Community Discussions

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to leverage the send command in Cribl Search. I have enabled a Cribl HTTP source in Cribl Stream that listens on port 10200 listening from all addresses. The worker group that this source is enabled on is a hybrid worker group hosted in my team's AWS account. Is there a list of IP addresses I need to allowlist on my AWS account's side?

This message originated from Cribl Community Slack.Click here to view the original link.It looks like the database collector is automatically turning MSSQL date and time fields into text versions of full timestamps complete with a hallucinated timezone. E.g. '2025-06-26' --> "2025-06-26T00:00:00.000Z", '13:09:11.0000000' --> "1970-01-01T13:09:11.000Z" Is there a way to stop this behavior at the collector, or do I have to undo the damage in a pipeline?

This message originated from Cribl Community Slack.Click here to view the original link.Hi Folks, I think I am missing a trick here. I am trying to create a Stream API collector to Salesforce Marketing Cloud, and I get the “Error: read ECONNRESET at TLSWrap.onStreamRead” error. I have configured the collector correctly, so I was wondering if there is any way to confirm connectivity from Cribl Cloud to the Salesforce Marketing Cloud URL to confirm that part is working at least? Also, any suggestions I can try? Has anyone successfully managed to create a connector to Salesforce Marketing Cloud?

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, is there anyone having experience to reduce Network device logs(VPN,IPS,FW)? We are currently working on a proposal for log reduction on Cisco ASA devices for our customer. But the customer mind if reduction logs have impact on their SIEM operation. Based on our analysis, we believe that certain logs—such as informational-level messages (e.g., session teardown notifications, routine status updates)—are generally low-value for SIEM correlation and threat detection, and can be safely excluded. So if you have an experience about similar log reduction strategies for Cisco ASA or other network devices, could you share with me?

This message originated from Cribl Community Slack.Click here to view the original link.Hello team! I’d like to understand the difference between sending only the _raw field to Lake, and sending _raw along with some extracted/parsed fields. I assume it will affect the size of the event, but more importantly, how does it affect the performance in Cribl Search? Additionally, are there any recommendations for using JSON/Parquet data format?

This message originated from Cribl Community Slack.Click here to view the original link.Need some clarificaton regarding Splunk DSS and Cribl lake. The doc says: “In Cribl Lake, deleting a Splunk Cloud Self Storage Source means that you will lose all your Splunk data archived here. Also, Splunk Cloud will no longer be able to write to Cribl Lake through this integration. However, this deletion will not affect your data flow and storage within Splunk Cloud.” Does this mean that if I delete a Splunk Cloud Self Storage connection to Cribl Lake that I’ll lose all capability to communicate with Splunk DSS and Cribl lake - including future ones - or just this individual connection?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a way to do a cumulative sum on log events in Search? Or even with metrics? I'm not seeing anything mentioning cumulative in the stats functions in the docs. I would like to graph at what time a service reached 1,000 total requests, or when a service first had 100 unique clients IPs. I currently only have the events with this data, but if I need to convert these to metrics in Stream and send them over to Search as well I can, I'm just not sure Search supports cumulative queries

This message originated from Cribl Community Slack.Click here to view the original link.can search send data to http listeners, or does it have to go through stream?

This message originated from Cribl Community Slack.Click here to view the original link.Should I be able to click on a column in search table to change the sort on rows?

This message originated from Cribl Community Slack.Click here to view the original link.How can I see concurrency metrics? Almost every dashboard panel is getting queued, but I don't see how many searches are actually being run at once so I dont know how much adjustment to usage groups I need to do

This message originated from Cribl Community Slack.Click here to view the original link.Am I allowed to register an On-Prem cribl worker to a cribl.cloud leader? It looks like I do not have access to the auth-token for the default group

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, Does Cribl support OAuth2.0? Can we integrate with BOX with Cribl?

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, I would like to know about "Enforce License Quotas" in Cribl Stream(On-Prem, not Cribl.Cloud). The docs state that there will be no restrictions if the license quota is exceeded for an Enterprise license. Is there a restriction like Splunk where data cannot be imported if the license quota is exceeded a certain number of times within a certain period of time? Of course, we are assuming that it should not be exceeded, but we are concerned about the impact if a spike occurs due to maintenance, etc. and the license is exceeded. > Enforce License Quotas > If your data throughput exceeds your license quota: > • Free and Standard licenses enforce data ingestion quotas through limits on the number of Worker Groups/Fleets and W

This message originated from Cribl Community Slack.Click here to view the original link.If we're implementing Github/Github Ops, should the repo be read-only. If I'm correct, you won't want to modify Cribl through anything but the UI unless it's specific .yaml files on servers right?

This message originated from Cribl Community Slack.Click here to view the original link.Hello all, working on trying to find volume for destination for each fleet, monitoring only allows for the last 1 day. Are there any specific logs that I can collect from the edge to be able to perform a search on the fleet to be able to see volume over a period of time, ideally at least the last 7 days. Thanks in advance.

