General

This message originated from Cribl Community Slack.Click here to view the original link.Is there a trick to understanding how to read the 'Status' tab of a 'Destination'? It's frustrating that the UI frequently gives very mixed signals. The below image shows a Host that is 'healthy' with 12 errors indicating it 'failed to push to persistent queue'. How is that 'healthy'?Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Hi, has anyone sent otel metrics from Cribl to Splunk? I'm currently sending the metrics into a metric index successfully. But the histogram _buckets, _sum and _count are somehow not in the metrics in the index? Is the some sort of data engineering that needs to be done for Splunk to identify those bucket fields? Data flow -> source otel(extract metrics) -> capture metrics in route -> apply pipeline to assign index based on conditions -> send to Splunk via HEC As the data leaves Cribl the buckets, sum and count are present.

This message originated from Cribl Community Slack.Click here to view the original link.Just to clarify, if we have on-prem Cribl Edge nodes sending 100% of their data to on-prem Cribl Stream workers connected to the same leader, which ingestion price do we pay? Cribl Edge is listed at $0.21 / GB and Cribl Stream is listed at $0.26 / GB. We have consumption from both Edge and Stream in the FinOps center so I'm assuming we pay just the Cribl Edge rate sending it from Edge to Stream?

This message originated from Cribl Community Slack.Click here to view the original link.Does teleport usage emit events to the leader? If so, what channel and at what level? We want to know when Edge Reader users are using it and how.

Hi Team,I'm currently facing issues accessing this lab environment for my lab work in order to become a cribl certified user. Been loading for hours ​​ 

This message originated from Cribl Community Slack.Click here to view the original link.What's the safest way to migrate a leader's configuration to a new host? Would there be many issues with moving the entire /opt/cribl directory over? Maybe just do /groups/?

This message originated from Cribl Community Slack.Click here to view the original link.Separate question about Cribl Lake destinations in Cribl Stream - what is the path for the "staging directory" for this destination?

This message originated from Cribl Community Slack.Click here to view the original link.Can I use a value calculated/extracted in a pre-processor pipeline to manage a collector's state?

This message originated from Cribl Community Slack.Click here to view the original link.Hi Team, Do we know if Adobe supports Cribl's RAW HTTP Source for webhook URL? Currently, Adobe's verification of the webhook URL is failing - we're seeing a 604 from Adobe's side although the uri path at the Cribl source is reachable & listening.

This message originated from Cribl Community Slack.Click here to view the original link.Trying to setup a brand new Windows 11 Splunk UF and point it at Cribl.Cloud Splunk TCP /w TLS, no client auth. Using the default cribl provided TLS certificates on the endpoint, following the directions at https://docs.cribl.io/stream/sources-splunk/#config-splunk-fwd but the UF won't connect, it repeats the following continously: 06-02-2026 16:00:49.883 -0500 ERROR TcpOutputFd [4296 TcpOutEloop] - Invalid payload_size=352518912 received while in parseState=1 06-02-2026 16:00:49.883 -0500 WARN AutoLoadBalancedConnectionStrategy [4296 TcpOutEloop] - Applying quarantine to ip=100.20.132.14 port=9997 connid=2 _numberOfFailures=2

This message originated from Cribl Community Slack.Click here to view the original link.Hi Team , from the Cribl side , which log gives us visibility into what is happening during PQ flushing

This message originated from Cribl Community Slack.Click here to view the original link.Hi Goaties, we are looking to activate IPv6 for certain sources. The source needs to receive via IPv4 alongside with IPv6. Can anybody assist please? I didnt find any info in regards to this topic in the docs.

This message originated from Cribl Community Slack.Click here to view the original link.Hello! Is there a method to have a destination that uses an event field to update the endpoint url? Event {"table_id": "40004930"} Destination https://erehwon:8080/api/v1/table/${table_id}

This message originated from Cribl Community Slack.Click here to view the original link.If the index of a Syslog source isn't specified in the Fields panel, which index would it go to in Splunk?

Every time we update openshift in azure, my cribl config is lost. since we have the free version, we cannot use git repository. would using persistent storage helps keep the config because the update process drains the node from the cluster and restart them on another node. I suspect this is why the config is not kept.

