Skip to main content

General

Can't find what you're looking for? Ask it here!

  • 425 Topics
  • 2,586 Replies
425 Topics
V
VenkatNew Participant
asked in General
Query on SIEM parsing

Hi All,We are managing Crowdstrike NGSIEM  in our network and all the data sources are routed to Cribil and from Cribil , we are forwarding the logs to NGSIEM. Data source → Cribil →  NGSIEM I understand , we require parsers in NGSIEM to read the relevent logs received from the  datasources but I wish to know ,is there any parser concept present in cribil to onboard the logs from the different datasources.    

40
V
Louise Tang
Louise TangKnown Participant
asked in General
How do I create a REST API Collector that needs to reference a dynamic bearer token?

This is an example of how we can reference a value provided by Discover Type HTTP Request in the REST API Collector which will correctly save a bearer token value which will expire (default time 5 minutes) using a named Token attribute: token, Authorization header `Bearer $(token)` and Authentication expression `Bearer $(token)` The initial authorization request:curl -X POST 'http://localhost:9000/api/v1/auth/login' -H "Content-Type: application/json" -d '{ "username": "admin", "password": "<password value here>" }' Run a Discover request to generate a bearer token: The above request will return a value something like: {"token":"abcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKEN","forcePasswordChange":false} The Collect layer will use the information pulled during discover to pull the following: The Encode operation is not necessary but provided for illustration purposes.‘ite

241
Louise Tang
A
a.pietersen@eremote.nlParticipating Frequently
asked in General
Cribl Edge (standalone): Windows Metrics - Splunk, do not result in actionable information

I am new with Cribl.Cribl Edge (standalone, installed on Windows 10 laptop for test/evaluation): Windows Metrics do not return actionable information when forwarding to a standalone Splunk Enterprise instance. What am I doing wrong or what I am missing here?Windows Eventlog cribl-source is correctly received in json. But adding the Windows Metrics cribl-source to the same (working) Splunk Destination (default forwarding to port 9997) it shows:All relevant metric_names seems to be received correctly, but no Values to find. Besides, do not understand the metric_type "g". I would expect a value-field in bytesI have tried many things sofar, including Cloud Stream, searching in the docs and and start some basic first lessons on Cribl Universty. Neither an overall and understandable Google search explanation about type g. Stuck now!Does somebody has a clue, suggestion, tip or direction to search in other sources?ThanksAshleyP

84
A
P
Prabhat SharmaNew Participant
asked in General
Best way to send logs from Cribl to OpenObserve

I am trying to send logs from cribl to OpenObserve.OpenObserve accepts data in a JSON array format.e.g.[ { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }, { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }]What is the best way to do this?

51
J
A
Ashley PietersenNew Participant
asked in General
Yesterday started Cribl-Cloud (stream), now my Splunk License is chocking with data from it

Hi Anyone/supportYesterday, started Cribl-Cloud (stream), just for testing, now my Splunk License is chocking with data from it Crible Cloud :-(.Tried to delete all things I could delelte, still chocking my Splunk license. Deactivating my subscriiption says: We're sorry to see you go!We are processing the cancellation of your Cribl.Cloud organization. This process takes up to 30 days and you will get an email 7 days before the cancellation is final. If you didn't mean to cancel or having second thoughts, contact support@cribl.io.How can I interrupt this data-stream. I had to stop my Splunk Enterprise instance for this…Hope someone can help out.Ashley Pietersen

35
A
O
openwebspaceNew Participant
asked in General
Updating a lookup table with a pipeline function

I read that Cribl has the ability to update lookup tables using REST API and with a search string, but I'm looking for a way to do it during the processing stage. Is this possible? I see a Redis function and read something about that. If the values go there, is there a way to automatically lookup the results?

22
O
S
Steve BennettParticipating Frequently
asked in General
Creating New Fields from _raw

I want to create new fields from values in _raw. See below. I want to create a series of folders based off the year, month, date and hour. 2025 (parent folder) - 01(subfolder) - 12(sub under 01) - 23(subfolder under 12)._raw:"2025-01-12 23:59:56","Another Value","Dummy Data","","Something Really Cool"I'm using Regex Extraction and I can see the selection in the preview as Group 1, Group 2, etc.However, I can not convert these into individual fields. Any suggestions?

