Community Discussions

Does anyone know if the MinIO destination in Cribl Stream supports virtual hosting style addressing? In my experience it only seems to support path-style addressing which was deprecated by AWS in 2020.

Get ready to feast your eyes on our latest release! v4.4 brings several new capabilities and usability improvements to your Cribl deployment. Here are some of the features I am excited for. Make sure to check out the release notes for all the new features and corrections. Stream: https://docs.cribl.io/stream/release-notes/release-v44/ New Azure Data Explorer (ADX) native Destination enables sending security and observability data directly to ADX. This integration enables sending data to Azure Data Explorer customer tables as well as Cribl's supported native tables.System Metrics Source now supports configuring 

In an era where industry standards are as dynamic as the data they govern, Cribl’s core value of putting ‘Customers First, Always’ drives us to stay ahead of the curve. It’s with immense pride and excitement that we announce our strategic partnership with Elastic. This alliance isn’t just a meeting of minds; it’s a bold stride towards a future where flexibility in data management isn’t just a luxury – it’s the standard.Together, we combine our strengths in data processing with Elastic’s AI-driven search analytics to provide our customers with enhanced real-time insights and automated threat detection. This partnership is set to turn organizations’ data deluge into a strategic advantage, where efficient management meets precise compliance and actionable insights.You can read more about this exciting partnership at

So, this question has been bothering me for quite some time now. While I am a big fan of Cribl and I really enjoy working with their products and showing/explaining them to others I still wonder every now and then what value Stream would provide to a customer, who already has a well-maintained and functioning logstash for routing/transforming data.If I think about it the following points come to my mind, but if someone here has more/different reasons I would be glad to hear them!Stream's replay functionScalabilityLogstash works as a single instance, Cribl can be clustered to infinityStream is easier to maintainNo grepping around in config files for that one transformation command you need to changePipelines are easier to understand/maintain than logstash filesLess complex to get started with for new users/adminsVisualization of data flows"Debuggability" Being able to

When we check monitoring/sources we see metrics for the average thruput for both Events Per Second and Bytes Per Second for the sourcesHowever when we check monitoring/routes we see metrics for the average thruput for only Events Per Second and and NOT Bytes Per Second for the sources

End of Support for CentOS 6We will be deprecating support for CentOS 6 with our Cribl Stream and Cribl Edge 4.4.4 release. CentOS 6 reached its End-of-Life (EOL) status in 2020. Continuing to support it would impact our ability to maintain the high security standards we set for our products and customers. Removing support for CentOS 6 in a future version allows us to focus on more stable and secure environments.Action Required for Cribl Stream and Cribl Leader Users on CentOS 6If you are currently running Cribl Stream and the Cribl Leader on CentOS 6, we strongly recommend that you upgrade your operating system to at least CentOS 7 or later before updating to version 4.4.4. This step will ensure future functionality and security.Guidance for Cribl Edge Node Users on CentOS 6For those running Cribl Edge Nodes on CentOS 6, we strongly recommend upgrading your OS to CentOS 7 or later before updating you

Here at Cribl we are committed to making our customers' lives easier. One of the requests we had was how we can quickly ship new versions of our products into the Amazon Marketplace for customers who cannot use our SaaS offering Cribl.Cloud. Today we are announcing the availability of Cribl Amazon Machine Images or AMI’s for both x86_64 and ARM64  platforms. These two AMI’s can be used as part of a Free Tier for up-to 1TB/data per day. Customers can also elect to bring their own license and convert these images to paid Enterprise or Standard versions. This would also work for deploying hybrid Cribl worker nodes in our customer’s own AWS environment.The CloudFormation templates will still be available via our GitHub repo https://github.com/criblio/cribl-aws-cloudformation-templates .  Navigate to the AWS Marketplace and select the AMI archi

Version 4.4.4 adds new capabilities and usability improvements to Cribl Stream, Cribl Edge, Cribl Search, and Cribl.Cloud:• Load balancing in the Webhook Destination. You can enable load balancing and specify multiple webhook URLs and their load weights, which sets relative traffic-handling capabilities for each connection. You can also choose whether to exclude all IPs of the current host from the list of resolved hostnames.• Exponential backoffs for HTTP request timeout errors in HTTP-based Destinations. You can configure the values for initial retry delay, retry delay multiplier, and maximum retry delay. This helps build in a time buffer before Stream retries an HTTP request.• Custom session timeout in Cribl.Cloud. In Cribl.Cloud Global Settings, you can now configure a Session idle time limit for the GUI. This helps keep pages up longer.• Cribl Search results are now automatically sorted in de

We've unleashed the Cribl Search sandbox in Cribl.Cloud. Get ready to dive into a world of Search wizardry where you'll master the magic of search syntax, data aggregation, data summarization, and even conjure up some dashboards from your saved searches. The best part? The sandbox is completed within your Cribl.Cloud organization, allowing you to return to it at any time.Click here and let the data adventures begin!

How can I get my edge nodes to send data to Cribl cloud so it can be seen in my end destination?

