General

We had an outage over the January 21st weekend. Please let Tony Reinke (Slack - Tony Reinke (Cribl) or Email - treinke@cribl.io) know if you are still running in to any issues. Thanks.

Is there a way to measure the size of a field and then only keep XX bytes of it? I have some huge events coming in from Corelight and it’s all from one field within the event.

When trying to attach ./scope to PID in Docker, I receive the error, you must have ptrace capabilities to attach to a process .

If Splunk Universal Forwarders are configured with compressed = true in the outputs.conf, can the Cribl Stream SplunkTCP source receive from them properly?

I am new to the distributed world, so please bear with me. I have a distributed setup with 2 worker groups(default & 2ndgroup). I have assigned nodes to each of the above 2 groups. In the leader ui when I navigate into the "2ndgroup" and make changes to my pipelines and commit and distribute the changes, it gets pushed to my git repo(remote) & the worker nodes.When I further navigate into the worker nodes and do a live capture of events and make changes to the pipelines, how do I push these changes to the git remote and further when I view it in the leader node under group view reflect the changes that were done at the node level? May be I am missing something obvious, can somebody shed some light on what I am not getting right in this flow?

Is there a way to set up a Destination as a POST request (w/authentication)? I tried using Code and modifying the code for DNS lookup on this page (https://cribl.io/blog/extending-cribl-building-custom-functions/). I got errors about using Promise.

This discussion has been moved.

I'm here to give you the 411 on new features of v.4.1.1 with updates to Stream, Edge, Search, and AppScope. Remember, this is just the new feature list, so, it is kind of a big deal. Stream (release notes):This release provides the following improvements: Introducing Stream Projects (Beta). This feature enables Cribl admins to create isolated spaces for teams and users to share and manage their data.New native MSK (Amazon Managed Streaming for Kafka) Source and Destination support accessing Kafka topics via IAM roles.The Mask Function now supports toggling individual Masking Rules on and off, to enable iterative development and debugging. It also now supports the SHA512 hash algorithm.The Redis Fu

A week from today!  Sunil Kimar Gudivada will work through REST API integration for ServiceNow and Smartsheet.You know you don't want to miss that!

I’m using a code function in my pipeline for some extra custom logic, but exporting that as yml config is kinda ugly. Is there any chance I can load a .js file up and just tell the code function to run the js file? This would make local testing of my custom js a much nicer experience. I am doing this with samples for my test cases where I have the sample file locally and I load it up to the cribl server, and reference the file in my samples.yml. I’d love to do basically the same thing with a code function. Original message in Cribl Community Slack Message:https://cribl-community.slack.com/archives/C02A9EQV61J/p1683553724131069

It’s May, hi, 4.1.2 fixes the problem, it’s May (to the tune of TSwift’s Anti-hero ) Sorry everyone @here, we had to. It just fit so well. Even with  Cribl v.4.1.2 being a “maintenance release”, the team managed to squeeze in a few new features as well as a ton of fixes. AppScope 1.3.3 removes our support for two Go versions that the Go project no longer supports: 1.9 and 1.10. This makes the AppScope code less complicated and more robust. Related issue: #1452.AppScope 1.3.3 was also able to solve the following:1461 - In libc musl environments, attaching to an already-running but idle process now works normally1412 - Node.js apps compiled as Position Independent Executables (PIE) no longer seg fault when scoped.Edge now contains the Prometheus Edge Scraper source. Edge is edgier than ever before thanks to the new 

Cribl is representing 413. Shout out to Springfield, MA! While we do love Massachusetts, today we are talking about the new release of Cribl v4.1.3.Downloads are now available at: https://cribl.io/download/ AppScopeRelease Notes: https://github.com/criblio/appscope/releases/tag/v1.3.4Fixes:1499 AppScope no longer exposes the backtrace symbol. Before this fix, certain scoped applications would segfault when they called backtrace.1491 When you run AppScope in a Kubernetes pod, the pod now starts normally ev

Thank you to @CriblNinja:A couple examples of real world use of Lookup Tables.https://medium.com/p/80c72a569e27Original Message: https://cribl-community.slack.com/archives/CPYBPK65V/p1687549304158039

I'm trying to assign a value to a field whose name is a value of another field. I expected __e[fieldName] to work, but it doesn't seem to. I get foo2 , but not foo1

