Community Discussions

Version 4.4.4 adds new capabilities and usability improvements to Cribl Stream, Cribl Edge, Cribl Search, and Cribl.Cloud:• Load balancing in the Webhook Destination. You can enable load balancing and specify multiple webhook URLs and their load weights, which sets relative traffic-handling capabilities for each connection. You can also choose whether to exclude all IPs of the current host from the list of resolved hostnames.• Exponential backoffs for HTTP request timeout errors in HTTP-based Destinations. You can configure the values for initial retry delay, retry delay multiplier, and maximum retry delay. This helps build in a time buffer before Stream retries an HTTP request.• Custom session timeout in Cribl.Cloud. In Cribl.Cloud Global Settings, you can now configure a Session idle time limit for the GUI. This helps keep pages up longer.• Cribl Search results are now automatically sorted in de

We've unleashed the Cribl Search sandbox in Cribl.Cloud. Get ready to dive into a world of Search wizardry where you'll master the magic of search syntax, data aggregation, data summarization, and even conjure up some dashboards from your saved searches. The best part? The sandbox is completed within your Cribl.Cloud organization, allowing you to return to it at any time.Click here and let the data adventures begin!

How can I get my edge nodes to send data to Cribl cloud so it can be seen in my end destination?

GOAT Mind, I am using a packet broker to aggregate my syslog data, then push it to Cribl Stream, which is running on Red Hat 9. I have had to spoof the MAC to the NIC and give it the accepting IP address that the Packet Broker is expecting to receive the data. Next I have had to modify kernel parameters so the data can be seen at the NIC.I can see the data at the NIC via tcpdump and ngrep. However, nether of the Crible Stream Sources Syslog or UDP are able to pick up the data, whether I use the specific IP for the NIC or leave it wide open (0.0.0.0).I have gone as far as SELinux running in permissive mode and disabled the firewalld, all with no luck with the source picking up data.Has anyone run into this issue and if so, how did they solve it?Scott

IMO, the Cribl logging need improvements.While in logs can see errors it is hard find which a pipeline, function causing it.My suggestion is to add infromation to each ERROR line about a pipeline and fuction releated to an error.

Hi All, i am facing an issue in Cribl data script, Actually the job is completed based on the logs, but it stuck saying 2 tasks inflight,We are using script option to pull the data, We have handled all the scenarios to prevent the issues, but after sometime, the job is getting stuck, As we can see in the above screenshot, totally 55 tasks( 1 discovery + 54 collector), and it says, 53 completed. But when I downloaded the logs where condition is ""message": "collect task completed","  based on this log count, inclusive of 0 to 53 totally 54. and all of them is completed but why the job didnt stopped.

I am confused about the new Cribl permissions system, I am in the process of configuring some roles for a local user, I am very happy with the fine grained controls available, especially allowing me to control individual endpoint access, the new permissions system appears to be much more coarse and losing a lot of functionality available in roles? Seems to be a "dumbing down" of the permissions system that takes away a lot of control?Hope I am misunderstanding this.Thanks for your help

The default format of exporting pipelines is the JSON. As the YML is used in config files, IMO, also exporting to this format should be possible.

Hi Community,Could anyone please help me configure MISP with Cribl via the Rest API collector. The 'x-rapidapi-key' is the MISP api key of the admin user the same api i gave in token attribute section and authentication I'm using username and password of the admin.Thanks in advance,

Hi Team,I am a Cribl Certified Engineer and have been working on a use case which is described below, but I haven't achieved the expected output.The use case involves an S3/Blob Storage where we have one bucket containing 2-3 folders. The source should be a specific folder, and from that folder, I need to ingest data to the required destination.In S3/Blob, I can see that regex can be used for matching file names to download and process, with the default being .*. Can I change it to /foldername/.*? Will this work? If yes, can I have a whitepaper or some documentation on this?

The question is focusing more towards your smaller companies, what are the usual problems your smaller customers present for first time setups?

