General

Our current license is at 5 TB quota, and we ingest only 337 GBs/day. In the learning material of Cribl University, I saw a reference to a free license of up to 1 TB without distributed administration to the workers, is it possible for us to move from our current 5 TBs license to a free one?

This message originated from Cribl Community Slack.Click here to view the original link.Hi guys, I have workers running on-premises and data is being sent successfully from the source to the destination. I also have some workers running in AWS. These workers are able to receive data, but for some reason the Dynatrace destination keeps returning 401 Unauthorized, so the data is not being delivered to Dynatrace. I confirmed the following: If I SSH to any AWS worker, I can successfully send data to Dynatrace using curl with the same endpoint and auth token. Firewall connectivity is open. outputs.yml is synced correctly from the Leader to the AWS workers. The AWS workers are using a specific RHEL 8 image. I tried the suggested checks related to fapolicyd and SELinux, and I also tested with SELinux disabled, but the issu

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone set up HAProxy or some sort of load balancer up for their on prem stream worker nodes? Would appreciate any tips or lessons learned people may have.

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, I'm looking to add multiple teams to the cribl console that I manage. I won't be needing multiple workspace, so I consider using Projects in Stream . The setup is pretty simple, every team can read every projets but editor only of their own. My question is, is there any recommendations or tips to switch from using routes to subscriptions? Should I put all my routes to one sub, then let the teams filter with pipelines? Or make 1 sub per route already there? The goal is to make them autonomous without admin access

This message originated from Cribl Community Slack.Click here to view the original link.Hi all we are having this issue on the monitoring sectionLinks for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, is this billing endpoint no longer supported? I'm getting a 404 response: https://github.com/criblio/collector-templates/tree/main/collectors/rest/cribl_billing_credits Also, was the default rule set CriblAPI removed at some point? I'm trying to ingest system/metrics but the default Cribl ruleset is not helping. I've built a custom ruleset with JSON Array and array field pointing to 'results.metrics' which then parses the event correctly, but I'd like to know if there is a better way. Thanks!

This message originated from Cribl Community Slack.Click here to view the original link.Is they any way to capture a full Splunk HEC payload coming into the Splunk HEC source before it breaks out the event into _raw? I have a source sending into /services/collector/event so I know event in the JSON is what gets stored as _raw. I would like to see the rest of the JSON outside of the event field when the data is sent. It is a cloud based source so I cannot check on that end. Is this possible?

This message originated from Cribl Community Slack.Click here to view the original link.Any general recommendations on using C.Lookup in an EVAL, versus using the Lookup function? I've always just used the C.Lookup in the eval, but I'm curious if / what are the benefits of using one over the other

This message originated from Cribl Community Slack.Click here to view the original link.Is there a restriction on what ports I can use for incoming syslog traffic in Stream? I created a new one today on port 9516 and it will not come up. I deleted it, cloned a working config changing just the port to 9516, and again it did not work. I thought perhaps there was a restriction to stop me from using it, but the UI doesn't indicate any problem.

This message originated from Cribl Community Slack.Click here to view the original link.Hello all, I'm trying to configure File monitor on a fleet of Ubuntu host. The error I'm getting s EACCES: permission denied, watch '/var/log/whatever.log' Would the fix just be granting the Cribl user permissions over that folder? Since I don't have access to those folders, I want to see if someone has a known solution to this, can't test it out since I don't have access to the host and want to minimize effort for the team managing those host.

This message originated from Cribl Community Slack.Click here to view the original link.I am considering how to tune noise out of a stream of data in a route. I started with: source == 'pan' && _raw.includes('THREAT,vulnerability') && !(_raw.includes('SMB: User Password Brute Force Attempt(40004)') && raw.includes('adm<user>')) However, I can forsee this getting to be pretty long and granular. There must be a better way to architect this. Any suggestions?

This message originated from Cribl Community Slack.Click here to view the original link.Hi! Do you know if there is any type of performance advantage on using quickconnect instead of routes besides the fact of avoiding filter testing for each route? In my mental model, a quickconnect entry is a route that takes the input id as filter, but i wonder if there is a non-negligible difference in terms of performance.

