Skip to main content
Question

Cribl Search Send Command Requires AWS IP Allowlisting For HTTP Source

  • January 5, 2026
  • 12 replies
  • 13 views

This message originated from Cribl Community Slack.
Click here to view the original link.

I am trying to leverage the send command in Cribl Search. I have enabled a Cribl HTTP source in Cribl Stream that listens on port 10200 listening from all addresses. The worker group that this source is enabled on is a hybrid worker group hosted in my team's AWS account. Is there a list of IP addresses I need to allowlist on my AWS account's side?

12 replies

Raanan Dagan
  • Employee
  • January 5, 2026
Have you included the Hybrid Worker Group as part of the send command?
https://<groupName>.<workspaceName>.<organizationId>.cribl.cloud:10200 

I'll give that a shot

Raanan Dagan
  • Employee
  • January 5, 2026
It looks like that by default, the ' default' worker group will receive the data: https://docs.cribl.io/search/send/

Would the workspacename be main by default?

  • New Participant
  • January 5, 2026
main is default - and to send to a group other than default use | send group=groupName

Thanks! I'm using main. running "https://main.-.10200"returns a getAddrInfo ENOTFOUND error

Just reiterating it's a hybrid worker group

  • New Participant
  • January 5, 2026
oh with | send just the worker group's name - not FQDN

  • New Participant
  • January 5, 2026
^ self-correction, you can also pass an FQDN without using the group= attribute per docs. We ended up sending this to a Cribl-managed group as it would have required poking holes in the firewall.

Raanan Dagan
  • Employee
  • January 5, 2026
@user @user I tested the same use case .. seeing the same error I tried both group='my hybrid group' .. as well as URL with the hybrid group included In both cases I see the same error ' getAddrInfo ENOTFOUND '

Raanan Dagan
  • Employee
  • January 5, 2026
And, testing it with Cribl Cloud workers, works as expected

Thank you for testing!