We just wanted to say thank you to everyone that has been asking and answering questions on Cribl Curious. Each month we will reward our top three contributors who have asked amazing questions and provide insightful answers that have helped fellow members. This month we even have a tie for 3rd place! 🏆 Top Contributors for the Month of June 🏆1st – Jeff G , 8 Points2nd – Bryan Rapp, 7 Points3rd  - Pawel Kwiatkowski, 4 Points3rd – Qian Zhao, 4 PointsTo express our gratitude for your contributions, we have a special gift for each of our top contributors. Please keep an eye on your inbox, as we'll be reaching out to you shortly with the details. You've earned it!You might be asking; how do I get points in Cribl Curious?Discussions:Posting a question

Hi, Using Cribl TCP > Cribl TCP and on the destination side getting a “message:sender state change” with a “stage: STALE”. Also seeing messages of “reason: marked as stale”. What is causing this and is this something to be concerned about ? Found this digging around as on the Cribl TCP destination we are seeing the “Blocked status” on the charts tab showing as 1 however all servers are green under the status. The final destination is also Green and we cannot find any reason why the Blocked status is enabled. Original message in Cribl Community Slack Message: https://cribl-community.slack.com/archives/CPYBPK65V/p1683177474390609

We had the first CriblCon on Monday. We have kept the party going with the CooLabs so if in Las Vegas, you can still stop by and get demos, talk to the experts, or just hang out. But we wanted to give you more. Today we are releasing Cribl v4.2.0 and AppScore v1.4.1! Below are some of the features I am personally excited for but make sure to check the release notes to learn more.Download Today!In version 4.2.0, we give you more control. Members and Permissions adds finer-grained access control and authorization, allowing you to assign access and capabilities to users independently at the Organization, Product, Group/Fleet, and resource levels.Stream:

Besides bragging rights, is there anything else I can do with my points? Funny you should ask. We are currently building the Community Redemption center. Once you earn a new level, you will be sent a code to redeem Community Swag. Please let us know what you would be wanting swag wise.Community T-Shirts?Sling Bags (like those found at CriblCon)?Tumblers?Stickers?Sweatshirts? Donations to a cause?Call with a Community Team Member / Product Team Member / one of the Co-Founders?

What is Cribl up to in August?Our community is bustling with vibrant discussions, engaging webinars, interactive workshops, product updates, and so much more. Whether you are a seasoned data expert or just beginning your journey in the world of observability, Cribl has something special in store for everyone. Join us and embark on a thrilling ride through the latest innovations, industry best practices, and collaborative networking opportunities!CriblCon Recap:All the videos and content from CriblCon 2023 on July 17th, 2023.CriblCon 2023 PlaylistEvents:Black Hat USAAugust 9 - 10, 2023Mandalay Bay Convention Center, Booth #1381, Las Vegas

We’re thrilled to kick off Black Hat USA 2023 with an exciting announcement – a new strategic partnership with Exabeam! TL;DR? Cribl’s new partnership with Exabeam gives enterprises more control over their data by accelerating new technology adoption and improving threat detection, investigation, and response (TDIR).A new strategic partnership with Exabeam!This collaboration enables security and IT teams to streamline data ingestion and accelerate the deployment of new technologies, like Exabeam’s New-Scale SIEM™. With a common goal of empowering security teams to seamlessly

Everyone can stop holding their breath, Cribl v4.2.2 is officially here! We got a bunch to talk about, but I will try and summarize it. Stream:We have been able to make a bunch of fixes to make sure our Stream product is humming along. We have fixes in Access and Authorizations, Sources. Destinations, Persistent Queue. Diagnostics, Monitoring and Metrics, and Other Functional and UX/UI.Couple of fixes to note:CRIBL-19154 Corrected File Monitor Source's memory leak.CRIBL-18156 Corrected blocked data ingest on Source persistent queue read/write conflicts.CRIBL-18667 Increased FileSystemOut logging to better diagnose hung event processing. Edge:Edge has

It is release day and we are up to release 4.3.0. We have updates to Stream, Edge, and Search - this time with double the Pumpkin Spice! Below are a few of the new features I found interesting.Download Cribl v4.3.0StreamCribl.Cloud Organizations can now be created in the AWS Europe (Frankfurt) Region.Cribl admins can now optionally define a global banner to display above their whole Cribl suite (all products' UI). Your banner can use text and/or a hyperlink to announce new options, resources, deadlines, warnings, etc.The Google Cloud Storage Destina

Hi folks, the Cribl Technical Marketing Team has updated the Sandbox platform's verification code functionality. You'll see a new email template that looks like the following screenshot. These changes gives us better ability to troubleshoot problems.Please let us know if you have difficulty starting a Sandbox with these changes. Join us in #sandbox if you need any help!

This discussion has been moved.

This discussion has been moved.