Community Discussions

Hello, I have my Cribl setup in GitOps mode (https://docs.cribl.io/stream/gitops/). I also have it setup to auth against Azure AD (https://docs.cribl.io/stream/usecase-azure-ad/). Further, I have defined several Azure AD groups including one that I have assigned the GitOps role to (https://docs.cribl.io/stream/gitops/#user-role). When I attempt to follow the instructions (https://docs.cribl.io/stream/gitops/) about obtaining a Bearer token and use an account that is only in Azure AD, I always get “Invalid user or password”. However, if I use an account that exists internal to Cribl, it will succeed. I want to setup GitHub workflows to automate the sync once I complete a pull request. I realize I could create an internal user in Cribl and assign the GitOps role to it and just use that. But, I think I should be able to do this with an Azure AD user too. Has anyone run into this before and found a resolution? Thanks!

I’m really having a hard time with the GitOps sync. I’ve repeatedly followed the steps to generate a bearer token and am always getting “Forbidden” when I attempt to make the production leader sync. This has worked in the past.mkdir -p ~/.authcurl http://<Leader-URL-or-IP>:9000/api/v1/auth/login -H 'Content-Type: application/json' -d "{\"username\":\"<username>\",\"password\":\"<password>\"}" 2>/dev/null | jq -r .token > ~/.auth/tokenexport JWT_AUTH_TOKEN=`cat ~/.auth/token`export AUTH_HEAD="Authorization:Bearer `cat ~/.auth/token`"curl -X POST "http://<Leader-URL-or-IP>:9000/api/v1/version/sync" -H "accept: application/json" -H "${AUTH_HEAD}" -d "ref=prod&deploy=true"Any suggestions?

For a JSON log using the default Cribl JSON event breaker, do you know what the name is of the top most object?  For instance, _raw is an object, but what is the name of the object containing _raw?

In the monitoring section, how is Free Memory calculated per worker?

Hello,Currently testing the process of sending logs to the Chronicle destination.How do i retrieve the data from the "_raw" field.I came across a blog post that seemed to be relevant to my use case, where it mentioned using the log text field as "_raw."https://cribl.io/blog/google-chronicle-ingestion/However, despite following the instructions, I have not been successful in getting it to work.Appreciate any help.

The host name was showing up properly in the old version 4.1.0, but now the host shows up as the ip address of the first interface on the box.  This is bare metal

Greetings, how do I delete an edge node from the UI?

Hello, I’m trying to creation a S3 destination and trying to figure out how I can add index value to the file name.  How do I pass the index field from the source to the S3 destination file name?

hello, i’m trying to create a sql server db connection, but got a self signed certificate error. Is there an option that I can use to bypass this issue?  I’m using the following format from the documentation: Server=localhost; Database=test;User Id=SA; Password=Testing123![; Option=Value]Original Author: Tae HaLink: https://cribl-community.slack.com/archives/CPYBPK65V/p1690207040810899?thread_ts=1690207040.810899&cid=CPYBPK65V

Does anyone have a splunk universal forwarder config they typically use for forwarding?Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1690293855973699Original Author: Matt

Dear Cribl Community,Is there a way to paginate the DISCOVER (HTTP Request) stage results when using the REST API collector. The COLLECT stage has pagination parameters, but I can't figure out how to paginate discover results. Thanks!Regards,Justas

When a worker nodes fail (down for whatever reason), what happens to the data that the specific worker had received for processing ( like, in-memory , PQ data ) ? Worker nodes receive data in distributed manner for processing , how does it ensures that data delivered to any third party destination (e.g. splunk ) is the chronological order of the events ?e.g. in case of hardware issues / slowness if a worker node is experiencing lag in processing data ., can it be expected that data send to any output destination has latency ?

Is there a configurable setting within Stream to alert or notify when a particular source stops sending events for a given period of time? Thanks

HiI have DB Input. Adhoc it is working fine, but not scheduled. I can see different in the logs in the fields filtered.But I do not see an filter settings. I do not see any filter in the scheduler.Original Message: https://cribl-community.slack.com/archives/CPYBPK65V/p1688712420207369

Is there any guide available for deploying Cribl standalone on a Azure Kubernetes Service?Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1688623502905129

Hi does the Cribl leader or worker need to have access to the internet to download the packs?Original Question: https://cribl-community.slack.com/archives/C021UP7ETM3/p1688612591923099

I have bean configured source Windows Event Forwarder with certificate authorization. When my workstations sending events to cribl i had error "request error - processing error"

I've been up and down all through the documentation and even NXLogs at https://docs.nxlog.co/refman/current/im/wseventing.html but I still can't seem to get the logs in. I can send just find to a Windows WEC without a certs so I know it's cert related.Does anyone have a guide or tips when working with Windows Events in a Domain and Certs?

E.g. I would like use subshell like $(date). Is it possible?

Just curious. I find the lack of support and community to make it harder to work with Cribl compared to other services.

When a Google chronicle destination is configured, below errors are commonly seen? How to fix them?"hit request concurrency limit""Request payload size exceeds the limit: 1048576 bytes"

Hi,is it possible to define how much space should be left free for a filesystem destination?Kind regards

Currently, I have the Sentinel Agent installed on the windows machines. Would the best solution be to install edge on the all the window machines and send to stream or forward all the logs to a central windows machine and then send from there with Edge?

As a part of a cribl log processing pipeline, I want to add a function to remove any JSON keys that have empty strings or empty objects. I have a serialization function, such as this: - id: serde filter: "true" disabled: null conf: mode: reserialize type: json srcField: text fieldFilterExpr: value !=="" fields: [] remove: - .*but I don't want to reserialize, as it converts a JSON object during my pipeline into a JSON string. Is there another built-in function I can use to achieve this? Example input:{"my-log": {}, "my-other-log": "", "my-third-log": false} Expected output:{"my-third-log": false}

{ "_raw": "{"Id":4634,"Version":0,"Qualifiers":null,"Level":0,"Task":12545,"Opcode":0,"Keywords":-9214364837600034816,"RecordId":24675211,"ProviderName":"Microsoft-Windows-Security-Auditing","ProviderId":"54849625-5478-4994-a5ba-3e3b0328c30d","LogName":"Security","ProcessId":816,"ThreadId":2972,"MachineName":"vmwopsadm02-dev.hq.xxx.com","UserId":null,"TimeCreated":"\/Date(1686604325474)\/","ActivityId":null,"RelatedActivityId":null,"ContainerLog":"ForwardedEvents","MatchedQueryIds":[],"Bookmark":{},"LevelDisplayName":"Information","OpcodeDisplayName":"Info","TaskDisplayName":"Logoff","KeywordsDisplayNames":["Audit Success"],"Properties":[{"Value":"S-1-5-21-3567637-1906459281-1427260136-1830845"},{"Value":"VMWOPSADM03-DEV$"},{"Value":"xxx"},{"Value":"0xbc526b"},{"Value":"3"}],"Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-3567637-1906459281-1427260136-1830845\r\n\tAccount Name:\t\tVMWOPSADM03-DEV$\r\n\tAccount Domain:\t\txxx\r\n\tLogon ID:\t\t0xBC526