GOAT Mind, I am using a packet broker to aggregate my syslog data, then push it to Cribl Stream, which is running on Red Hat 9. I have had to spoof the MAC to the NIC and give it the accepting IP address that the Packet Broker is expecting to receive the data. Next I have had to modify kernel parameters so the data can be seen at the NIC.I can see the data at the NIC via tcpdump and ngrep. However, nether of the Crible Stream Sources Syslog or UDP are able to pick up the data, whether I use the specific IP for the NIC or leave it wide open (0.0.0.0).I have gone as far as SELinux running in permissive mode and disabled the firewalld, all with no luck with the source picking up data.Has anyone run into this issue and if so, how did they solve it?Scott

IMO, the Cribl logging need improvements.While in logs can see errors it is hard find which a pipeline, function causing it.My suggestion is to add infromation to each ERROR line about a pipeline and fuction releated to an error.

Hi All, i am facing an issue in Cribl data script, Actually the job is completed based on the logs, but it stuck saying 2 tasks inflight,We are using script option to pull the data, We have handled all the scenarios to prevent the issues, but after sometime, the job is getting stuck, As we can see in the above screenshot, totally 55 tasks( 1 discovery + 54 collector), and it says, 53 completed. But when I downloaded the logs where condition is ""message": "collect task completed","  based on this log count, inclusive of 0 to 53 totally 54. and all of them is completed but why the job didnt stopped.

I am confused about the new Cribl permissions system, I am in the process of configuring some roles for a local user, I am very happy with the fine grained controls available, especially allowing me to control individual endpoint access, the new permissions system appears to be much more coarse and losing a lot of functionality available in roles? Seems to be a "dumbing down" of the permissions system that takes away a lot of control?Hope I am misunderstanding this.Thanks for your help

The default format of exporting pipelines is the JSON. As the YML is used in config files, IMO, also exporting to this format should be possible.

Hi Community,Could anyone please help me configure MISP with Cribl via the Rest API collector. The 'x-rapidapi-key' is the MISP api key of the admin user the same api i gave in token attribute section and authentication I'm using username and password of the admin.Thanks in advance,

Hi Team,I am a Cribl Certified Engineer and have been working on a use case which is described below, but I haven't achieved the expected output.The use case involves an S3/Blob Storage where we have one bucket containing 2-3 folders. The source should be a specific folder, and from that folder, I need to ingest data to the required destination.In S3/Blob, I can see that regex can be used for matching file names to download and process, with the default being .*. Can I change it to /foldername/.*? Will this work? If yes, can I have a whitepaper or some documentation on this?

The question is focusing more towards your smaller companies, what are the usual problems your smaller customers present for first time setups?

HiI am new to cribl and i am trying to collect data from kafka, aggregate it and send it to victoriametricsfor that I have configured Prometheus destination http://xx.xx.xx.xx:8480/insert/0/prometheus/api/v1/import/prometheuswhen I run test all is ok but I don't see data in victoriametricsany idea why ?

I see it's possible for Cribl Search to read frozen Splunk buckets from S3 per this article below. Has anyone used it for reading Splunk frozen buckets, how fast are searches on multi-GB frozen buckets? Thanks https://community.cribl.io/kb/articles/30-search-splunk-backups-in-place-with-cribl-search?utm_source=community-search&utm_medium=organic-search&utm_term=splunk+frozen

Can i read azure event hub tags in cribl during the preprocess pipeline

Hi, I've been struggling with getting pagination to work correctly using the RestAPI Collector as a source. I'm trying to programmatically have Cribl grab software vulnerabilities that are identified in GitHub CodeQL using this API call:https://api.github.com/repos/myorg/myrepo/code-scanning/alertshttps://docs.github.com/en/rest/code-scanning/code-scanning?apiVersion=2022-11-28#get-a-code-scanning-analysis-for-a-repositoryI am able to successfully get the response, but I cannot figure out how to get pagination to work. The closest I've been able to get is adding the "per_page" parameter to my API call and hoping my containers have less than 100 vulnerabilities. I've tried adding "Link" as the response header attribute with no luck. When I do that, it seems to create an endless loop when I do a full run. Any guidance would be much appreciated.https://docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api

I wanted to ansiblize creating new cribl instances and have them fully up and functional/ready to login however this is my first barrier to entry. I want to untar cribl to /opt/cribl, run my playbook and then when I login it goes straight to the normal logged in page as I already accepted the agreement. Similar to Splunk's —accept-license

I am a long time Cribl & Splunk user, I have been on this platform for almost 5+ years now, and I have made my share of stupid stupid mistakes but learnt a lot about both Cribl & Splunk. In my journey to build a more resilient Cribl + Splunk environment with the constraints I do have($$ + time), I am constantly trying to make things a bit better and I introduced a change in my Splunk UF deployment. I set up some routing entries in my output.conf so that all index=_internal traffic is shipped directly to the Splunk IDX. The thinking was this allowed me to monitor my SplunkUF's and get ahead of any problems the Cribl workers may have in processing the events that we really care for. This change introduced some unintentional side effects which lead me to understand sourcePQ(sPQ) much better. My nodes ships out metrics periodically 24/7 and events on a much more systematic basis. Some of the nodes get very chatty during certain hours of the day and totally ra