Skip to main content

Community Discussions

Do you have a question about a Cribl product? look no further

767 Topics
P
Pawel KwiatkowskiInspiring
asked in Stream
Support for SNMPv3

In the https://docs.cribl.io/stream/sources-snmp-traps/ I don't see description regarding to the SNMPv3. So I have question if the Cribl support the SNMPv3 integrations?

03
B
V
VINOTH RAJ T NNew Participant
asked in Stream
Is there an option in Cribl Stream to store the data in local storage?

Hi guys,I am new to Cribl and I was wondering whether there is an option in Cribl to store the data in a local storage.So, if there is a way, a clear step by step procedure with the prerequisites would be really helpful.Also, a little clarity on using the "replay function" along with this local storage would be nice.Thanks in advance.

01
X
N
Neil ParisiParticipating Frequently
asked in General
Is there documentation for implementing local storage archival and replay functions?

Is there any documentation available for implementing local storage archival and replay functions?

26
X
F
Franky LaaritsEmployee
asked in General
how would i configure encryption from a splunk uf to cribl cloud?

how would i configure encryption from a splunk uf to cribl cloud?

04
J
E
Eugene KatzEmployee
asked in General
Is it possible to configure Cribl to sign the commits to Github?

I was asked by the customer if it is possible to configure Cribl to sign the commits to github? They use remote git for backing up the configurations.

01
B
E
Eugene KatzEmployee
asked in General
Recurring UI problem with one worker group. Leader restart helps temporarily.

We are seeing this issue quite often, the leader UI shows the the rotating wheel whenever a particular worker group is selected and it never loads the pipelines or routes. This issue happens only for one worker group and others load fine. A restart of the leader fixes the problem temporarily. I noticed the following error on leader but not clear on what it is indicating. The CPU usage of the leader is below average.

319
E
B
Brett WindomParticipating Frequently
asked in General
For wildcards to reference existing field names in an eval, how do you reference those field names?

quick question (I think) - if you need wildcards to reference existing field names in an eval, how do you reference those field names in your eval? e.g. do an eval operation against fieldA, fieldB, and fieldC using a single operation? could be any fieldX

23
A
R
Ryan HennessyInspiring
asked in General
Troubleshooting file monitor permission issue

Hello,While configuring cribl edge source of type file monitor and setting discovery mode to manual, it keeps on telling me permission denied(attached) and the *.log files are not monitored, although the user running cribl have access to this directory and the underneath *.log files. Attached the configuration of the source.Any idea what could be causing this issue?

211
R
H
hgoolyaKnown Participant
asked in General
Query on simplifying JSON to CSV conversion.

If I am reading the docs correctly, when converting from json to CSV, I have to define all the fields. Since all of the fields are really already known, is there a way to output all the fields first without having to define all of them? We are working on converting some Azure logs, and there are LOTs of properties.field(s). Hoping there is another way without us having to define all of these in the "Fields to serialize" field within the Serialize function.

112
H
A
Ahmed KiraKnown Participant
asked in General
is there a way to remove the metric event but still send it to splunk not as a metric

is there a way to remove the metric event but still send it to splunk not as a metric (if i hover over it says metric event) i was trying to move _value to value and _metric to metric__name

114
A
J
Jon RustEmployee
asked in General
Can I add a field that isn’t added to _raw, like not show up in the JSON that is the event?

Can I add a field that isn't added to _raw, like not show up in the JSON that is the event?

619
J
E
Eugene KatzEmployee
asked in General
Has Cribl considered Panther as a new possible Destination?

Has Cribl considered Panther as a new possible Destination?

011
E
F
Franky LaaritsEmployee
asked in General
Optimize sourcetype assignment in pipeline

We have a source coming in that consists of many different sourcetypes all under the same sourcetype, and we want to assign sourcetypes in a pipeline. E.g. an event starts with `2023-06-15T00:00` it's going to be sourcetype A, another one starts with `INFO 06/15/23` that's sourcetype B and so on. How would I best set up the functions in the pipeline, so that when one of the assignments was made the others aren't tried (for logical and performance reasons - an event can only ever have one sourcetype)? I guess we could make the function final, but then other functions (after the sourcetype has been assigned) aren't applied either, e.g. aggreations on some of these sourcetypes. Should I create two pipelines, one just for assigning the sourcetype with final functions, and then a follow up pipeline for further processing?

45
F
M
Martin PradoEmployee
asked in General
Is there a way to do POST to Cribl api endpoint (`/api/v1/version/sync`) from pipeline/destination?

