Edge

The host name was showing up properly in the old version 4.1.0, but now the host shows up as the ip address of the first interface on the box.  This is bare metal

Greetings, how do I delete an edge node from the UI?

Hello - I am testing out cribl stream/edge - first time user. Using version 4.1.2.I've deployed a stream server, a single worker and a Edge node leader.I've installed the edge node agents using the "Add/Update Edge Node" automated script. I've done this on 5 servers in my environment to test how this would work. So far, I can see logs coming into Edge/Stream and into my siem with one exception. My domain controller is not capturing/sending any data. I have followed this: https://docs.cribl.io/stream/usecase-edge-stream as my guide for the setup. The other 4 servers are working as expected but the domain controller is not. I dug and found at the end of an article https://docs.cribl.io/edge/sources-windows-event-logs which states to check permissions on a registry key and make sure it has read rights; I checked that and still no data. I have checked the logs found under programdata\cribl\ and nothing jumps out.cribl is now accounting for 40GBs of space on that dc in the span of 3

In some instances, it might be necessary to change the installation directory of your Cribl Edge agent on Windows. The need might arise from using a separate drive letter assigned to a network mount, or using a non-standard directory structure for program installations.

Hello,I have some trouble sending out system metrics from an Edge node to eventually Splunk. When the data stream is leaving Edge (captured at step 4) it still contains internal fields related to a metric event. When the data is collected in Stream all of those internal fields are missing and I'm ending up with a _raw field. There are no pipelines interfering with the data at all between Edge and Stream. Just a passthrough is set. Am I missing the point here? 🙂Do I have to manually transform the _raw to metric events again from Stream forwards? Is there a way to preserve the internal fields from Edge to Stream? Last resort is to send it out directly to Splunk HEC from Edge node but I want to channel as much through Stream as possible.Any thoughts? Thanks in advance!,Reemster

As a Stream user, if I deploy Edge, do I need to have a leader for each of them? Or do they work from the same leader that I use for Stream today?

Is there a way for edge to check that a process is running and if not, generate an event?

I want a method to know (within Splunk) that edge is working properly.

I would like to have Cribl Edge run on my BSD based servers (TruNAS and pfsense). Is that possible or on the roadmap?

How can I get my edge nodes to send data to Cribl cloud so it can be seen in my end destination?

Hi Community,Could anyone please help me configure MISP with Cribl via the Rest API collector. The 'x-rapidapi-key' is the MISP api key of the admin user the same api i gave in token attribute section and authentication I'm using username and password of the admin.Thanks in advance,

What mapping filters are commonly used to map Domain Controllers to an Edge Fleet?