Skip to main content

General

Can't find what you're looking for? Ask it here!

  • 423 Topics
  • 2,585 Replies
423 Topics
D
Dave GellerNew Participant
asked in General
Are there documented procedures for moving the leader to new hardware?

I just recovered a perfect server for a leader. Are there documented procedures for moving the leader to new hw? I was planning on using a new IP,

07
B
F
Franky LaaritsEmployee
asked in General
Check if a cribl instance is configured as a worker or a leader from the command-line?

hi all,is there a way to tell if a cribl instance is configured as a worker or a leader, from the command-line?

06
B
C
Corey McClureParticipating Frequently
asked in General
When does the license clock start midnight my local timezone or GMT?

When does the license clock start midnight my local timezone or GMT?

01
B
Q
Quinn StevensonKnown Participant
asked in General
What exactly does a Syslog source do when it experiences backpressure?

What exactly does a Syslog source do when it experiences backpressure? Does it close the receiving port?

07
Q
J
Jeremy PrescottEmployee
asked in General
Script source in a distributed environment - Run once to avoid duplicates?

I created a script source in a distributed environment that pulls past x mins of logs from an API. Does it run on multiple worker nodes? If yes, is there a way to make sure it only runs on one node at a time to avoid duplicates?

03
H
N
Nick Kwiecien Nick KwiecienKnown Participant
asked in General
Does anyone else deal with a high rate of job failures for Office365 Message Trace logs?

Does anyone else deal with a high rate of job failures for Office365 Message Trace logs? Do I need to adjust my poll interval? Right now its at 10 minutes

07
J
B
Bradley MurphyNew Participant
asked in General
Monitor and get alerted as soon as there is any issue with Cribl pushing data to AWS?

Hi, we have a requirement to push a copy of all data to AWS for storage which I have just completed and it is working perfectly. I am now looking into how we can effectively monitor and get alerted as soon as there is any issue with Cribl pushing data to AWS and I was wondering if anyone else has done this etc? Do you only use the Notifications in Cribl to alert or is there a way to monitor this with Cribl logs (currently pushed to Splunk) where we can create urgent alerts for someone to investigate. I want to make sure that we get alerted as soon as there are any problems as we cannot afford to loose any data etc.

02
B
L
lstropoleKnown Participant
asked in General
Passing two Collect parameters using the same name in a REST collector using a Get collect method?

Has anyone tried to pass two Collect parameters using the same name in a REST collector using a Get collect method? When I try this, only the 1st parameter is included in the URL passed to the API. The API I'm using only allows you to pass date parameters using one parameter called "f" and only supports "LT" and "GT". In order to limit the API to return results from yesterday, I need the URL to include "f=http://date.gt:2023-01-06&f=date.lt:2023-01-07|date.gt:2023-01-06&f=date.lt:2023-01-07". When I put in both collect parameters, only the 1st "f" parameter is included in the URL. If I try to craft both the LT and GT in one parameter by setting the parameter value to 'http://date.gt:2023-01-06&f=date.lt:2023-01-07|date.gt:2023-01-06&f=date.lt:2023-01-07', the included "f=" is encoded to "f%3D" in the URL and the API does not recognize it as a parameter.

02
L
E
Eric ReuscheKnown Participant
asked in General
How do I prevent the double underscore internal Cribl fields from being inserted into the _raw?

I'm trying to serialize into JSON and just keep the _raw field left over after bringing all the fields together. How do I prevent the double underscore internal Cribl fields from being inserted into the _raw field I'm creating?

07
J
A
Abby StrongKnown Participant
asked in General
Is there any way to force a pipeline to ONLY run on a single worker?

I think I know the answer to this, but I need to ask anyway.I have an aggregation that MUST run over the entire event stream.Is there any way to force a pipeline to ONLY run on a single worker.

015
A
S
Steve LitrasParticipating Frequently
asked in General
For CloudTrail, how would I format a query to look for the follow pattern?

Hello.  I have a basic CloudTrail bucket and would like to have the account number part of the bucket path be able to be specified in a Cribl Search.How would I format a search query that looks for “account” 12345 if the path is as follows. …/AWSLogs/${account}/CloudTrail/…

04
S
S
SonOfBuziInspiring
asked in General
anyway to deal with unix epoch nanoseconds?

anyway to deal with unix epoch nanoseconds like this 1672784149796000000 in event breaker rules?

07
S
M
mferrisKnown Participant
asked in General
Anyone know the proper method to extract something prior to pipelines to use for filtering?