2011
J
H
HT GoatKnown Participant
asked in General
Secure Communication between CriblCloud Leader node and Hybrid Worker/ Edge nodes !!!

Hi,I would like to secure the communication between the Cribl managed Leader node and the Hybrid Workers and edge nodes currently located on Prem . I understand that the communication between the Leader node and Hybrid Workers / Edge nodes is already encrypted ( port 443 ) . How are those entities being currently authenticated ? I can also see that the recommendation is to implement mutual authentication but not sure about the best way to go about it ?Any advice would be be very much appreciated .Thank You

02
H
S
Sai Lalith kumar T N VNew Participant
asked in General
Is there a way to Get Cribl Cloud leader's Internal/metrics logs to our Splunk

We are having Hybrid Cribl Cloud Setup where leader resides in Cloud. Is there a way to Get Cribl Cloud leader's Internal/metrics logs to our Splunk

51
D
H
HT GoatKnown Participant
asked in General
Can't bootstrap Edge node from Leader

Hi ,I have been trying to add an edge node into my default fleet but being denied because of permission error . I have run the script provided by the leader into an Ubuntu EC2 instance with a userwith privileged access but still failing ( see Screenshot ) . Can anyone assist please ? Thanks in advance

32
H
H
HT GoatKnown Participant
asked in General
Can ' t set up AWS S3 destination in Cribl using Hybrid Workers

Hi ,I ' m looking to add AWS S3 as a destination in Cribl while using a set of Hybrid Workers.I have followed the below instructions but yet failing to successfully test the connection . https://cribl.io/blog/securely-connecting-aws-s3-destination-to-cribl-cloud-and-hybrid-workers/The logs are showing the following errors even though the AWS Roles / Permissions / Policies have been correctly applied . The resources also appear to be sufficient on the Hybrid Workers nodes . This has worked fine with the Cribl Cloud managed workers .Can anyone please advise ?

14
H
H
HT GoatKnown Participant
asked in General
Can 't add Hybrid workers to Cribl Cloud

I 'm trying to add AWS hosted Hybrid workers into our instance of Cribl cloud ( Leader ) .The Workers VMs have been built using the CriblPrivateBuild from Amazon Marketplace .All the firewall policies are in place already . As per the instruction , I invoked the script from the leader and pasted it into our Hybrid Worker nodes but getting the following error ?Can anyone advise please ?Much Appreciated

16
H
H
HT GoatKnown Participant
asked in General
Verify connection to Destination host

Hi,I' m working on a solution that consist of Cribl sending logs to an Onprem syslog server . Is there a way to confirm whether Cribl has established communication with the destination endpoint ( like a ping feature) . The monitoring section in Cribl is showing data is flowing but we can't find anything on the syslog server . Any assistance will be greatly appreciated.

23
J
S
Srinath DayalaKnown Participant
asked in General
Data to TCP JSON source it not captured

I am trying to send data to Cribl stream→ TCP Json source using curl command, and i can see the data is coming to Cribl worker node on the given port ( verified with tcpdump) but the same data is not being captured in the TCP JSON source. Any settings i am missing here?

310
S
H
HT GoatKnown Participant
asked in General
How to Protect Syslog data !!!!

Hi I'm in the process of setting up Cribl to send data from a syslog source ( AWS hosted Cisco FTDs) to Amazon S3 .Although the firewall rules are locked down to source and destination , I'm concerned about transmitting unprotected data over the Internet .Can you please advise on the best way to protect the traffic ?Thanks

410
H
H
Henri BülteNew Participant
asked in General
How does "teleporting" work in Cribl Stream and Edge?

How does the 'teleporting' function work on a technical level? Based on the documentation on ports (https://docs.cribl.io/stream/ports/), it seems no inbound ports need to be opened on worker or edge nodes for the feature to work. The leader node handles teleport functionality via port 4200. When teleporting to a node, does it simply stream the UI data to the leader, essentially mirroring the node's interface rather than establishing a direct session? I couldn’t find detailed documentation on this, and tools like TCP dump/Wireshark or internal logs haven’t provided further insights.Thank you :) https://docs.cribl.io/stream/ports/

