Skip to main content

Community Discussions

Do you have a question about a Cribl product? look no further

767 Topics
J
Justas NarauskasNew Participant
asked in Stream
Pagination of REST Collector discover results

Dear Cribl Community,Is there a way to paginate the DISCOVER (HTTP Request) stage results when using the REST API collector. The COLLECT stage has pagination parameters, but I can't figure out how to paginate discover results. Thanks!Regards,Justas

21
B
A
Anoop RamachandranNew Participant
asked in Stream
What is the expected behavior of Cribl if the Redis cluster is unavailable for some time?

Double checking on this, what is the expected behavior of Cribl if the Redis cluster is unavailable for some time? To my understanding events skip the Redis function (after default 30seconds) and processes through the rest of the pipeline. Is that how it is?

00
T
T
Tony REmployee
asked in General
Cribl TCP > Cribl TCP - Destination side getting a “message:sender state change” with a “stage: STAL

Hi, Using Cribl TCP > Cribl TCP and on the destination side getting a “message:sender state change” with a “stage: STALE”. Also seeing messages of “reason: marked as stale”. What is causing this and is this something to be concerned about ? Found this digging around as on the Cribl TCP destination we are seeing the “Blocked status” on the charts tab showing as 1 however all servers are green under the status. The final destination is also Green and we cannot find any reason why the Blocked status is enabled. Original message in Cribl Community Slack Message: https://cribl-community.slack.com/archives/CPYBPK65V/p1683177474390609

00
A
S
Silambarasan SelvamaniNew Participant
asked in Stream
Failure of worker node

When a worker nodes fail (down for whatever reason), what happens to the data that the specific worker had received for processing ( like, in-memory , PQ data ) ? Worker nodes receive data in distributed manner for processing , how does it ensures that data delivered to any third party destination (e.g. splunk ) is the chronological order of the events ?e.g. in case of hardware issues / slowness if a worker node is experiencing lag in processing data ., can it be expected that data send to any output destination has latency ?

01
R
B
Bryan RappParticipating Frequently
asked in Stream
Source alerting/notifications

Is there a configurable setting within Stream to alert or notify when a particular source stops sending events for a given period of time? Thanks

02
B
B
BeniNew Participant
asked in General
For DB Input, Adhoc it is working fine but not scheduled

HiI have DB Input. Adhoc it is working fine, but not scheduled. I can see different in the logs in the fields filtered.But I do not see an filter settings. I do not see any filter in the scheduler.Original Message: https://cribl-community.slack.com/archives/CPYBPK65V/p1688712420207369

01
B
V
Valeriu SargheNew Participant
asked in Stream
How can I see what data is going through the Default route?

As we know, we have the default route where there goes any data that was not taken by previous routes.Since that route has a filter true how can I find what data is going to that route? Capture is not helping of course because it has filtered trueAny other method except for negating all filters from previous routes?Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1688625589301539

10
B
T
Tony REmployee
asked in General
Is there any guide available for deploying Cribl standalone on a Azure Kubernetes Service?

Is there any guide available for deploying Cribl standalone on a Azure Kubernetes Service?Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1688623502905129

11
B
T
Tony REmployee
asked in Stream
Does the Cribl leader or worker need to have access to the internet to download the packs?

Hi does the Cribl leader or worker need to have access to the internet to download the packs?Original Question: https://cribl-community.slack.com/archives/C021UP7ETM3/p1688612591923099

01
B
M
Maxim ParkhomenkoNew Participant
asked in Stream
Cribl collect Windows Events throuth Windows Event Forwarder

I have bean configured source Windows Event Forwarder with certificate authorization. When my workstations sending events to cribl i had error "request error - processing error"

01
B
L
lewus.litttNew Participant
asked in Stream
How do you send in Windows Events?

I've been up and down all through the documentation and even NXLogs at https://docs.nxlog.co/refman/current/im/wseventing.html but I still can't seem to get the logs in. I can send just find to a Windows WEC without a certs so I know it's cert related.Does anyone have a guide or tips when working with Windows Events in a Domain and Certs?

01
J
P
Pawel KwiatkowskiInspiring
asked in Stream
Are some limitations of using tee functions?

E.g. I would like use subshell like $(date). Is it possible?

23
B
E
Eugene KatzEmployee
asked in General
How do I assign values to a field whose name is dynamic?

I'm trying to assign a value to a field whose name is a value of another field. I expected __e[fieldName] to work, but it doesn't seem to. I get foo2 , but not foo1

10
B
L
lewus.litttNew Participant
asked in Stream
How does one get invited to the Cribl Community Slack Server?

Just curious. I find the lack of support and community to make it harder to work with Cribl compared to other services.

02
J
M
Mugdha KhandekarNew Participant
asked in Stream
How to fix "Request payload size exceeds the limit:" "hit request concurrency limit" for Chronicle?

When a Google chronicle destination is configured, below errors are commonly seen? How to fix them?"hit request concurrency limit""Request payload size exceeds the limit: 1048576 bytes"

12
J
S
support_criblNew Participant
asked in Stream
Define Free Space for Destination Filesystem

Hi,is it possible to define how much space should be left free for a filesystem destination?Kind regards

01
T
S
seclabs.andrew.willNew Participant
asked in Stream
Ideal way to send Windows logs to Sentinel?

Currently, I have the Sentinel Agent installed on the windows machines. Would the best solution be to install edge on the all the window machines and send to stream or forward all the logs to a central windows machine and then send from there with Edge?