This message originated from Cribl Community Slack.Click here to view the original link.In stream is there anyway to drop cribl metric events out of a pipeline?

After log configuration on port 1515 for some firewall logs, we observed logs are getting dropped and not all logs are forwarding to splunk.We observed udp drops on RHEL OS level, where we increased the max_mem_buffer size to 256 MB , but still same thing - Please check below output.But still we are getting buffer issue as provided in below output.[root@hostname ~]# cd /etc/sysctl.d/[root@hostname /etc/sysctl.d]# lltotal 4lrwxrwxrwx. 1 root root  14 Sep 12 16:14 99-sysctl.conf -> ../sysctl.conf-rw-r-----. 1 root root 187 Dec 11 16:08 99-udp-tuning.conf[root@hostname /etc/sysctl.d]# cat 99-udp-tuning.confnet.core.rmem_max=268435456net.core.wmem_max=268435456net.core.rmem_default=268435456net.core.wmem_default=268435456net.ipv4.udp_rmem_min=262144net.ipv4.udp_mem=65536 131072 262144[root@hostname /etc/sysctl.d]#[root@hostname /etc/sysctl.d]# netstat -usIcmpMsg:

Hi all i am having issue parsing nested Json the event goes like {  "records": [    {      "time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}{"time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}  ],  "_time": 1766078828.252,  "index": "index",  "sourcetype": "sourcetype",  "source": "source"}so basically, records field have multiple Json event Nested in it  i want to extract to individual events with parent fields like metadata carried to each right now when i use event breaker i am getting no change can someone help me  

Hello everyone! I’m quite new to Cribl, but I’ve spent about 10-20 hours so far reading the documentation. I’d like to send Windows event logs from on-prem servers and workstations to Azure Storage with the sort of parsing/normalisation that you’d have from Azure Monitor Agent (such as the SecurityEvent and WindowsEvent structures). This isn’t directly possible with Azure Monitor Agent and the AgentDirectToStore kind in Data Collection Rules (only Azure VMs are supported). I’m hoping that one of the Cribl products can help me with this. I looked at the Sentinel pack, and it appears to only support forwarding data to Sentinel. Is there an existing solution for mapping/normalisation/transformation (I’m not sure which term(s) are appropriate here: pipelines are so complicated!)? My environment has a lot of events across many log providers, and I’m also not sure what kind of magic that Azure Monitor Agent does to events (ie, is it just changing field names? Does it enrich

Hello.  I am a total newb with API integrations and was hoping for someone to help me set up an integration between Delinea and Cribl.  I again am totally new at this and just dabbled at a couple of Cribl University courses but I need to get on the fast lane.  Is there anyone that has done this already than can walk me through this configuration.  If there is any additional details needed to clarify please let me know. So far in the Delinea platform I have followed their instructions and enabled the Syslog/CEF Logging option.  As for the entries I had to enter into the field I’m not sure if I did this right.On the Cribl side I tried setting up a Syslog Source but not sure what to enter into the field either.Hope someone can assist.Thanks!

i have corelight events which  has id.orig_h ,id.resp_h etc fields , but when i try to rename them using eval src_ip=id.orig_h… it doesnt work , the RENAME fucntion works though, I dont want to use rename because i dont want to lose original fields , i also cant use corelight pack because it is also using rename , how can i rename without losing original field???

Hey folks! I’ve been tinkering away and ended up building a couple of Ansible Collections for Cribl - mostly focused on Stream and Edge. Since everything is generated from the OpenAPI spec, you’ll also find modules for Lake and Search in there. Those aren’t fully battle-tested yet, but they’re along for the ride. The collections include both declarative/idempotent modules and more imperative ones, depending on how hands-on you want to be. They also support both on-prem username/password auth and client-ID/secret for Cribl Cloud. If you want to poke around, try things out, or throw tomatoes at my code, the repo’s here:AlexAsplund/ansible-collections-criblCurious to hear what people think or how you might want to use it next.

how can i setup cribl hec source or the splunkhec destination to drop data older than 24hrs ?

Has anyone been able to Ingest Proofpoint CASB and TAP ATO (Account Takeover) logs into Stream? I do not see a collector available for these. Proofpoint sent me some API specs for their endpoint but I’m stuck.Proofpoint CASB and TAP ATOAPI GuideVersion 4.04(US)December 2023This document describes the API methods provided by the Proofpoint CASB platform for retrieving various data entities. The guide includes details on how to use the Proofpoint CASB APIs to retrieve system events and their corresponding alerts.https://proofpoint.my.salesforce.com/sfc/p/#3000000006Bs/a/Uy000000gPbV/QnJwgeOF_q4XsxQYmHUkAl_HzPSl08BxnGpQsEVVS8o

We are planning to integrate SailPoint log with Cribl and send to Cribl lake. Is there any specific Cribl doc for the same? Or anyone has done this integration in the past?