153
J
B
BalaNew Participant
asked in General
Different between Azure log analytics workspace and Cribl

What is the difference between cribl and Azure log analytics workspace...What is the benefit when I use instead of Azure LAW

71
R
T
tpevelerParticipating Frequently
asked in General
Cribl is stopped, but pid file exists

HiI have 2 cribl workers (cribl worker 1 and cribl worker 2 )managed by the same manager; cribl worker 1 goes down every now and then and has to be started manually. Status checks return the following: 'Cribl is stopped, but pid file exists'; can any of you please help me troubleshoot or point me in the right direction

84
S
G
Govardhanen GopalParticipating Frequently
asked in General
Using VSCode + nodejs to write/debug your code function

TL;DR Use VSCode to test out javascript "code" function locally before attempting it in Cribl Stream/Edge.I wanted to first give a shout out to @Jon Rust for pointing me in this direction. Paying it forward to other Cribl users who would like to give the code function a shot.I am using the example from the following pagehttps://docs.cribl.io/stream/usecase-code-function/#building-a-new-arrayI had a pipeline with about 40 functions which was used to take a bunch of metrics together and publish it as a multi-metric into splunk. I wrote this with David Maislins help about 3-4 years ago, and it was getting to be a bear to maintain and upate. The code function was the perfect candidate for this. I took 36 functions and consolidated into 1 code function which was much easier to debug. Please note I have NO experience with JS and this is just something I came up over 2 days of grinding.Make sure you have VSCode + nodejs installed in your computer. Further take the full payload of your i

22
G
D
Dhevasenapathy R SNew Participant
asked in General
Using cribl TCP source can we whitelist IP addresses

Hey All,Trying to setup TCP source to onboard our vendor saas logs in to our onprem splunk. With Cribl can we do IP whitelisting for the TCP source and allow only certain IPs instead of opening it up to public. My setup is onprem so want to see if there are possibilities available in the cribl side.

241
T
J
josh.hartNew Participant
asked in General
How can I create a REST Collection with authentication requiring an HMAC signature

I’m attempting to leverage the REST collector to collect logs from Duo. The REST API requires authentication to be in the form of an HMAC-SHA1 signature in hex ASCII format. Instructions can be found here: Duo Admin API | Duo Security.At the very least, I’m curious if this is possible, and if so, how would one go about setting this up? Thanks!

174
T
A
Allyn BaskervilleNew Participant
asked in General
Migrate from Cribl Stream to Worker Node and put Leader in the Cloud

I'm new to Cribl, so at this point we have single-instance Cribl Stream installed on premise. We just got a new SE, and he stated I need to move the Leader Node to the cloud as it's easier for him to troubleshoot. I have a cloud account created.I presume this is the distributed deployment, but the menus described in the documentation don't seem to align with what I see in the UI. https://docs.cribl.io/stream/deploy-distributed/ I'm not confident I have the correct software. Can Stream be converted into a worker node? Do I need the distributed deployment? Can anyone point me to a video that describes the process? I've looked on YouTube, but I've not had any luck.

212
A
J
Jeremiah RossParticipating Frequently
asked in General
Is there a way to move a worker to another group via GUI?

Is there a way to move a worker to another group via GUI? And when not, why not?!

156
S
L
Lukáš MečířNew Participant
asked in General
Cribl software support policy

Hello, I would like to ask about Cribl software support policy. In other words - where I can find info about how long is particular Cribl release supported and about End of support dates? Is it for Cribl available something like this docu for Splunk - https://www.splunk.com/en_us/legal/splunk-software-support-policy.html? Thanks in advance for help. Best regards Lukas Mecir

53
K
R
Rajneesh ShuklaNew Participant
asked in General
Extract Fields from raw

In raw there is a field called origin="123456"I want to extract this from the events how can I do this?

204
R

Badge winners

Show all badges
Terms & ConditionsCookie settings