Edge

**Environment:**- Cribl Version: 4.18.1- Leader: AWS eu-west-1, behind internal NLB (port 4200)- Outpost: On-prem Linux server Background: We are deploying Cribl Edge nodes on-prem. The generated bootstrap script points to the Outpost server on port 9000 (default). When we run the script as-is, the `/init/cribl-edge` endpoint returns an HTML page (the Cribl Web UI) instead of a shell script:But when we modified the bootstrap script to use port 4200 instead of 9000, pointing to the same Outpost server. With port 4200, the `/init/cribl-edge` endpoint returns the correct shell script, the Edge node installs successfully, and it connects and reports to the Leader as expected.Question:Is it expected/by design that the Edge bootstrap endpoint `/init/cribl-edge` only works on port 4200 (the distributed communications port) and not port 9000 (the web UI/API port) on an Outpost server?The default generated bootstrap script uses port 9000. Is this a bug in the script generation, a misconfigurati

This message originated from Cribl Community Slack.Click here to view the original link.Can we use either Cribl HTTP or TCP for edge to stream routing? Are there any pros and cons to using one over the other?

This message originated from Cribl Community Slack.Click here to view the original link.I've poked around a bit in the #channel history and didn't find a direct answer to this, so forgive me if I missed it. What is the simplest, most direct way to observe when a node becomes disconnected from the leader, preferably when it has been disconnected for x consecutive minutes? We're ingesting Cribl Stream logs into Splunk. Is this information in those? If not, which server-side logs might contain this information?

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone had their destinations drop off but only for the UI? I had about 8 Cribl TCP destinations drop off the UI but when I open an individual node that is on the current config, I can see all 8 destinations showing as green. Data is still flowing from those nodes too but I can't edit the destinations due to this issue. (empty screenshot is from fleet management, filled one is teleported inside a node in the same fleet, no pending commits)Links for this message:Screenshot 2026-04-28 at 12.05.05 PM.pngimage.png

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone successfully used a lookup file to do Edge node mappings? I might be approaching this the wrong way but trying to move 100+ Edge nodes to a new fleet without having to re-deploy the nodes. Is there a better approach to what I am doing or are the only options: re-dploy edge nodes or use the world's longest mapping filter

 Hi,I would like advise seek advise regarding the CC Admin-Edge Final Review Lab. I have a task that keeps failing to clear.  I'm unsure which step I may have missed out. Please see details and screenshots below Task 11: Add Mask function to obfuscate VISA, Mastercard, and Discover credit cards numbersTask 11 InstructionsMask Function, Masking Rules createdMatch Regex and Replace Expression for Visa, Mastercard and Discover Applied to fields _raw from captured Sample Data Masking rules for VisaMatch Regex and Replace Expression Sample input/output results from captured sample data Masking rules for MastercardMatch Regex and Replace Expression Sample input/output results from captured sample dataMasking rules for DiscoverMatch Regex and Replace Expression Sample input/output results from captured sample data 

I want a method to know (within Splunk) that edge is working properly.

Notes: we use a cribl.cloud leader so all of our edge nodes are managed-edge. We cannot make api requests directly to edge nodes, we have to make api requests of the leader.My org has deployed a decent number of edge nodes, but did not apply tags or a worker group when doing so. My goal is to use a patch request on the /master/workers/{id} endpoint to update the nodes.So far I have created a python script makes a get request on the /master/workers endpoint to get all config data from these nodes and modify the config with the new tag.Has anyone successfully used a patch request to update the endpoints on Cribl?

This message originated from Cribl Community Slack.Click here to view the original link.For System_State data sets - Can we add a polling interval per Collector/Metric? Or do we have to add new Sources and group the Collectors/Metrics by polling interval. Example - I dont need host info every 5 minutes. Listening Ports on the other hand....might be good every 5 minutes.

This message originated from Cribl Community Slack.Click here to view the original link.What's the upper limit you guys would suggest for amount of time to keep disconnected nodes? We have about 150 disconnects from pods rolling a day, is there a lot of stored data per node?

This message originated from Cribl Community Slack.Click here to view the original link.does edge Linux support .xz compressed file collection?

This message originated from Cribl Community Slack.Click here to view the original link.Going through the interface of configuring an Edge node on Windows - there's a toggle for Windows Event Logs to collect in XML or JSON. JSON isn't native, so is there something behind the scenes going on with Edge that allows this? Traditionally with Steam you use the Windows pack to do the conversions

This message originated from Cribl Community Slack.Click here to view the original link.For a File Monitor input: If I have a path say /foo/bar/ And inside of there are 4 sub folders. We'll call it A/ B/ C/ and D/ ; and I want Edge to monitor all CSV files inside /foo/bar/ except for anything in A/ Can I do this in 1 combination of "Search Path" and "Filename allowlist" ? Or do I need to create 3 specific file monitors with their direct paths?

