Community Discussions

I was sending events to a syslog-ng server with the following configsource s_test { syslog( transport(tcp) port());};I introduced Stream, and now I’m not seeing those logs on our syslog-ng server. Instead, I’m seeing this:Invalid frame header; header=‘’syslog-ng[3025832]: Syslog connection closed; fd=‘12’, client=‘AF_INET(10.1.80.158:12506)’, local=‘AF_INET(0.0.0.0:23514)’How can I fix this?

I am interested in sending Heroku logs to Stream. Has anyone ever done this before?

Hello,We have turned on the cribl internal metrics source and are receiving all the metrics data in Splunk via HEC. The only metric we are not receiving is cribl.logstream.sourcetype.in_bytes. We are receiving out_bytes.Does anyone know the reason for this?Thank you

Hello,I have some trouble sending out system metrics from an Edge node to eventually Splunk. When the data stream is leaving Edge (captured at step 4) it still contains internal fields related to a metric event. When the data is collected in Stream all of those internal fields are missing and I'm ending up with a _raw field. There are no pipelines interfering with the data at all between Edge and Stream. Just a passthrough is set. Am I missing the point here? 🙂Do I have to manually transform the _raw to metric events again from Stream forwards? Is there a way to preserve the internal fields from Edge to Stream? Last resort is to send it out directly to Splunk HEC from Edge node but I want to channel as much through Stream as possible.Any thoughts? Thanks in advance!,Reemster

I was previously using SPLUNK to get data via a SPLUNK add-on that used an API query to pull down detections from the CrowdStrike platform. We are moving away from SPLUNK and trying to use CRIBL to get CrowdStrike data. CrowdStrike have a SIEM connector but this requires additional infrastructure and I am trying to see if I can use CRIBL to query CrowdStrike via the API to pull this information down. Has anyone attempted or tried this? I was stuck with the client id and key with the REST API, but I think this needs to be done separately and only use an authentication token (bearer) to make the connection.

The Microsoft Windows Events pack is currently dropping "SourceName=AD FS Auditing" events from the Security logs. I found the two lines that are not properly filtering the events.Pipeline: Windows Classic Events, "Final Cleanup" lines 27 & 28, (Serialize & Eval).I turned it off, but still working to get the events to not drop and convert to json.Q: Wondering if this filter is currently being updated/corrected?

Hi all, this is my first post on this forum, so hello. We have just begun to use CRIBL and I am still in a learning phase. I am wondering if there are more parsers that can be added to the library or whether you have to create them yourself? As an example I have a CRIBL instance that is receiving json data from another CRIBL instance (with the data having been prebaked SPLUNK) for a Cisco ASA log. The content of the log entry is in either the raw or Message field and I would like to extract into key value pairs. I have tried the some functions but it looks like I have to do custom regex (and I am not good with regex).

Can someone assist in explaining the difference between setting the Cribl General TLS settings versus the distributed TLS settings and what server certificates need to be applied? Where do we need to put the server.pem certs versus the web certs? Currently I am using mutual authentication and each host has their own self-signed certificates.

I am trying to pull event data from a remote location with http rest collector.It requires 2 stages to pull the data.Discovery will pull an array of job id's (and details).Collection will pull the results of each job from the array.When I set the collector up for discovery, I get the correct information including the ID.Using this id variable in the collection url I only get 1 event per id. If I hard code this id in the url AND disable collection, I get all events for that job.The throughput looks ok.But the capture window only captured 2 events. 1 from each job id.

Hello,I have a few general questions on Persistent Queues(PQ). I see PQ settings for Source & Destination, and further my question are specific to size & compression. 1. If I enable PQ and let the default size to be 1 MB & with compression turned on and if I get a burst of 100MB of events which Cribl Stream is unable to handle, does it create a 100 compressed files of 1 MB each? I understand my events will get delayed in getting indexed in Splunk, but will this guarantee that I eventually will get these events(Assuming I have PQ enabled on the destination side too).2. Is compression given as an option just so to mitigate disk utilization? 3. When I turn on PQ, I do see a few ndjson.*.gz files in the queues directory, but these are from about 20-60 minutes ago when I first enabled PQ, when i do a cursory check of the data, I am seeing all the events in Splunk. Does this mean the Cribl is busy and eventually will get through processing these gz files may be in a few ho

Hi there,Is a Pulsar connector for input/output analog Kafka planned?This would be a important addition to cribl stream, as pulsar is a fast growing platform and (for me) a successor to kafka.Best regards,

I am trying to setup SSO for our Cribl environments using Okta. I have successfully completed this within our DEV environment (which does not use agentless SSO). When testing the SSO setup in Prod, the login process gets stuck at the agentless desktop SSO step and will not progress past it.Does anyone have any ideas/recommendations as to what can be changed within Cribl, Okta, or somewhere else, that may help resolve this problem? We have not seen this issue with any other application at our enterprise except for Cribl.Thank you,Andrew

An F5 load-balancer was setup and should be sending syslog traffic to some Cribl Stream workers using round-robin. Currently there is a single source of events, for testing purposes. The events are almost exclusively going to a single worker, which is unexpected.The expectation is that the events would be load-balanced and that there would be a fair distribution across the worker nodes. According to F5 team, the connection gets load-balanced, so as more sources added, traffic will start showing on the other workers. That is to be expected but since UDP syslog is being used the events from a single source should already getting load balanced.

