General

This message originated from Cribl Community Slack.Click here to view the original link.Hello community, is there a Cribl Cloud API endpoint I can hit to add multiple CIDR Ranges to the Workspace --> Access Control List? I have been scanning the API documentation for such an endpoint.

This message originated from Cribl Community Slack.Click here to view the original link.This may be a silly question, but regarding the Azure Event Hub source, let's say I have to restart my Stream workers or otherwise take them down briefly for maintenance. Once they come back up, they'll just resume the data ingestion where they left off, right? Do I need to do anything "special" to make sure it keeps track of where it needs to pick back up reading data?

This message originated from Cribl Community Slack.Click here to view the original link.I know that Cribl added the ability to include Source and Destinations in the Pack. I was looking at using this, and I can see in the routing that there is an option "Send to Worker Group routes". How do I actually access this data in the Worker Group routes?

This message originated from Cribl Community Slack.Click here to view the original link.Quick question.. Whats the simplest way to get the cribl audit logs from the leader node to a destination. The docs say the audit logs are written to the leader node logs dir; but i need to send these to a custom destination

This message originated from Cribl Community Slack.Click here to view the original link.I am using Cribl Cloud and have configured a REST Collector that stores a value named 'latestLoginTime' in state management. Should I be able to access that in a preprocessing pipeline using the following syntax? It doesn't appear to be present. __state.latestLoginTime

This message originated from Cribl Community Slack.Click here to view the original link.For setting up a trust with AWS in cribl cloud stream is there a global eternal id to provide to AWS or is it collector by collector?

This message originated from Cribl Community Slack.Click here to view the original link.Hi Team. I am trying to onboard Fortinet firewall logs in Cribl with UDP port 514. I am not receiving data in Cribl, I have asked the Fortinet team to route to different UDP port such as 1514 or 5514. But the team wants to send the data only in 514 port in UDP. Is it possible to onboard the data from Fortinet with UDP port 514?

This message originated from Cribl Community Slack.Click here to view the original link.Hi, I have an on prem stream single instance and i want to install Cribl edge on several servers to collect and forward logs to this stream instance. In this case what is the right architecture here? Can this Cribl stream single instance act as a leader for the edge nodes? or they require a separate leader ? If i install edge as a single instance on each machine i wish to collect from, does it consume a lot of resources? or should i install a separate leader node and all edge nodes connect to it?

This message originated from Cribl Community Slack.Click here to view the original link.Hi :wave: Apologies if this has been solved, I haven't been able to find anything using Slack's search option. The scenario is that we have a REST endpoint that we need to call to download a report with data, but in order to download the right report we need to first query a slightly different endpoint to get the last report ID. :sigh: Cribl's REST can do OAuth -> API call just fine, but then I need to store the returned value in a global variable so that the second REST call can look it up and use it. Not pretty, it's what we have. So the question is, is there an internal call that can perform an update of a global variable, or a REST/HTTP call that I can set as the destination to do this? The CoPilot AI says I can use /lib/vars/ end

This message originated from Cribl Community Slack.Click here to view the original link.Hi team, I’m configuring a Cribl File Monitor source to ingest multiple files under the same path, but it looks like only the first file in the list is actually being ingested. Has anyone run into this behaviour before? Max Depth is unlimited.Links for this message:Screenshot 2026-03-06 at 12.55.56 PM.png

I need to open a support case

I’m having an issue with the setup of SSO, using Entra.  99% of it is up and working, and users are able to get in. My issue with Organization level permissions. I want the users of a particular group to have Owner permissions, at the Organization level. Per documentation, that would be set in Entra. As best I can tell, I have gone through all of the related documentation and adjusted my settings to match, but I can’t get it to work. When we log in with an SSO account, the users do have Owner rights from the Workspace down (as that is set in the Teams page), but not at the Org level. I’m sure it’s an easy setting that I’m just missing, and I’m hoping someone could point me in the right direction. 

