176874)stack: Error: Unspecified GSS failure. Minor code may provide more information: No credentials cache found (filename: /tmp/krb5cc_176874)}level: errormessage: Authentication process failedIt seems the Kerberos tickets are being removed from the /tmp directory.  How do I change that?

Is it possible to use the REST API to run a collector job?

Hi does anybody have a full visio stencil for cribl? I've found a pack on the website but it doesn't contain the cribl single node stencil.Original Author: MateoOriginal message in Cribl Community Slack Message:https://cribl-community.slack.com/archives/C02A9EQV61J/p1687295477338279

Random question, and doesn’t really affect me or customer base atm, but is something that ALWAYS comes up with Splunk SaaS. When we say that that Cribl.Cloud instance is deployed within a VPC, is this VPC individual to the customer, or are they a tenant?Original Post is from https://cribl-community.slack.com/archives/C022FME74PM/p1664401586748939

For the on-prem workers in a hybrid deployment, which ports need to be open inbound?  Doc mentions 4200 and 443 outbound to Cribl cloud, but is communication from the Cloud back to the worker also on 4200? Or another port?

Hello, I haven't logged into my free instance for a while.  But now my commit buttons are greyed out with an error "Commit message must be at least 2 characters long".

hi all,Are the ingress ip’s listed in Cribl Cloud static?  I need to have some firewall changes implemented to allow events in.Original Post was from https://cribl-community.slack.com/archives/C022FME74PM/p1684846243115099