HiI am new to cribl and i am trying to collect data from kafka, aggregate it and send it to victoriametricsfor that I have configured Prometheus destination http://xx.xx.xx.xx:8480/insert/0/prometheus/api/v1/import/prometheuswhen I run test all is ok but I don't see data in victoriametricsany idea why ?

I see it's possible for Cribl Search to read frozen Splunk buckets from S3 per this article below. Has anyone used it for reading Splunk frozen buckets, how fast are searches on multi-GB frozen buckets? Thanks https://community.cribl.io/kb/articles/30-search-splunk-backups-in-place-with-cribl-search?utm_source=community-search&utm_medium=organic-search&utm_term=splunk+frozen

Can i read azure event hub tags in cribl during the preprocess pipeline

Hi, I've been struggling with getting pagination to work correctly using the RestAPI Collector as a source. I'm trying to programmatically have Cribl grab software vulnerabilities that are identified in GitHub CodeQL using this API call:https://api.github.com/repos/myorg/myrepo/code-scanning/alertshttps://docs.github.com/en/rest/code-scanning/code-scanning?apiVersion=2022-11-28#get-a-code-scanning-analysis-for-a-repositoryI am able to successfully get the response, but I cannot figure out how to get pagination to work. The closest I've been able to get is adding the "per_page" parameter to my API call and hoping my containers have less than 100 vulnerabilities. I've tried adding "Link" as the response header attribute with no luck. When I do that, it seems to create an endless loop when I do a full run. Any guidance would be much appreciated.https://docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api

I wanted to ansiblize creating new cribl instances and have them fully up and functional/ready to login however this is my first barrier to entry. I want to untar cribl to /opt/cribl, run my playbook and then when I login it goes straight to the normal logged in page as I already accepted the agreement. Similar to Splunk's —accept-license

I am a long time Cribl & Splunk user, I have been on this platform for almost 5+ years now, and I have made my share of stupid stupid mistakes but learnt a lot about both Cribl & Splunk. In my journey to build a more resilient Cribl + Splunk environment with the constraints I do have($$ + time), I am constantly trying to make things a bit better and I introduced a change in my Splunk UF deployment. I set up some routing entries in my output.conf so that all index=_internal traffic is shipped directly to the Splunk IDX. The thinking was this allowed me to monitor my SplunkUF's and get ahead of any problems the Cribl workers may have in processing the events that we really care for. This change introduced some unintentional side effects which lead me to understand sourcePQ(sPQ) much better. My nodes ships out metrics periodically 24/7 and events on a much more systematic basis. Some of the nodes get very chatty during certain hours of the day and totally ra

Has anyone used a Transparent proxy when using Hybrid workers with CRIBL.Cloud ?We are having a weird issue where the workers work and communicate to CRIBL.Cloud Leader as expected but when the CRIBL.Cloud leader gets rebooted after an upgrade all the worker nodes get this error when trying to talk to the CRIBL.Cloud leader:Connection error: Client network socket disconnected before secure TLS connection was established

Is there a way to implement a password change on a Cribl Cloud local account WITHOUT using the "forgot password" link on the login page? Our access management process needs to have something like an API call or a simple password reset page available in order to implement our password management process.

what's an alternate input plugin for logs received from beats

Hi ,How do I make sure that only specific IP addresses or IP ranges can access my Cribl organization’s domain URL ?Thank you in advance

Hello. We are trying to set up a postgres database connection using cyberark (on prem).How would we build the connection string? Cribl expects the following format: postgres[ql]://[userspec@][hostspec][/dbname][?paramspec]But this doesn't seem to include any vault managed database user account.

Hi there,Does anyone has a working configuration to pull box.com API events that could share?I have been trying the following and somehow it is not working for me, not sure if I am not using the proper App or missing something else.https://github.com/criblio/collector-templates/tree/main/collectors/rest/box

I have a REST collector that is using Discover to collect the ID of the log I'm importing. Then an event breaker using the File Header break type. The issue is that I don't know what version of the event the Auto Timestamp extractor tries to process. The event from discovery where the format is JSON or the raw event during breaking. When I run the preview from the REST collector, I have have fields I can work with for the auto extraction unless auto extraction only works on the raw event which is CSV.