Edge

Hi I'm looking into Cribl and its features - one thing I haven't been able to find in the documentation is licensing stream vs edge. Is it the same license or are they separate?

Wondering if anyone has experience with using Edge to collect Windows host logs and sending them to IBM QRadar. Would appreciate any lessons learned or LSX XML created to account for the format differences.

Hi Team, quick question. How do the Windows Edge Nodes extract Windows Event logs and forward them to Cribl? Does it spin a powrshell process and send logs up in batches?

Hi there,Question about encryption keys: would it be possible to use the same encryption key in an Edge fleet and in a Stream worker group ?I have a use case where we need to encrypt data at the source (Edge) and send it to a S3 compatible storage. Then I should be able to retrieve data from the S3 bucket using a collector Job that would be ran from a Stream worker group and then use a pipeline for decryption. Does it make sense ?For those of you who are going to tell me to forward data from Edge to Stream and then use Encrypt function before sending to S3 I would answer to them that the Sec team insists to encrypt data the closest to the source

Where abouts on a windows system would Cribl Edge have local application logs stored? trying to troubleshoot

Hello there,I am preparing a POC (on prem) for a customer based on Edge and Stream. I just wanted to know if it is possible to manage an Edge agent from a standalone Stream instance or if is mandatory to deploy a leader node to manage both Stream and Edge instances ?

Does Edge have any local application debug / error logs? Dug through the install directory and nothing seemed to jump out as an obvious log file.

Is there a way we can add our own edge node info? We'd like to add some metadata that we can use for our mappings

Our networking group collects events to their own syslog server and refuse to send the events directly to use from the network devices. We have to use their syslog relay. Wondering, what would be the pros/cons of putting an edge client on their syslog server instead. Could it keep up? The edge client would read from logfiles. Any other considerations?

Trying Cribl edge for the first time to get logs and metrics from our K8 cluster. We followed the documentation deploying edge node on K8 but the edge node is not visible on our leader which is sitting outside the k8 cluster. Any suggestions appreciated

How to take CPU profile for edge node? I don't see an option in UI.

In the “File Monitor” Allowlist, can I use REGEX expressions like \d{2} or just ! & *?

The host name was showing up properly in the old version 4.1.0, but now the host shows up as the ip address of the first interface on the box.  This is bare metal

Greetings, how do I delete an edge node from the UI?

Hello - I am testing out cribl stream/edge - first time user. Using version 4.1.2.I've deployed a stream server, a single worker and a Edge node leader.I've installed the edge node agents using the "Add/Update Edge Node" automated script. I've done this on 5 servers in my environment to test how this would work. So far, I can see logs coming into Edge/Stream and into my siem with one exception. My domain controller is not capturing/sending any data. I have followed this: https://docs.cribl.io/stream/usecase-edge-stream as my guide for the setup. The other 4 servers are working as expected but the domain controller is not. I dug and found at the end of an article https://docs.cribl.io/edge/sources-windows-event-logs which states to check permissions on a registry key and make sure it has read rights; I checked that and still no data. I have checked the logs found under programdata\cribl\ and nothing jumps out.cribl is now accounting for 40GBs of space on that dc in the span of 3

In some instances, it might be necessary to change the installation directory of your Cribl Edge agent on Windows. The need might arise from using a separate drive letter assigned to a network mount, or using a non-standard directory structure for program installations.

Hello,I have some trouble sending out system metrics from an Edge node to eventually Splunk. When the data stream is leaving Edge (captured at step 4) it still contains internal fields related to a metric event. When the data is collected in Stream all of those internal fields are missing and I'm ending up with a _raw field. There are no pipelines interfering with the data at all between Edge and Stream. Just a passthrough is set. Am I missing the point here? 🙂Do I have to manually transform the _raw to metric events again from Stream forwards? Is there a way to preserve the internal fields from Edge to Stream? Last resort is to send it out directly to Splunk HEC from Edge node but I want to channel as much through Stream as possible.Any thoughts? Thanks in advance!,Reemster

As a Stream user, if I deploy Edge, do I need to have a leader for each of them? Or do they work from the same leader that I use for Stream today?

Is there a way for edge to check that a process is running and if not, generate an event?

I would like to have Cribl Edge run on my BSD based servers (TruNAS and pfsense). Is that possible or on the roadmap?

How can I get my edge nodes to send data to Cribl cloud so it can be seen in my end destination?

Hi Community,Could anyone please help me configure MISP with Cribl via the Rest API collector. The 'x-rapidapi-key' is the MISP api key of the admin user the same api i gave in token attribute section and authentication I'm using username and password of the admin.Thanks in advance,

What mapping filters are commonly used to map Domain Controllers to an Edge Fleet?