This message originated from Cribl Community Slack.Click here to view the original link.I'm starting to toy and mess around with Cribl Edge as a possible replacement for our Splunk UFs. I know it natively has the Windows Event Log collection. Is there a way to filter down specific EventCodes or even specific occurrences of EventCodes right within the Edge endpoint? Reading through this I'm not seeing it super clear as to how to do that: https://docs.cribl.io/edge/sources-windows-event-logs/. The other thing I'm exploring is if anyone has gone down the path of monitoring Windows Registry changes using Cribl Edge? I'm assuming we can do this utilizing the Exec source in some way, but didn't

This message originated from Cribl Community Slack.Click here to view the original link.Does anyone know if Cribl Edge can handle xpath filtering on the windows log ingestion side? IE I can feed it the xpath that I want for logs and it honors that

This message originated from Cribl Community Slack.Click here to view the original link.If I apply a TLS cert to our workers' distributed TLS settings through the UI (or via console, in instance.yml), one by one, and then apply the cert to the leader, control plane communication will be down for each worker until I finish with the leader. Will other communication (data plane, in particular) be broken during that time, as well? I'd like to know if I should plan for data loss during that period.

This message originated from Cribl Community Slack.Click here to view the original link.Hi, I am using Google pub/sub source in Cribl stream with Manual Authentication(with Service account creds in Json format) I am getting Permission denied error but the same creds are working when tested with python code from my local. Below is the sample screenshot what values(not the actual values though) I have provided for my source I have tried couple of other ways to troubleshoot but getting same error. Verified that the Service account and subscription are from same project and have the required access Below are the errors that I am seeing message: Error listing subscription permissions err: message: 7 PERMISSION_DENIED: User not authorized to perform this action. I do have a question that Is there a requirement on GC

This message originated from Cribl Community Slack.Click here to view the original link.Hi all - I have a QQ on Azure Blob Collectors. We have databricks pushing logs into a databricks development container and files for \audit, and \query. Ive tried adhoc pull but with no success. This is set up exactly like our prod Stream -> container. Im getting the "This request is not authorized to perform this operation using this permission. Are the permissions different for when we need to pull logs in from that container rather than push into it?

This message originated from Cribl Community Slack.Click here to view the original link.Anyone with experience polling Tenable.SC and Nessus Manager for Asset inventory, vulnerabilities, plugins, and agent status? We used to poll this via Splunk apps / custom Python but I've been tasked with leveraging Cribl API methods to ingest into our new SIEM. I've been looking at this article in the meantime: https://www.aplura.com/news/cribl/tenable/2025/08/06/tenable_sc_logs_with_cribl.html Sorry in advance: I'm a Unix beard but very new to Cribl.

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to send a datagen of syslog data to a syslog destination. The format of the beginning of the _raw message being sent in the datagen is <187>1 2026-04-17T14:13:25-0400 hostname The destination syslog (I ran TCPDUMP to see it) is receiving it like this <187>Apr 17 14:13:25 hostname the 1 is gone after the <> and the date format is completely different. As the receiving syslog is getting the changed message, is Cribl changing something in the _raw data before it sends out over the wire to the syslog destination?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a way to create knowledge (lookup) for all workergroups at once?

This message originated from Cribl Community Slack.Click here to view the original link.Quick question about the Cribl Terraform provider. Wen you push changes via Terraform, do you still need to commit and deploy them in the UI?

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone successfully configured an Akeyless audit logs TCP listener with TLS? Ours works without TLS, but when we try to enable regular TLS or mTLS, we stop receiving events. We have other log sources successfully using TLS in the same worker group from the same network

This message originated from Cribl Community Slack.Click here to view the original link.is netflow (https://docs.cribl.io/stream/sources-netflow/) default udp or tcp?

This message originated from Cribl Community Slack.Click here to view the original link.Hi community, does Stream support file encryption in the S3 staging location?

This message originated from Cribl Community Slack.Click here to view the original link.Hey, can anyone give me a pointer on what I may be missing in my S3 path. I have an s3 destination and am setting up a s3 source to "rehydrate" logs. I used the destination to populate the source as recommended and copied over the same partition expression I have in the destination but am not getting any results back. It is consistently being written to. Destination configurations - Bucket Name: archive path: palo_alto/${C.Time.strftime(Date.now()/1000, '%Y-%m-%d-%H:%M')} File name prefix expression: CriblOut File name suffix expression: .${__format}${__compression === "gzip" ? ".gz" : ""} Example from on premise s3 storage: /palo_alto/2026-04-07-00:01/CriblOut-zsf3kU.json.gz Source