Community Discussions

Hi,Excuse me for my "not knowing", maybe a easy answer for all of you.I am in the process of migrating our Heavy Forwaders to Cribl . One off the inputs is for Cisco IOS devices. The props.conf has a Regex in it to change the sourcetype with help of a transforms. The props uses a regex to select the events.Where and how do i put the regex which is used in the props.conf for filtering the events. Do i have to place this regex in the "filter expresion" in the route? Or in a pre-pipeline? And how do i do it?Thanks in advancegreetingsJari

I am trying to forward an exact duplicate of the syslog message. I have the route going thru passthru to not change the data. But I am getting the timestamp and original message host added to the message. Thoughts?Source: Syslog on 514/tcp/udp.Pipeline: passthruSource Data:<164>:Jul 23 12:34:15 CDT: %ASA-auth-4-987654: Group = 1234567890, Username = efghijk, IP = aaa.bbb.ccc.ddd, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:30m:29s, Bytes xmt: 0, Bytes rcv: 0, Reason: Idle TimeoutDestination Data:<164>Jul 23 12:34:15 lll.mmm.nnn.ppp :Jul 23 12:34:15 CDT: %ASA-auth-4-987654: Group = 1234567890, Username = efghijk, IP = aaa.bbb.ccc.ddd, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:30m:29s, Bytes xmt: 0, Bytes rcv: 0, Reason: Idle Timeout

The cribl service should not be run as root, some users have run into file ownership problems if they start the service as root and subsequently chown the cribl home directory as described in the docs. If the files in $CRIBL_HOME are owned by user cribl and the service still won't start, check that the files in /tmp/cribl_stream are also owned by the cribl user.If not, you can use this command to change the owner. You may need to use sudo to do this if your user does not have permission.chown -R cribl /tmp/cribl_stream

I have an application which is running on a Virtual Machine & this app is responsible for generating syslog messages.My goal is to forward these syslog messages to a source configured on Cribl Cloud.I went through the documentation, however I am not able to understand that how can I forward these messages.I know the idea is to send the messages to some IP address and Port, but where do I find this IP and port number?Also, while configuring the source on cribl, what is the purpose of IP and Port there? Do I need to point it to my Virtual Machine?

You know how as you get better at Cribl Pipelines, you refactor as you learn better ways to do stuff? What's the coolest thing you've figured out how to do? Include a screenshot if you can.

Hi, I have an API endpoint which require parameter to use a time string in the format of %Y-%m-%d %H:%M, which e.g. look something like this: https://host/api/v1.0/endpoint?start=2024-06-21 14:00&end=2024-06-21 15:00However when I put this on the URL, it always get converted to a value of 2024-06-21%2014:00 using example above. The API endpoint is unable to accept %20 and always ended up throwing error.Is there a way to avoid space being converted in Discover/Collect URI in REST API collector?

I'm getting 400 responses on a POST Body that I'm trying to pass through the state.latestTime within the POST body. I would like to know what is being posted.I don't seem to be able to get a debug log out of my REST Collector to see what it is POSTing. What it's deriving from state.latestTime.Anyone know where I can find this? The debug logs seem to only show the URL, not the POST Body

I have a REST API Collector which look at retrieving a number of records containing an ID which then need to be fed into a collection task as input for a 2-stage API call.While the Discover task has successfully retrieved the records with the ID, and I can see that in debug log the collection task has pick up the ID and insert correctly into Collect URI using variable, the tasks simply get cancelled afterwards.Does anyone have experience resolving similar issue before or have some idea what this might have gone wrong?

Hi, have anyone successfully deployed Cribl on RHEL based host that comes with SELinux enabled?While I have managed to get Cribl manually run, I've hit into issues when trying to enable Cribl on boot as a service. Looking at the entries from "journal -xe", it's throwing up errors to do with SELinux denying the processs because of cribl.pid file unlinking permission.After running the suggested actions as interim fix for SELinux, systemd were able to launch Cribl process but only to see that it fail right after, with slightly different message about "protocol failure" which doesn't give much of a clue what went wrong.

I'd like to search a CloudTrail S3 bucket. What I want to search is "in all accounts" and only in "US-EAST-2" region for event name:"Assume Role". I'm not sure if I configured the Dataset correctly and/or how to do the search. Regarding the Dataset bucket path. This is the S3 folder layout: AWSLogs/subfolder/<ACCOUNT>/CloudTrail/<REGION>/YYYY/MM/DDIn the Dataset config, i'm not sure what to put in the bucket path. Especially for the <Account> and <Region> parts My guess is something like this AWSLogs/subfolder/${ACCOUNT}/CloudTrail/${REGION}/${_time:%Y}/${_time:%m}/${_time:%d}Regarding search: What I want to search is "in all accounts" and only in "US-EAST-2" region for event name:"Assume Role" When I did: dataset="CloudTrail_DATASET_NAME" | limit 1000 it returns no results. Not sure what I'm missingThanks

Hi, I am currently exploring a way to collect event data and looking to save it into a temporary staging storage (GCS Bucket) before transferring the data downstream for further processing.I am having difficulty to get a working configuration on Stream no matter what I tried. Stream worker is always throwing the following error: "failed to close file" where the detailed message is saying "Invalid argument." without much details except that the file that Stream worker is having issue to close is at this location: /opt/cribl/state/outputs/staging/prefix/Bucket_yyyymmdd_hhmm/yyyy/mm/dd/CriblOut-<random>.0.json.tmpI have checked that the credentials for accessing the bucket is valid and the permissions for the given credentials are alright for upload files into the bucket.Does anyone have any idea how I might be able to get around this problem?Thanks.

