General

This message originated from Cribl Community Slack.Click here to view the original link.what would be the best way to report on log stats (volume, drops) for a period of a year? Should I just query an endpoint and save them to a lookup, or is there a way to do it that won’t take forever to run a report. I’d probably want avgs/peaks and also by some other criteria (routes, destinations). I know cribl vsision can do a lot of this, but my concern is that rrunning it ffor longer periods of time would take forever.

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, im trying to forward logs from stream to snowflake. Has anyone tried doing this before? There is no native destination and i tried searching for workarounds but no luck so far

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, we're trying to setup log forwarding from Cyberark Audit to cribl. Could you please help with that

This message originated from Cribl Community Slack.Click here to view the original link.Can we set up volume notifications on worker group level instead of source and destination?

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to collect CATO logs using the REST Collector. The current issue is that logs retrieved via the REST API are being duplicated. When retrieving CATO logs through the REST API, I would like to avoid collecting data that was already fetched previously. Is it possible to prevent previously collected data from being ingested, for example by using timestamp information? If this is not supported as a built-in Cribl feature, could you please share any best practices to handle this?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a per GB dollar cost calculator for using Lakehouse?

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to leverage the send command in Cribl Search. I have enabled a Cribl HTTP source in Cribl Stream that listens on port 10200 listening from all addresses. The worker group that this source is enabled on is a hybrid worker group hosted in my team's AWS account. Is there a list of IP addresses I need to allowlist on my AWS account's side?

This message originated from Cribl Community Slack.Click here to view the original link.It looks like the database collector is automatically turning MSSQL date and time fields into text versions of full timestamps complete with a hallucinated timezone. E.g. '2025-06-26' --> "2025-06-26T00:00:00.000Z", '13:09:11.0000000' --> "1970-01-01T13:09:11.000Z" Is there a way to stop this behavior at the collector, or do I have to undo the damage in a pipeline?

This message originated from Cribl Community Slack.Click here to view the original link.Hi Folks, I think I am missing a trick here. I am trying to create a Stream API collector to Salesforce Marketing Cloud, and I get the “Error: read ECONNRESET at TLSWrap.onStreamRead” error. I have configured the collector correctly, so I was wondering if there is any way to confirm connectivity from Cribl Cloud to the Salesforce Marketing Cloud URL to confirm that part is working at least? Also, any suggestions I can try? Has anyone successfully managed to create a connector to Salesforce Marketing Cloud?

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, is there anyone having experience to reduce Network device logs(VPN,IPS,FW)? We are currently working on a proposal for log reduction on Cisco ASA devices for our customer. But the customer mind if reduction logs have impact on their SIEM operation. Based on our analysis, we believe that certain logs—such as informational-level messages (e.g., session teardown notifications, routine status updates)—are generally low-value for SIEM correlation and threat detection, and can be safely excluded. So if you have an experience about similar log reduction strategies for Cisco ASA or other network devices, could you share with me?

This message originated from Cribl Community Slack.Click here to view the original link.Am I allowed to register an On-Prem cribl worker to a cribl.cloud leader? It looks like I do not have access to the auth-token for the default group

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, Does Cribl support OAuth2.0? Can we integrate with BOX with Cribl?

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, I would like to know about "Enforce License Quotas" in Cribl Stream(On-Prem, not Cribl.Cloud). The docs state that there will be no restrictions if the license quota is exceeded for an Enterprise license. Is there a restriction like Splunk where data cannot be imported if the license quota is exceeded a certain number of times within a certain period of time? Of course, we are assuming that it should not be exceeded, but we are concerned about the impact if a spike occurs due to maintenance, etc. and the license is exceeded. > Enforce License Quotas > If your data throughput exceeds your license quota: > • Free and Standard licenses enforce data ingestion quotas through limits on the number of Worker Groups/Fleets and W

This message originated from Cribl Community Slack.Click here to view the original link.If we're implementing Github/Github Ops, should the repo be read-only. If I'm correct, you won't want to modify Cribl through anything but the UI unless it's specific .yaml files on servers right?