This message originated from Cribl Community Slack.Click here to view the original link.What's the safest way to clone a currently top-level fleet to be a child fleet? On-prem deployment, and the top level fleet will be a freshly created fleet We're reshaping out fleet architecture right now and there is a lot to move I manually moved everything in lower but it was such a pain, I kept missing pieces so I'd like to do it in a more quick and safe way if possible.

Can i install Cribl Edge on my worker nodes without any production impact. `I want to use Cribl  Edge to monitor my Cribl Workers and certain files

Hi,We are currently working on updating our Cribl Edge Agents. While our Linux agents successfully auto-update through the UI, we are encountering issues with our Windows agents. Specifically, the Windows agents display an error during the download process and fail to update.Manual updates are possible by logging into the system and running the update script; however, the UI-based update consistently fails. We have confirmed that port 4200 is open, and there are no indications of blocked or dropped traffic. Additionally, all platform-specific packages, including the corresponding hash files, have been prepared and placed in the appropriate Cribl temporary directory.Given these conditions, what could be causing this issue?

We are running a PowerShell scrip to collect AD Computers using the Get-ADComputer cmdlet and we are receiving this type of response in Cribl which is not what we are expecting to receive:{"time":"2024-09-20T14:40:32.097Z","cid":"w0","channel":"input:test-retrieve_ad_computers","level":"error","message":"error from child process","data":{"0":65,"1":116,"2":32,"3":108,"4":105,"5":110,"6":101,"7":58,"8":49,"9":32,"10":99,"11":104,"12":97,"13":114,"14":58,"15":49,"16":53,"17":54,"18":13,"19":10}}

I'm collecting files written by syslog from Cisco ASA and I'd like to change the source from the filename to a value extracted from _raw. It's not possible right now to send the syslog directly to the edge node.I've tried evaling source to __raw.match(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/) The output on value expression seems right but the source field doesn't change. Is this possible?

Hi,I've configured SNMP source to accept SNMPv3 traps.Traps can not be decrypted and would like get why.I enabled debug mode in Worker Settings for authentication, input snmp, etc.But nothing appear in Logs tab when chosing an All Logs option.

I'm trying to collect the full windows event messages, all the fields plus the full message/rendered message (the view you see in windows) It seems like if use the json method I get that message at least sometimes but then really crucial information like username domain etc are buried in the properties field, and if I use xml then I get all the fields with names etc, but I don't get that rendered message at all.I'm used to working with winlogbeat and nxlog and this is pretty standard to do in those, but is there a way to do this in the edge agent?

How can I get my edge nodes to send data to Cribl cloud so it can be seen in my end destination?

I deployed Cribl on some Windows Servers. They are routing events to an on-premise Cribl Stream instance. Everything was working fine, until collection just stopped. It appears that the Edge agents aren't connecting to "https://cdn.cribl.io/telemetry". These servers are behind a web proxy. The proxy settings are applied properly in Windows.If I pull up a browser on the server, and surf to https://cdn.cribl.io/telemetry, I get the expected output --- “cribl /// living the stream!”I have tried:Manually configuring the proxy settings in Windows itself rather than auto-config.Defining actual environment variables for “HTTP_PROXY” and “HTTPS_PROXY” within Windows Server.Tried flipping the Cribl Edge “default_fleet” toggle for “Proxy” -> “use environment variables” on and off.I have manually restarted the services and the Edge agent itself multiple times. Nothing has worked. What is the proper combination of settings in Windows and Cribl Edge to force the agent to use the proxy to phone h

I am running Edge Nodes on our EC2 instances. When reviewing internal fields from our File Collector sources, I noticed that there is alot of really useful data that our SREs use to investigate which regions & servers are experiencing issues during incidents. These include: - AMI image - Region - Availability Zone - Architecture - Public IP - Private IPI'd like to extract these internal fields as event fields that get sent to our destinations. What is the simplest way to do that?

What is the function of the NSSM.exe process that starts with Cribl Edge?

I am trying to add a new Edge node to my Cribl Cloud instance. I click on the Add/Update Edge Node and get the script. The docker instance installs but when it goes to run the Edge instance, it errors out.Server:Ubuntu 22.04.3 LTS (GNU/Linux 5.2.0 x86_64)Install:docker run -d --privileged -e "CRIBL_DIST_MASTER_URL=tls://{token}@{instance}.cribl.cloud:4200?group=default_fleet" -e "CRIBL_DIST_MODE=managed-edge" -e "CRIBL_EDGE=1" -p 9420:9420 -v "/:/hostfs:ro" --restart unless-stopped --name "cribl-edge" cribl/cribl:latestUnable to find image 'cribl/cribl:latest' locallylatest: Pulling from cribl/cribledaedc954fb5: Pull completef83a34600de3: Pull complete94a7ecdae25d: Pull complete995bcc02c181: Pull completeb0adc0627ec2: Pull completeDigest: sha256:8879de72b7cd95715e938d7828dd6adb0e5869fe893cfe1612cd520e0746bf46Status: Downloaded newer image for cribl/cribl:latestdb13a2d0f898bca6a983e62458d736f573819b825b19fe1f78da1bfb4e107ac8Error Message:docker: Error response from daemon: failed to cre