Skip to main content

Edge

Get answers to questions about collecting, processing, and routing data at the edge.

  • 36 Topics
  • 152 Replies
36 Topics
G
Govardhanen GopalParticipating Frequently
asked in Edge
REGEX Expressions in Allow List for File Monitor

In the “File Monitor” Allowlist, can I use REGEX expressions like \d{2} or just ! & *?

03
G
G
Govardhanen GopalParticipating Frequently
asked in Edge
Host field shows up as the ip address of the first interface on the box

The host name was showing up properly in the old version 4.1.0, but now the host shows up as the ip address of the first interface on the box.  This is bare metal

07
P
N
Nick Kwiecien Nick KwiecienKnown Participant
asked in Edge
How do I delete an edge node from the UI?

Greetings, how do I delete an edge node from the UI?

17
J
W
Wesley RaynorNew Participant
asked in Edge
Domain Controller security logs

Hello - I am testing out cribl stream/edge - first time user. Using version 4.1.2.I've deployed a stream server, a single worker and a Edge node leader.I've installed the edge node agents using the "Add/Update Edge Node" automated script. I've done this on 5 servers in my environment to test how this would work. So far, I can see logs coming into Edge/Stream and into my siem with one exception. My domain controller is not capturing/sending any data. I have followed this: https://docs.cribl.io/stream/usecase-edge-stream as my guide for the setup. The other 4 servers are working as expected but the domain controller is not. I dug and found at the end of an article https://docs.cribl.io/edge/sources-windows-event-logs which states to check permissions on a registry key and make sure it has read rights; I checked that and still no data. I have checked the logs found under programdata\cribl\ and nothing jumps out.cribl is now accounting for 40GBs of space on that dc in the span of 3

36
W
C
Christopher OwenEmployee
asked in Edge
How do I change the installation directory of Cribl Edge on Windows?

In some instances, it might be necessary to change the installation directory of your Cribl Edge agent on Windows. The need might arise from using a separate drive letter assigned to a network mount, or using a non-standard directory structure for program installations.

11
M
R
reemsterNew Participant
asked in Edge
Edge System Metrics internal fields removed at Stream source

Hello,I have some trouble sending out system metrics from an Edge node to eventually Splunk. When the data stream is leaving Edge (captured at step 4) it still contains internal fields related to a metric event. When the data is collected in Stream all of those internal fields are missing and I'm ending up with a _raw field. There are no pipelines interfering with the data at all between Edge and Stream. Just a passthrough is set. Am I missing the point here? 🙂Do I have to manually transform the _raw to metric events again from Stream forwards? Is there a way to preserve the internal fields from Edge to Stream? Last resort is to send it out directly to Splunk HEC from Edge node but I want to channel as much through Stream as possible.Any thoughts? Thanks in advance!,Reemster

05
R
S
Shane DanielsEmployee
asked in Edge
Cribl Leader node same for Edge and Stream?

As a Stream user, if I deploy Edge, do I need to have a leader for each of them? Or do they work from the same leader that I use for Stream today?

31
K
E
Erin SweeneyEmployee
asked in Edge
Is there a way for edge to check that a process is running and if not, generate an event?

Is there a way for edge to check that a process is running and if not, generate an event?

01
J
E
Erin SweeneyEmployee
asked in Edge
Does Cribl Edge send any sort of heartbeat?

I want a method to know (within Splunk) that edge is working properly.

12
P
A
Aravind SreekumarNew Participant
asked in Edge
MISP to Cribl via Rest API Collector

Hi Community,Could anyone please help me configure MISP with Cribl via the Rest API collector. The 'x-rapidapi-key' is the MISP api key of the admin user the same api i gave in token attribute section and authentication I'm using username and password of the admin.Thanks in advance,

20
A
R
Richard HarrisNew Participant
asked in Edge
Edge Mapping to select Domain Controllers

What mapping filters are commonly used to map Domain Controllers to an Edge Fleet?

00
R

Badge winners

Show all badges
Terms & ConditionsCookie settings