22
J
R
Richard DeAvilaNew Participant
asked in General
Cribl function for removing keys based off value

As a part of a cribl log processing pipeline, I want to add a function to remove any JSON keys that have empty strings or empty objects. I have a serialization function, such as this: - id: serde filter: "true" disabled: null conf: mode: reserialize type: json srcField: text fieldFilterExpr: value !=="" fields: [] remove: - .*but I don't want to reserialize, as it converts a JSON object during my pipeline into a JSON string. Is there another built-in function I can use to achieve this? Example input:{"my-log": {}, "my-other-log": "", "my-third-log": false} Expected output:{"my-third-log": false}

52
D
Q
Qian ZhaoNew Participant
asked in Stream
How to extract fields from the Microsoft-Windows-Security-Auditing

{ "_raw": "{"Id":4634,"Version":0,"Qualifiers":null,"Level":0,"Task":12545,"Opcode":0,"Keywords":-9214364837600034816,"RecordId":24675211,"ProviderName":"Microsoft-Windows-Security-Auditing","ProviderId":"54849625-5478-4994-a5ba-3e3b0328c30d","LogName":"Security","ProcessId":816,"ThreadId":2972,"MachineName":"vmwopsadm02-dev.hq.xxx.com","UserId":null,"TimeCreated":"\/Date(1686604325474)\/","ActivityId":null,"RelatedActivityId":null,"ContainerLog":"ForwardedEvents","MatchedQueryIds":[],"Bookmark":{},"LevelDisplayName":"Information","OpcodeDisplayName":"Info","TaskDisplayName":"Logoff","KeywordsDisplayNames":["Audit Success"],"Properties":[{"Value":"S-1-5-21-3567637-1906459281-1427260136-1830845"},{"Value":"VMWOPSADM03-DEV$"},{"Value":"xxx"},{"Value":"0xbc526b"},{"Value":"3"}],"Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-3567637-1906459281-1427260136-1830845\r\n\tAccount Name:\t\tVMWOPSADM03-DEV$\r\n\tAccount Domain:\t\txxx\r\n\tLogon ID:\t\t0xBC526

02
Q
N
New userNew Participant
asked in Stream
Lookup enrichment , Masking and unmasking

hello, I’m working on a dummy task. I have a lookup of 3 fields one of them is “card number” and it’s masked as shown in the attachment. I then have sample files that I need to enrich them with this lookup using the “card number” field as the joining field. The sample files have the “card number” field but umasked with normal digits. How can i enrich the sample files with the lookup when i don’t know the masking expression of the lookup field ?Can anyone help ?attached is the lookup file

21
B
B
Bryan RappParticipating Frequently
asked in Stream
Every firewall event is being cloned

I'm trying to figure out why every event from my pfsense firewall is being cloned as it passes through the pipeline. When I look at Preview Full from the Pipeline, I see the first event in my sample data file being processed as desired through the pipeline, then the second event is an unprocessed clone of the first. The third event is processed correctly by the pipeline, and the fourth event is an unprocessed clone, etc. When enabling the Advanced Setting to Show Internal Fields, I see a field called "__cloneCount". The value of this field in the correctly processed events is, "__cloneCount: 0", and the value for the unprocessed, cloned events is, "__cloneCount: 1". I've tried adding a Drop function to the end of the pipeline to drop events where, "__cloneCount == 1", but this has no effect. I've also tried to use Chain to call another pipeline to Drop the clone events, but this also has no effect. I though about adding a post-processing pipeline to the destination, but I'm sending to

08
B
J
Jeff GNew Participant
asked in Stream
Download file

Total Cribl noob. I've been asked to use Cribl to download a file at regular intervals, but I can't see how that is done. The source is not anything in our environment - it's an external entity. If I were to do it manually in a scheduled python job, it would look like this.oldest = (datetime.utcnow() - timedelta(hours=2)).strftime("%Y%m%d%H")file_name = f"{oldest}.tar.bz2" link = f"https://site.com/feeds/files/hourly/{oldest}"r = requests.get(link, headers={"x-apikey": apikey})file = BytesIO(r.content)I've been asked to download the file with Cribl, send it to s3, then extract it and ingest the contents into elastic. The thought is they expect more data sources in the future as I would probably consider it overkill, but I said I would give it a try and see. But not sure if it does that sort of thing. Thanks for any advice you can offer.

14
J
W
Wesley RaynorNew Participant
asked in Edge
Domain Controller security logs

Hello - I am testing out cribl stream/edge - first time user. Using version 4.1.2.I've deployed a stream server, a single worker and a Edge node leader.I've installed the edge node agents using the "Add/Update Edge Node" automated script. I've done this on 5 servers in my environment to test how this would work. So far, I can see logs coming into Edge/Stream and into my siem with one exception. My domain controller is not capturing/sending any data. I have followed this: https://docs.cribl.io/stream/usecase-edge-stream as my guide for the setup. The other 4 servers are working as expected but the domain controller is not. I dug and found at the end of an article https://docs.cribl.io/edge/sources-windows-event-logs which states to check permissions on a registry key and make sure it has read rights; I checked that and still no data. I have checked the logs found under programdata\cribl\ and nothing jumps out.cribl is now accounting for 40GBs of space on that dc in the span of 3

36
W
P
Pawel KwiatkowskiInspiring
asked in Stream
How to read data from buffer?

I would like decode data from buffer 'data'.I was trying use Buffer.from but with partial success.Any ideas how should be done properly?

01
B
S
SriPrashanth GunasekarNew Participant
asked in Stream
Replay Splunk Data by reading the Splunk frozen buckets

Have anybody tried to replay Splunk frozen buckets from AWS S3

01
J

Badge winners

Show all badges
Terms & ConditionsCookie settings