Anyone know the proper method to extract something prior to pipelines to use for filtering?Case: I'm looking to use kubernetes.namespace_name as a field to compare against to send through different routes. It's nested inside _raw and I can't seem to get it to be referenced without doing some nasty .search() or .match() that could match with other data streams coming through that source

010
M
S
Sheldon CarmichaelParticipating Frequently
asked in General
DNS Header Flag fields that are boolean, can I convert this to ECS by just having one object

Teach me, oh Pipeline Wizards....I have DNS Header Flag fields coming in that are boolean, like `aa: false`, `ra: true`, `rd: true`, `tc: false`, etc. I would like to convert this to ECS by just having one object (`dns.header_flags`) with an array of the header flag names show in an array if their above referenced field value is `true`. So the JSON would end up being structured like this.```"dns": { "header_flags": [ "rd","rd" ],```And the false fields would be dropped. I would also like to be able to do this in one function instead of a function with a filter for each potential Header Flag Field.

030
S
T
Taylor MillParticipating Frequently
asked in General
Is there a way to debug a kafka input?

Hello All, Is there a way to debug a kafka input? The workers don't consume any data, but the status is "Green". I know that there are live data in the topic as I can see it when using the `bin/kafka-console-consumer.sh` command with the same settings from a worker.

02
T
N
noura aliNew Participant
asked in General
Getting no results with DB Connect

Hello,GivenSuccessful DB connection config (attached)DB collector config (attached)I get no results when i run the collector (attached)What is wrong or what is missing? Appreciate your support.

03
N
N
noura aliNew Participant
asked in General
Using REST Collector source, is there a way to mark the each event from which URL it was retrieved

hello,Using REST Collector source and putting multiple URLs in the collect URL field, is there a way to mark the each event from which URL it was retrieved

04
J
E
Erin SweeneyEmployee
asked in General
Is it possible to POST to the API to trigger a collector?

Is it possible to use the REST API to run a collector job?

02
A
M
mateo.sosaNew Participant
asked in General
Full Visio Stencil for Cribl

Hi does anybody have a full visio stencil for cribl? I've found a pack on the website but it doesn't contain the cribl single node stencil.Original Author: MateoOriginal message in Cribl Community Slack Message:https://cribl-community.slack.com/archives/C02A9EQV61J/p1687295477338279

03
T
E
Evert GaswayNew Participant
asked in General
Is communication from the Cloud back to the worker also on 4200?

For the on-prem workers in a hybrid deployment, which ports need to be open inbound?  Doc mentions 4200 and 443 outbound to Cribl cloud, but is communication from the Cloud back to the worker also on 4200? Or another port?

05
E
E
Erin SweeneyEmployee
asked in General
My commit buttons are greyed out with an error "Commit message must be at least 2 characters long"

Hello, I haven't logged into my free instance for a while.  But now my commit buttons are greyed out with an error "Commit message must be at least 2 characters long".

03
R
T
Tony REmployee
asked in General
Are the ingress ip’s listed in Cribl Cloud static?

hi all,Are the ingress ip’s listed in Cribl Cloud static?  I need to have some firewall changes implemented to allow events in.Original Post was from https://cribl-community.slack.com/archives/C022FME74PM/p1684846243115099

11
B
W
weiting lauNew Participant
asked in General
AWS Cross-Account Data Collection - "failed to AssumeRole"

Hi Experts,I'm setting up AWS Cross-Account Data Collection by following the reference links. However, it prompted me with the error of "failed to AssumeRole".I have double-checked the settings as well as the policies needed, but I still have no idea what is the cause of this error. can help to have a look at it and possibly let me know where the part I miss off?Reference links:  https://docs.cribl.io/stream/usecase-aws-x-account/

011
W
M
Mike DupuisParticipating Frequently
asked in General
Access Splunk UF meta data

splunk uf internal logs are picked up by a passthru pipeline in cribl. based on index.startsWith('_') for the route filter. That works fine.the problem, i lose all meta information about the splunk ufs. like version and os. Can this be prevented somehow?I just see all the cribl workers and some machines (HF) that are sending data directly to splunkOriginal post was from https://cribl-community.slack.com/archives/CPYBPK65V/p1693930511929089

09
A
A
Anoop RamachandranNew Participant
asked in General
Memory usage with Cribl Leader Logs for cpuPerc

I am creating a dashboard for leader insights based on the Cribl leader logs. While cpuPerc make sense to me () i do not understand the memory usage given in the event. It doesn't look like system memory, am I wrong here? https://docs.cribl.io/stream/internal-logs/#leader-node-logs-distributed

03
O

Badge winners

Show all badges
Terms & ConditionsCookie settings