This message originated from Cribl Community Slack.Click here to view the original link.Hello all, working on trying to find volume for destination for each fleet, monitoring only allows for the last 1 day. Are there any specific logs that I can collect from the edge to be able to perform a search on the fleet to be able to see volume over a period of time, ideally at least the last 7 days. Thanks in advance.

This message originated from Cribl Community Slack.Click here to view the original link.In stream is there anyway to drop cribl metric events out of a pipeline?

The first step in setting up SSO is to make a ‘backup access’ account with an email NOT in the domain being SSO’d. Can anyone say if this needs to be a working account or is it just a Cribl-specific username/password which doesn’t need to receive emails?

Hello,Am experiencing issue on cribl leader that no commits to be raised after any change I do. I wan not using any remote github and when I tried to change the settings in cribl to a current github repo, the git setting page gives me a gateway error and does not load at all   

Every time we update openshift in azure, my cribl config is lost. since we have the free version, we cannot use git repository. would using persistent storage helps keep the config because the update process drains the node from the cluster and restart them on another node. I suspect this is why the config is not kept.

Hi all, I just completed the Level 3 Prerequisite exam but I have a question.One of the questions was as follows:What would be the result of the Mask function with the following settings Match Regex =`(user_id=) (d+)" Replace Expression = C. Mask. random( ${g2}') on the event host=server. local user_id=12345?A)host=server. local aeQI9B) host=server. local user_id=fe8780bd8237b0388df7175034db75d6C) host=server. local user_id=aeQI9D) The event would remain unchanged because the Match Regex is invalid.I chose option D. But apparently this was the wrong answer. But I think it shouldn't be… Here is why.The event host=server.local user_id=12345….(user_id=) (d+) matches “user_ID=”(d+) is incorrect, d is just a literal d and not a digit in this case, it should have been \d+. There is also a space in the regex, but the event itself does not have a space. “user_id=12345”This is why the event would remain

Hi All,We are managing Crowdstrike NGSIEM  in our network and all the data sources are routed to Cribil and from Cribil , we are forwarding the logs to NGSIEM. Data source → Cribil →  NGSIEM I understand , we require parsers in NGSIEM to read the relevent logs received from the  datasources but I wish to know ,is there any parser concept present in cribil to onboard the logs from the different datasources.    

This is an example of how we can reference a value provided by Discover Type HTTP Request in the REST API Collector which will correctly save a bearer token value which will expire (default time 5 minutes) using a named Token attribute: token, Authorization header `Bearer $(token)` and Authentication expression `Bearer $(token)` The initial authorization request:curl -X POST 'http://localhost:9000/api/v1/auth/login' -H "Content-Type: application/json" -d '{ "username": "admin", "password": "<password value here>" }' Run a Discover request to generate a bearer token: The above request will return a value something like: {"token":"abcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdef

I am new with Cribl.Cribl Edge (standalone, installed on Windows 10 laptop for test/evaluation): Windows Metrics do not return actionable information when forwarding to a standalone Splunk Enterprise instance. What am I doing wrong or what I am missing here?Windows Eventlog cribl-source is correctly received in json. But adding the Windows Metrics cribl-source to the same (working) Splunk Destination (default forwarding to port 9997) it shows:All relevant metric_names seems to be received correctly, but no Values to find. Besides, do not understand the metric_type "g". I would expect a value-field in bytesI have

I am trying to send logs from cribl to OpenObserve.OpenObserve accepts data in a JSON array format.e.g.[ { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }, { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }]What is the best way to do this?

Hi Anyone/supportYesterday, started Cribl-Cloud (stream), just for testing, now my Splunk License is chocking with data from it Crible Cloud :-(.Tried to delete all things I could delelte, still chocking my Splunk license. Deactivating my subscriiption says: We're sorry to see you go!We are processing the cancellation of your Cribl.Cloud organization. This process takes up to 30 days and you will get an email 7 days before the cancellation is final. If you didn't mean to cancel or having second thoughts, contact support@cribl.io.How can I interrupt this data-stream. I had to stop my Splunk Enterprise instance for this…Hope someone can help out.Ashley Pietersen