Skip to main content
Solved

Cribl Stream: Identifying all Cisco switches sending logs using host

  • Nov 4, 2026 11:56 AM UTC
  • 3 replies
  • 0 views
This message originated from Cribl Community Slack.
Click here to view the original link.

Hi everyone, I have sources sending logs to Cribl, for example, Cisco, and I want to identify all the switches sending logs from Cisco. The switch name or IP is available in the host field, but I’m not able to see all the hosts that are sending logs. I can only see the hosts from the live capture. If anyone has a solution for this, please suggest

Best answer by Jon Rust

Native cribl internal metrics include host as a dimension
View original

3 replies

Jon Rust
Forum|alt.badge.img
  • Jon Rust
  • Employee
  • Answer
  • Nov 4, 2026 11:56 AM UTC
Native cribl internal metrics include host as a dimension
Jon Rust
Forum|alt.badge.img
  • Jon Rust
  • Employee
  • Nov 4, 2026 11:56 AM UTC
You can wire up your preferred LLM agent to the Cribl MCP and ask it to show you traffic by host: > report on the event traffic for each host in my cribl env, worker group XYZ
Jon Rust
Forum|alt.badge.img
  • Jon Rust
  • Employee
  • Nov 4, 2026 11:56 AM UTC
worked like a champ with hermes on openai luna model
Terms & ConditionsAccessibility statement