Skip to main content

General

Can't find what you're looking for? Ask it here!

  • 423 Topics
  • 2,585 Replies
423 Topics
T
Terry MulliganNew Participant
asked in General
Trying to send data to Chronicle using a custom log type but it is not working

I'm trying to send data to Chronicle using a custom log type but it is not working and the error messages are not very helpful.  The logs are JSON events.   I know the connector works because if I change the default log type to "Honeyd" from custom, the events are successfully sent to Chronicle.   Anyone have any success sending custom log types to Chronicle?

04
T
B
Brandon McCombsEmployee
asked in General
Lost SSO with Cribl Cloud

If all owner/admin access is lost to a Cribl Cloud org/tenant that is currently setup to use SSO then how does anyone re-gain admin access?

02
B
D
Dean SolomonNew Participant
asked in General
Custom DNS (CNAME) + Certificate for Cribl Cloud

We use Cribl Cloud, but would like to use our own sub-domain as a target so that we can re-route data as well as manage our own TLS certificates.Can I do this with Cribl Cloud?

01
J
T
Thinus SwartNew Participant
asked in General
The TCP output processor has paused the data flow

Afternoon (at least on my side).Need some help on my side. I've got a Splunk HF cluster sending events to my Cribl cluster. The HFs are experiencing this issue every now and then:08-16-2023 09:29:32.056 +0200 WARN  TcpOutputProc [12084 indexerPipe_1] - The TCP output processor has paused the data flow. Forwarding to host_dest=xx.xx.xx.xx inside output group cribl_out_group from host_src=xxxxxx has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.It's not happening too often, so I guess the questions are:Should I be worried?If yes, where do I start looking for what might be causing the issue on the Cribl side?

04
T
L
louNew Participant
asked in General
What is the per node -2 referring to in Cribl Sizing?

Hi Experts,i am doing some sizing calculation using  https://criblsizing.info/ what is the per node -2 referring to ?

03
B
J
Joshua CookParticipating Frequently
asked in General
Cribl setup in GitOps mode with Azure AD Auth

Hello, I have my Cribl setup in GitOps mode (https://docs.cribl.io/stream/gitops/). I also have it setup to auth against Azure AD (https://docs.cribl.io/stream/usecase-azure-ad/). Further, I have defined several Azure AD groups including one that I have assigned the GitOps role to (https://docs.cribl.io/stream/gitops/#user-role). When I attempt to follow the instructions (https://docs.cribl.io/stream/gitops/) about obtaining a Bearer token and use an account that is only in Azure AD, I always get “Invalid user or password”. However, if I use an account that exists internal to Cribl, it will succeed. I want to setup GitHub workflows to automate the sync once I complete a pull request. I realize I could create an internal user in Cribl and assign the GitOps role to it and just use that. But, I think I should be able to do this with an Azure AD user too. Has anyone run into this before and found a resolution? Thanks!

05
J
J
Joshua CookParticipating Frequently
asked in General
Getting "Forbidden" when generating a bearer token for GitOps sync

I’m really having a hard time with the GitOps sync. I’ve repeatedly followed the steps to generate a bearer token and am always getting “Forbidden” when I attempt to make the production leader sync. This has worked in the past.mkdir -p ~/.authcurl http://<Leader-URL-or-IP>:9000/api/v1/auth/login -H 'Content-Type: application/json' -d "{\"username\":\"<username>\",\"password\":\"<password>\"}" 2>/dev/null | jq -r .token > ~/.auth/tokenexport JWT_AUTH_TOKEN=`cat ~/.auth/token`export AUTH_HEAD="Authorization:Bearer `cat ~/.auth/token`"curl -X POST "http://<Leader-URL-or-IP>:9000/api/v1/version/sync" -H "accept: application/json" -H "${AUTH_HEAD}" -d "ref=prod&deploy=true"Any suggestions?

016
N
A
andrewskiNew Participant
asked in General
What is the name of the object containing _raw?

For a JSON log using the default Cribl JSON event breaker, do you know what the name is of the top most object?  For instance, _raw is an object, but what is the name of the object containing _raw?

02
A
T
Tony REmployee
asked in General
How is Free Memory calculated per worker?

In the monitoring section, how is Free Memory calculated per worker?

01
J
L
louNew Participant
asked in General
How do i retrieve the data from the "_raw" field for Chronicle destination

Hello,Currently testing the process of sending logs to the Chronicle destination.How do i retrieve the data from the "_raw" field.I came across a blog post that seemed to be relevant to my use case, where it mentioned using the log text field as "_raw."https://cribl.io/blog/google-chronicle-ingestion/However, despite following the instructions, I have not been successful in getting it to work.Appreciate any help.

06
L
M
Matt FeeleyNew Participant
asked in General
Config for Splunk Universal Forwarder

Does anyone have a splunk universal forwarder config they typically use for forwarding?Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1690293855973699Original Author: Matt

04
P
T
Tony REmployee
asked in General
Cribl TCP > Cribl TCP - Destination side getting a “message:sender state change” with a “stage: STAL

Hi, Using Cribl TCP > Cribl TCP and on the destination side getting a “message:sender state change” with a “stage: STALE”. Also seeing messages of “reason: marked as stale”. What is causing this and is this something to be concerned about ? Found this digging around as on the Cribl TCP destination we are seeing the “Blocked status” on the charts tab showing as 1 however all servers are green under the status. The final destination is also Green and we cannot find any reason why the Blocked status is enabled. Original message in Cribl Community Slack Message: https://cribl-community.slack.com/archives/CPYBPK65V/p1683177474390609

01
A
B
BeniNew Participant
asked in General
For DB Input, Adhoc it is working fine but not scheduled

HiI have DB Input. Adhoc it is working fine, but not scheduled. I can see different in the logs in the fields filtered.But I do not see an filter settings. I do not see any filter in the scheduler.Original Message: https://cribl-community.slack.com/archives/CPYBPK65V/p1688712420207369

00
B
T
Tony REmployee
asked in General
Is there any guide available for deploying Cribl standalone on a Azure Kubernetes Service?