:question: Is there a way to do POST to Cribl api endpoint (`/api/v1/version/sync`) from pipeline/destination?

16
B
S
Shawn CannonKnown Participant
asked in General
Is there an easy way to view all the HEC tokens in a HEC source?

Is there an easy way to view all the HEC tokens in a HEC source? Sometimes we have someone give us a HEC token that they say they were given and we need to search for it

03
S
F
Franky LaaritsEmployee
asked in General
Best practice when adding event breakers to sources with different teams using the same source?

What's the best practice when adding event breakers to sources with different teams using the same source? E.g. suppose I have a splunk tcp input, and several teams are sending data to it. When I need non-default line breaking, I need to add them to the Event Breakers under Processing Settings. There, I can either add one rule set per team, and each rule set could have any number of rules (e.g. one for this sourcetype, another one for a second sourcetype). I could also add one rule set per sourcetype however. I feel like the Event Breaker rulesets exist to logically group the line breaking rules, e.g. by team - correct?

03
F
R
Robbert HinkInspiring
asked in General
Does Cribl have a checkpoint feature, similar to Splunk's fishbucket feature?

Hi All,Does Cribl have a checkpoint feature, similar to Splunk's fishbucket feature?Eg. Ingesting from a source like kafka(doesn't know what it has sent) via Cribl to Splunk, but Cribl for some reason is down for a period of time, how does Cribl know what it's ingested already and what it hasn't.

27
R
F
Franky LaaritsEmployee
asked in General
is there a function that works with tabular data, like `top` output from linux?

Before I build something, is there a function that works with tabular data, like `top` output from linux? Could not find anything with google, but new to the product so maybe I don't know what to search for yet.

09
F
N
Nick Kwiecien Nick KwiecienKnown Participant
asked in Edge
How do the Windows Edge Nodes extract Windows Event logs and forward them to Cribl?

Hi Team, quick question. How do the Windows Edge Nodes extract Windows Event logs and forward them to Cribl? Does it spin a powrshell process and send logs up in batches?

011
P
J
Jeremy PrescottEmployee
asked in General
Are there default limits for JSON processing and are they tunable?

I have a TCP JSON stream with massively long lines… i suspect Cribl is truncating them. Are there default limits for JSON processing? and are they tunable?

320
B
E
Eugene KatzEmployee
asked in General
Preserving dual values for a field in parser function extract mode.

i am using parser function in extract mode for a key value pair data source. What I noticed is that, some of the events have two values for the same field `rule_uid = "1234556" | rule_uid = "78938794"` . Cribl seem to be keeping the second value for rule_uid field. What is a right way to preseve both the values for a field? I wonder if parser is the right choice for this.

019
E
E
Eric ReuscheKnown Participant
asked in General
Query about global variable behavior with event values

Hi AllRegarding global variables, specifically string/array types, do they need to use/compare against values from an event, or can they maintain a static value from the definition of the global variable itself?Our use case:We have the three Redis hosts in our Sentinel config.We want to implement the Cribl Redis function across multiple sources in the environment, but to manage the host list/credentials in all of those separate Redis functions would be a nightmare.Can we use global variables to store the host list (either multiple string variables or an array that can be accessed based on index value), and then reference it in the Redis function's host fields using something akin to the below?`C.vars.prod_list[0] <-- first host value``C.vars.prod_list[1] <-- second host value``C.vars.prod_list[2] <-- third host value`Example in Redis (doesn't work, even with all the types of access I tried, in this example the array global variable type):

025
E
L
lstropoleKnown Participant
asked in General
i applied a scheduler but it's not working

Hello guys,i applied a scheduler but it's not working:can you please help me to figure out the mistake.

02
P
T
Thomas VogtParticipating Frequently
asked in General
does cribls collector for rest api support jwt?

does cribls collector for rest api support jwt?I need to generate an api key, then use this key for authorization (bearer) and then i can collect data but i've to set some dynamic fields like date in the body to collect the datahttps://platform.secutix.com/backend/dataexport/how_to

18
J
M
Martin PradoEmployee
asked in General
Using variables to select the production or staging redis environment?

:question: - I have two branches. `master` is my production and `staging` is my staging/dev environment. I also have two redis servers for production (`production-redis`) and staging (`non-prod-redis`) Cribl. Now in redis function, how can I use `C.env.CRIBL_GIT_BRANCH` variable to specify either `production-redis` OR `non-prod-redis`?

14
M

Badge winners

Show all badges
Terms & ConditionsCookie settings