Skip to main content
Solved

How do I aggregate multiple logs into a single output?

  • March 11, 2025
  • 1 reply
  • 21 views

For example: firewall logs that has the same IPs and ports in Windows of time 10 sec.

Best answer by pie

Start with the Aggregations function to select the desired data, and use the appropriate Aggregate function for your use case:

https://docs.cribl.io/stream/aggregations-function/
Aggregate events in real time

1 reply

  • Participating Frequently
  • Answer
  • March 11, 2025

Start with the Aggregations function to select the desired data, and use the appropriate Aggregate function for your use case:

https://docs.cribl.io/stream/aggregations-function/
Aggregate events in real time