Is there any guide available for deploying Cribl standalone on a Azure Kubernetes Service?Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1688623502905129

01
B
E
Eugene KatzEmployee
asked in General
How do I assign values to a field whose name is dynamic?

I'm trying to assign a value to a field whose name is a value of another field. I expected __e[fieldName] to work, but it doesn't seem to. I get foo2 , but not foo1

00
B
R
Richard DeAvilaNew Participant
asked in General
Cribl function for removing keys based off value

As a part of a cribl log processing pipeline, I want to add a function to remove any JSON keys that have empty strings or empty objects. I have a serialization function, such as this: - id: serde filter: "true" disabled: null conf: mode: reserialize type: json srcField: text fieldFilterExpr: value !=="" fields: [] remove: - .*but I don't want to reserialize, as it converts a JSON object during my pipeline into a JSON string. Is there another built-in function I can use to achieve this? Example input:{"my-log": {}, "my-other-log": "", "my-third-log": false} Expected output:{"my-third-log": false}

02
D
T
Tony REmployee
asked in General
o365 message trace input: changed from basic auth to oauth and the input fails now with this error

o365 message trace input: changed from basic auth to oauth and the input fails now with this error{ "time": "2023-04-10T23:00:12.531Z", "cid": "w1", "channel": "TaskExecutor", "level": "error", "message": "failed to execute task", "jobId": "1681167600.54.scheduled.CD_o365_msg_traces:MessageTrace", "taskId": "collect.1", "host": "hostname", "reason": { "message": "Non-whitespace before {[.\nLine: 3\nColumn: 1\nChar: 60", "stack": "Error: Non-whitespace before {[.\nLine: 3\nColumn: 1\nChar: 60\n at v (/opt/cribl_w/bin/cribl.js:14:9579357)\n at p._ [as write] (/opt/cribl_w/bin/cribl.js:14:9580223)\n at y.write (/opt/cribl_w/bin/cribl.js:14:17538090)\n at S._transform (/opt/cribl_w/bin/cribl.js:14:17539431)\n at S.Transform._write (node:internal/streams/transform:205:23)\n at writeOrBuffer (node:internal/streams/writable:391:12)\n at _write (node:internal/streams/writable:332:10)\n at S.Writable.write (node:internal/streams/writable:336:10)\n at IncomingMessage.ondata (

12
S
T
Tony REmployee
asked in General
Does cirbl support MDT cisco yet Yang/netconf collection

does cirbl support MDT cisco yet Yang/netconf collection Original message in Cribl Community Slack Message:https://cribl-community.slack.com/archives/C02A9EQV61J/p1680730994732489

00
C
F
Franky LaaritsEmployee
asked in General
404 Error when querying the API

I am running a distributed environment, and when I use the API Reference to query an endpoint it returns Status Code 404. How can I resolve this?

01
J
S
Steve BridgeKnown Participant
asked in General
Re-write host field for Splunk

Hello, this is probably simple, but I can’t get it to work. I just want to remove IPV6 encapsulation from the host field of events arriving at Cribl via syslog. So, existing host field is ::ffff:10.1.1.1, I want it to be just 10.1.1.1. For some reason I can’t get this to work, Splunk shows a null value for host when I try to EVAL, MASK, REGEX, etc. Anyone have a way to do this?

01
C
K
Kyle McCririeEmployee
asked in General
How do I aggregate multiple logs into metrics?

I am trying to send the count or average of certain fields instead of the whole events for a specific time period.

01
C
E
Erin SweeneyEmployee
asked in General
How can I set policies for an API role?

I’ve cloned user, and am now trying to add more GET polices. However, looks like ‘GET’ /system/something, ‘POST’ etc can’t be added as NewPolicy - only GroupFull etc available.Can this be done in the UI?or only using POST /system/roles?or do I need to post new Policy , POST /system/policies?

00
C
B
BargiBargiNew Participant
asked in General
Unable to create a new account

FYI, I was unable to sign up to the site via the normal account sign up.Never got any confirmation emails, tried multiple email accounts (they are were all hosted with google if that has a bearing on anything)Had to use “OpenID Connect” and sign up with Google

03
B
A
AustinrNew Participant
asked in General
AWS OpenSearch Service and Cribl

Has anyone connected up an AWS Opensearch Service instance to Cribl? I created a local backend user in my domain and gave it what I thought were good permissions but I still get a 401 error when I test the connection. Can anyone share what they did to get this to work?

03
B
D
dmtrsNew Participant
asked in General
Using HMSET to update Redis

Are the available Redis commands in the dropdown list or should I go by the complete list at the URL provided when I hover over the ‘?’?I’m trying to set multiple values for a hash and I’m having trouble grabbing the key-value pairs from my event to send. I’m not sure if it’s a limitation or I’m doing something incorrectly. I’m using ‘__e’ to grab the entire event (Args section) and specifying a key. The Command section allows me to put in hmset.

01
B

Badge winners

Show all badges
Terms & ConditionsCookie settings