Hello,Here I have a small picture of how the environment is structured:Red arrow -> Source Splunk TCP (Cribl Stream) I'm trying to forward the journald data from the Splunk Universal Forwarder to the Cribl Worker (Black to blue box).I have configured the forwarding of the journald data using the instructions from Splunk.(Get data with the Journald input - Splunk Documentation) I can forward the journald data and it also arrives at the cribl worker.Problem: the cribl worker cannot distinguish the individual events from the journald data or does not know when a single event is over and thus combines several individual events into one la

I recently set up our SQS amazon queue in cribl. Events are forwarding to splunk, however when compared to the pre existing aws logs in Splunk from the Heavyforwarder TA, I noticed we are only pulling in events from only one region via cribl oppose to the 20 actually sending events and being received through the Splunk TA. Any advice on how to troubleshoot an solve this issue?

Hi,I have a very basic setup which has: Cribl stream leader node, 2 cribl workers, 1 admin nodesource: syslog tcp port 1514destination:filesystemroute filter:__inputId.startsWith('syslog:')route pipeline: mainroute output: filesystempipeline: main and CriblSyslog routes attachedI have a test machine that has it's rsyslog sending to remote location (a worker node) and also a script that randomly generates syslog data and sends to the same worker node every 1 second.I can see the data come in using tcpdump, I can see the received messages coming into the worker in the Sources → Syslog → Status menu but nothing is being processed. Outside of the status menu, none of the metrics show the incoming messages and no files are being written to the filesystem. I've confirmed the connection between the test host and worker node is open with telnet and netcat.Tried tailing Cribl log files, system log files, anyth

Which Azure Sentinel tables does Cribl Stream natively support? And does it also support sending data to custom tables?

Hi All, Posted this in the Slack channel but no bites.We are trying to filter out data from an WAF log to decrease the log size ingested. I created a parser in the existing WAF pipeline using the “Extract” Operation Mode but I cant seem to get it to function correctly.  I was told by support the "Mask Function" would work best, they said "Within that function you can specify the regex and replace it with "". " Not sure how to go about that route. I'm essentially trying to drop data in the log using the following regex but like i said it doesnt seem to function when I test with sample log. The regex is the following -> nContent-Security-Policy-Report-Only.*?DFCspReportFunction\+blob:.*

A which version of the Cribl support integration with the BigPanda?

Hello, I would like to ask about Cribl software support policy. In other words - where I can find info about how long is particular Cribl release supported and about End of support dates? Is it for Cribl available something like this docu for Splunk - https://www.splunk.com/en_us/legal/splunk-software-support-policy.html? Thanks in advance for help. Best regards Lukas Mecir

Hi community,I'm trying to route log data to a self-hosted minio cluster that uses certificates generated using a custom certificate authority. Other destinations allow me to set the path to my CA - the MinIO destination does not seem to have that option.Is there a way to configure a CA so that this works?I have also already tried to disable the "reject invalid ssl cert" option, but the events are still not routed to the destination. It always gives the error "self-signed certificate in chain".Thanks in advance,Hannes

I'm collecting files written by syslog from Cisco ASA and I'd like to change the source from the filename to a value extracted from _raw. It's not possible right now to send the syslog directly to the edge node.I've tried evaling source to __raw.match(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/) The output on value expression seems right but the source field doesn't change. Is this possible?

Hello,I am re-factoring a lot of our code + workflow and trying to simplify stuff. I ran into this issue and I wanted to check with the community + cribl folks if they could give some guidance.We have a few groups, some groups have an rsyslogd input configured. This is configured as "networkrsyslogd". As you can imagine we have networking gear sending out its events over. I stood up a new "Pre-Processing-Pack" and I tried to use create a route filtering via the cribl internal field __inputId but alas this did not work, I further configured the above input to include a new field inputName="networkingsyslog" and further when I used this as as a filter in routes, things work. That said, other than fields that are emitted by the source, what cribl internal fields can I use for filtering purposes? I thought logically this should have been stamped on the events as soon as it hits stream or edge, but doesn't look like it does.Thank you

i am using Syslog-ng to send logs to Cribl (distributed deployment ).In this setup, A cribl leader and one single worker is configured.in the syslog-ng , i configured it to send to Cribl leader IP using port 5514.but i got an error that syslog connection failed:but when i set the Cribl worker as destination in syslog-ng it works!I asssumed initially that the Cribl leader IP should be set in the destination part in syslog-ng config file but doesnt work that way as i had error (mentioned above).Apparently when we have multiple worker nodes. should we redirect to just one worker?how does this works?

How to search ipv4 range through Cribl search. What would be the syntaxI want to know whether we can search fields from raw logs or only parsed fields can be searched?

Hi,I've configured SNMP source to accept SNMPv3 traps.Traps can not be decrypted and would like get why.I enabled debug mode in Worker Settings for authentication, input snmp, etc.But nothing appear in Logs tab when chosing an All Logs option.

We are trying to build a region based leader worker node configuration and a central leader to manage all those regional leaders .Is this possible ?