Does the unroll function support any other methods than split() ?Please give me your examples 🙂

Hi,I’ve configured an index template in Elastic for a specific log source and set it to use a data stream instead of the indices.Whenever Cribl starts sending data, the data stream is created, but no data is added to is. I presume this has something to do with the _bulk API, since data streams only support the op_type create.Does anyone have a working configuration for logging towards data streams in Elastic?

Hi, I have problem with deploy config from Leader to Worker. I have distributed deployment with 2 Workers and 1 worker group (testing, free license used). I configured secure connection between Leader and Workers according to https://docs.cribl.io/stream/securing-communications 1. For the first look everything is OK - both Workers are visible on Manage Worker Nodes on Leader as alive, I can connect to Workers GUI (Remote UI Access is on), config version is OK etc.Problem is when I want to deploy config changes to Workers. On Manage Worker Nodes I see yellow exclamation mark and neverending rotating circle in Config version column and config changes are not propagated to Workers.In log on Leader I see this:{"time":"2022-06-17T13:01:21.350Z","cid":"api","channel":"CriblMaster","level":"info","message":"sending config update request","group":"default","version":"8627dcf","logStreamEnv":"master","worker":"ff5ea4c4-51eb-4aa4-a650-2e6c8251bb21"}{"time":"2022-06-17T13:01:21.363Z","cid":"api",

HiWe have setup event hub to send data stream to cribl and our now trying to extract the json into individual events. We have tried the event breaker JSON Array method and JSON unroll method. Neither seems to work. Has anyone tried this successfully or have pointers?Thank you

Are the available Redis commands in the dropdown list or should I go by the complete list at the URL provided when I hover over the ‘?’?I’m trying to set multiple values for a hash and I’m having trouble grabbing the key-value pairs from my event to send. I’m not sure if it’s a limitation or I’m doing something incorrectly. I’m using ‘__e’ to grab the entire event (Args section) and specifying a key. The Command section allows me to put in hmset.

Can I use self-signed certificate with a REST collector? Does Cribl perform any TLS certificate validity checks?

If I need to accept an SNMP trap from a source, and send it to multiple trap destinations, will Cribl spoof the source IP and send the trap “un-altered” to the final destinations? Meaning will it preserve the source IP address from the original trap IP header?

I’ve made the switch from a single instance to a distributed setup (1 leader and 2 worker nodes). My old server, which receives logs from a variety of sources, is now acting as a worker. What happens if this worker goes down, because all of the sources are sending logs to one single worker IP? What should I do to guarantee appropriate high availability?

Not a question but rather something useful. I have data that is in key:value format, using key=value in the extract format did not work. I was able to extract every key and value with this one regex extract.(?<_NAME_0>.*):\s(?<_VALUE_0>.*)

i have a use case where we have a nfs share that applications writes logs too i would like to monitor these while being written to (file monitor?) but distribute the load across workers. is that possible?

Hi guys,I’m testing cribl stream for the 1st time by getting a splunk UF to forward to a Worker on the same centos7 host (ip: 10.0.2.9).When checking Live Data, I only see events from /opt/splunkforwarder/var/log/splunk/metrics.logI was expecting to see events from /var/log/audit/audit.log and /var/log/secure which are listed as being monitored files:/opt/splunkforwarder/bin/splunk list monitorYour session is invalid. Please login.Splunk username: adminPassword:Monitored Directories:$SPLUNK_HOME/var/log/splunk/opt/splunkforwarder/var/log/splunk/audit.log/opt/splunkforwarder/var/log/splunk/btool.log/opt/splunkforwarder/var/log/splunk/conf.log/opt/splunkforwarder/var/log/splunk/configuration_change.log/opt/splunkforwarder/var/log/splunk/dfm_stderr.log/opt/splunkforwarder/var/log/splunk/dfm_stdout.log/opt/splunkforwarder/var/log/splunk/first_install.log/opt/splunkforwarder/var/log/splunk/health.log/opt/splunkforwarder/var/log/splunk/license_usage.log/opt/splunkforwarder/var/log/sp

What does this message indicate on the Splunk TCP source:message:Failed to parse s2s payload{}error:αmessage:Cannot advance offset 2023514992 past end of event 74αstack:Error: Cannot advance offset 2023514992 past end of event 74at p.advance (/opt/cribl/bin/cribl.js:14:12271888)at h._readEvents (/opt/cribl/bin/cribl.js:14:12274323)at h._transform (/opt/cribl/bin/cribl.js:14:12275791)at h.Transform._read (_stream_transform.js:205:10)at h.Transform._write (_stream_transform.js:193:12)at writeOrBuffer (_stream_writable.js:352:12)at h.Writable.write (_stream_writable.js:303:10)at Socket.ondata (_stream_readable.js:719:22)at Socket.emit (events.js:315:20)at Socket.EventEmitter.emit (domain.js:486:12)Show less