General

Hello, I haven't logged into my free instance for a while.  But now my commit buttons are greyed out with an error "Commit message must be at least 2 characters long".

hi all,Are the ingress ip’s listed in Cribl Cloud static?  I need to have some firewall changes implemented to allow events in.Original Post was from https://cribl-community.slack.com/archives/C022FME74PM/p1684846243115099

Hi Experts,I'm setting up AWS Cross-Account Data Collection by following the reference links. However, it prompted me with the error of "failed to AssumeRole".I have double-checked the settings as well as the policies needed, but I still have no idea what is the cause of this error. can help to have a look at it and possibly let me know where the part I miss off?Reference links:  https://docs.cribl.io/stream/usecase-aws-x-account/

splunk uf internal logs are picked up by a passthru pipeline in cribl. based on index.startsWith('_') for the route filter. That works fine.the problem, i lose all meta information about the splunk ufs. like version and os. Can this be prevented somehow?I just see all the cribl workers and some machines (HF) that are sending data directly to splunkOriginal post was from https://cribl-community.slack.com/archives/CPYBPK65V/p1693930511929089

I am creating a dashboard for leader insights based on the Cribl leader logs. While cpuPerc make sense to me () i do not understand the memory usage given in the event. It doesn't look like system memory, am I wrong here? https://docs.cribl.io/stream/internal-logs/#leader-node-logs-distributed

I'm trying to send data to Chronicle using a custom log type but it is not working and the error messages are not very helpful.  The logs are JSON events.   I know the connector works because if I change the default log type to "Honeyd" from custom, the events are successfully sent to Chronicle.   Anyone have any success sending custom log types to Chronicle?

If all owner/admin access is lost to a Cribl Cloud org/tenant that is currently setup to use SSO then how does anyone re-gain admin access?

We use Cribl Cloud, but would like to use our own sub-domain as a target so that we can re-route data as well as manage our own TLS certificates.Can I do this with Cribl Cloud?

Afternoon (at least on my side).Need some help on my side. I've got a Splunk HF cluster sending events to my Cribl cluster. The HFs are experiencing this issue every now and then:08-16-2023 09:29:32.056 +0200 WARN  TcpOutputProc [12084 indexerPipe_1] - The TCP output processor has paused the data flow. Forwarding to host_dest=xx.xx.xx.xx inside output group cribl_out_group from host_src=xxxxxx has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.It's not happening too often, so I guess the questions are:Should I be worried?If yes, where do I start looking for what might be causing the issue on the Cribl side?

Hi Experts,i am doing some sizing calculation using  https://criblsizing.info/ what is the per node -2 referring to ?

Hello, I have my Cribl setup in GitOps mode (https://docs.cribl.io/stream/gitops/). I also have it setup to auth against Azure AD (https://docs.cribl.io/stream/usecase-azure-ad/). Further, I have defined several Azure AD groups including one that I have assigned the GitOps role to (https://docs.cribl.io/stream/gitops/#user-role). When I attempt to follow the instructions (https://docs.cribl.io/stream/gitops/) about obtaining a Bearer token and use an account that is only in Azure AD, I always get “Invalid user or password”. However

I’m really having a hard time with the GitOps sync. I’ve repeatedly followed the steps to generate a bearer token and am always getting “Forbidden” when I attempt to make the production leader sync. This has worked in the past.mkdir -p ~/.authcurl http://<Leader-URL-or-IP>:9000/api/v1/auth/login -H 'Content-Type: application/json' -d "{\"username\":\"<username>\",\"password\":\"<password>\"}" 2>/dev/null | jq -r .token > ~/.auth/tokenexport JWT_AUTH_TOKEN=`cat ~/.auth/token`export AUTH_HEAD="Authorization:Bearer `cat ~/.auth/token`"curl -X POST "http://<Leader-URL-or-IP>:9000/api/v1/version/sync" -H "accept: application/json" -H "${AUTH_HEAD}" -d "ref=prod&deploy=true"Any suggestions?

For a JSON log using the default Cribl JSON event breaker, do you know what the name is of the top most object?  For instance, _raw is an object, but what is the name of the object containing _raw?

In the monitoring section, how is Free Memory calculated per worker?

Hello,Currently testing the process of sending logs to the Chronicle destination.How do i retrieve the data from the "_raw" field.I came across a blog post that seemed to be relevant to my use case, where it mentioned using the log text field as "_raw."https://cribl.io/blog/google-chronicle-ingestion/However, despite following the instructions, I have not been successful in getting it to work.Appreciate any help.

Does anyone have a splunk universal forwarder config they typically use for forwarding?Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1690293855973699Original Author: Matt

HiI have DB Input. Adhoc it is working fine, but not scheduled. I can see different in the logs in the fields filtered.But I do not see an filter settings. I do not see any filter in the scheduler.Original Message: https://cribl-community.slack.com/archives/CPYBPK65V/p1688712420207369

Is there any guide available for deploying Cribl standalone on a Azure Kubernetes Service?Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1688623502905129

As a part of a cribl log processing pipeline, I want to add a function to remove any JSON keys that have empty strings or empty objects. I have a serialization function, such as this: - id: serde filter: "true" disabled: null conf: mode: reserialize type: json srcField: text fieldFilterExpr: value !=="" fields: [] remove: - .*but I don't want to reserialize, as it converts a JSON object during my pipeline into a JSON string. Is there another built-in function I can use to achieve this? Example input:{"my-log": {}, "my-other-log": "", "my-third-log": false} Expected output:{"my-third-log": false}

o365 message trace input: changed from basic auth to oauth and the input fails now with this error{ "time": "2023-04-10T23:00:12.531Z", "cid": "w1", "channel": "TaskExecutor", "level": "error", "message": "failed to execute task", "jobId": "1681167600.54.scheduled.CD_o365_msg_traces:MessageTrace", "taskId": "collect.1", "host": "hostname", "reason": { "message": "Non-whitespace before {[.\nLine: 3\nColumn: 1\nChar: 60", "stack": "Error: Non-whitespace before {[.\nLine: 3\nColumn: 1\nChar: 60\n at v (/opt/cribl_w/bin/cribl.js:14:9579357)\n at p._ [as write] (/opt/cribl_w/bin/cribl.js:14:9580223)\n at y.write (/opt/cribl_w/bin/cribl.js:14:17538090)\n at S._transform (/opt/cribl_w/bin/cribl.js:14:17539431)\n at S.Transform._write (node:internal/streams/transform:205:23)\n at writeOrBuffer (node:internal/streams/writable:391:12)\n at _write (node:internal/streams/writable:332:10)\n

does cirbl support MDT cisco yet Yang/netconf collection Original message in Cribl Community Slack Message:https://cribl-community.slack.com/archives/C02A9EQV61J/p1680730994732489

I am running a distributed environment, and when I use the API Reference to query an endpoint it returns Status Code 404. How can I resolve this?

Hello, this is probably simple, but I can’t get it to work. I just want to remove IPV6 encapsulation from the host field of events arriving at Cribl via syslog. So, existing host field is ::ffff:10.1.1.1, I want it to be just 10.1.1.1. For some reason I can’t get this to work, Splunk shows a null value for host when I try to EVAL, MASK, REGEX, etc. Anyone have a way to do this?

I am trying to send the count or average of certain fields instead of the whole events for a specific time period.

I’ve cloned user, and am now trying to add more GET polices. However, looks like ‘GET’ /system/something, ‘POST’ etc can’t be added as NewPolicy - only GroupFull etc available.Can this be done in the UI?or only using POST /system/roles?or do I need to post new Policy , POST /system/policies?