Does Cribl have any documentation for pulling Workday report logs?

This message originated from Cribl Community Slack.Click here to view the original link.hello im having issues with JSON Unroll and I'm not sure why it's not working. I've tried everything imaginable path with quotes, without quotes, etc. but it still does not work. total.in_bytes is the name of the array every element of which should be extracted to a field test as a new event. But it is not workingLinks for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.We have 10 workers, do we normally put a load balancer in front of the workers, or the data is being routed straight to the workers?

This message originated from Cribl Community Slack.Click here to view the original link.We set up Cribl TCP destination to send logs to a Cribl TCP source in another Worker Group. We are sending a high-volume source (~1TB/day) and using Always On source persistent queuing. The Cribl TCP destination does not have persistent queuing enabled and is set to drop events when backpressure signals are received from the destination (the Cribl TCP source) as we felt that using PQ on both sides would be redundant and we don't want to place any additional load on the sending Worker Group. However, we are seeing events being dropped at the destination with this configuration, and it looks like the Cribl TCP source is constantly exerting backpressure, even in Always On mode with plenty of disk available to queue logs. Any ideas why this would happen? I would expect the queue disk to fill up for a Worker Process before the source would excerpt backpressure. I read this (https://docs.cribl.io/stream/p

This message originated from Cribl Community Slack.Click here to view the original link.We have a Cribl environment with one leader and ten workers which was designed to ingest 5 TBs of data, but unfortunately, our system is being sunsetted, and at the moment, we are ingesting 340 GBs a day. Management is pushing me to remove Cribl altogether, but I'm thinking that the best way would be to move to the free license of 1 TB with no time constraint. Is there a way to keep the architecture as is, with these 11 VMs, while switching the workers one by one, to the free license. If I manage to move one worker, the pressure will be off my back :sweat_smile:.

This message originated from Cribl Community Slack.Click here to view the original link.What is the best way to determine if a slow pipeline is causing backpressure that is impacting sources? I am most interested in S3/SQS sources like CrowdStrike FDR that appear to stop downloading new messages https://docs.cribl.io/stream/backpressure-impacts-sources/#pull-sources. I checked the Cribl Internal Metrics source but only see destination backpressure metrics https://docs.cribl.io/stream/internal-metrics/.

This message originated from Cribl Community Slack.Click here to view the original link.Good morning everyone, I have maybe a crazy question. Is it possible somehow to delete data in an S3 bucket within Cribl? Like some REST POST on the S3 delete endpoint that runs everyday on the workers and deletes data in the bucket older than 30 days? For some reason, S3 lifecycles are not possible in this situation (don't ask me why..) and it seems the only option is to phase out the data over the API somehow. Thanks for any insight

This message originated from Cribl Community Slack.Click here to view the original link.Running our setup in Cribl.cloud we have a number of sources with IP restrictions setup and they all seemed to break recently cause the cloud egress IP addresses had changed. Is there a notification of these addresses changing expected to be sent out?

This message originated from Cribl Community Slack.Click here to view the original link.I am shipping log data to an OTEL destination and I keep getting a RESOURCE_EXHAUSTED: gprc: received message after decompression larger than max 4194304 I am not really sure what I need to be tuning for this, in my pipeline I have my function set to batch in size of 4096 (see screenshot) and my destination is configured to have a body limit size of 4096 KB (see screenshot) - which should place me under that threshold per batch Has anyone encountered this or like error with an OTEL destination? any tips on what I can check out?Links for this message:image.pngimage.png

This message originated from Cribl Community Slack.Click here to view the original link.Hey all. I'm relatively new to Stream so I might be missing some fundamental knowledge here, but I'm working through some data input consistency... can someone explain why I'm seeing drops in the Stream Home charts, but not when looking at cribl_metrics and total.in_bytes? What drives the Stream Home charts? I had a similar issue where my workers showed 0 free memory and CPU load average for a 90min window (and my route sparklines were flat), yet I have logs for that time period... I need to be sure that I haven't lost data and produce an accurate picture of what happened and why it looked like stuff went offline, or significantly dipped.Links for this message:Screenshot 2026-05-05 at 10.30.47 AM.pngScreenshot 2026-05-05 at 10.30.59 AM.png