I have some JSON that I've extracted via a parser function, manipulated/renamed some fields, and now I have an element of an array that is null. Can anyone point me in the right direction on how I might clean up the null? For reference, my end destination is a GCP storage bucket, so I'm just writing the data out as a raw JSON string.It seems I can serialize the fields back into _raw (which cleans up the null array element), and then extract again, and then remove _raw, but that feels like it is potentially inefficient, 3 step process. Is there a better way to accomplish this?

This message originated from Cribl Community Slack.Click here to view the original link.Hi All. I am creating a pipeline at worker group level (I have 2 worker nodes in the group) , in which I want to amend worker node name in _raw file. I tried using __cribl_worker field but I am getting value as undefined. Can someone help in getting the worker node name to amend to my _raw field

This message originated from Cribl Community Slack.Click here to view the original link.Hello, I have configured a rest collector to fetch Fastly WAF requests. the collector is working and getting the correct requests. due to limitations in the API I have to fetch 1000 requests and then utilize a suppression in the pipeline to deduplicate the requests that have already been fetched in prior runs. The problem I am running into is that the collector job is running on both workers in my WG. I tried to disable the source on one of the workers manually but the rest sources are not present in the individual worker UI. does anyone have any recommendations for configuring this so that this collection only runs on one worker? do I need to run this in a worker group with only a single worker?

This message originated from Cribl Community Slack.Click here to view the original link.Can we connect cribl Search with Azure cold storage? And be able to pull data if organized in proper monthly datasets?

This message originated from Cribl Community Slack.Click here to view the original link.Hello All. I am deploying Cribl for one of my customer where we need to collect data from a syslog server and I have 2 Cribl worker nodes to collect the data. Customer is having some concerns in getting the load balancer to distribute the traffic to my 2 worker nodes. What are the other options to send the traffic from Syslog server to 2 Cribl worker nodes? Is there any Cribl internal LB or any other recommended options?

This message originated from Cribl Community Slack.Click here to view the original link.Do people typically spin up Leader nodes inside of a DMZ to control Edge clients in there?

This message originated from Cribl Community Slack.Click here to view the original link.Hi! Im about to migrate some data from an old Splunk solution over to a new one. Not all the data. As I have nightmares about multi-line events being messed up using rsync over ssh and oneshot-commands on Splunk I'm thinking about trying to use Cribl to perform this stunt. Has anyone performed this stunt before and can point me in the right direction? Right now im thinking worker and leader cribl on an old search head, splunk ingest into cribl and output to HEC on the new solution. Any help, experience or pointers would be highly appreciated.

This message originated from Cribl Community Slack.Click here to view the original link.Hello. Are there documented DR solutions that don't involve restoring from Git? unfortunately, I can't use our external git with a personal access token from the environment our Cribl stream is in.

This message originated from Cribl Community Slack.Click here to view the original link.Separate question. Is there a way to filter for fields at this level instead of inside a pipeline? Ie. we want to have events from "logGroup" X go to a certain route.Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Hey all - Working on configuring our Zscaler Cloud NSS feeds to send over to our cribl.cloud worker groups. Using the zscaler_nss Source but when i enable TLS - the connection breaks (not understanding why). Just need a sanity check that my configuration is proper. The cert is something we established for this use. Maybe something is off on my zscaler side?

This message originated from Cribl Community Slack.Click here to view the original link.does cribl integrate with parseable? Anyone ever send data to it?

This message originated from Cribl Community Slack.Click here to view the original link.Happy Monday Everyone! Has anyone pulled Jira + Confluence audit logs into Cribl before? We initially tried the admin API while exploring, but we’re really after product-level audit logs. Working through OAuth now with the ex/jira and ex/confluence endpoints. Docs are a bit thin on required scopes + query params. If anyone has a working config or notes, would appreciate it. Thanks!

This message originated from Cribl Community Slack.Click here to view the original link.Is Leader - Worker Node Communication required for doing Pull Sources? ie - If my Leader node goes down for an extended period of time, and I have Workers that all have Splunk Search Sources on a cron job....Is that connection supposed to break?