Skip to main content
Solved

How do I aggregate multiple logs into a single output?

  • Mar 11, 2025 3:24 AM UTC
  • 1 reply
  • 147 views

For example: firewall logs that has the same IPs and ports in Windows of time 10 sec.

Best answer by pie

Start with the Aggregations function to select the desired data, and use the appropriate Aggregate function for your use case:

https://docs.cribl.io/stream/aggregations-function/
Aggregate events in real time

View original

1 reply

  • Participating Frequently
  • Answer
  • Mar 11, 2025 3:41 AM UTC

Start with the Aggregations function to select the desired data, and use the appropriate Aggregate function for your use case:

https://docs.cribl.io/stream/aggregations-function/
Aggregate events in real time