General

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to implement state tracking for a rest collector. How do I reference the state in the collect parameters trying to assign the parameter 'newerThan' an integer with the javascript prevState.lastActivityId == null ? 7369027 : prevState.lastActivityId When I run a preview it just passes url encoded of my javascript, but the expression should set to 7369027

This message originated from Cribl Community Slack.Click here to view the original link.Darktrace - Has anyone managed to parse the JSON syslog and convert directly to JSON? _raw: <165>Feb 16 14:56:36 darktrace.temp.com darktrace {"model":{"description":"Test model used for testing alerting configuration.","created":{"by":"System"},"edited":{"by":"Nobody"},"name":"Unrestricted Test Model","priority":5,"pid":0,"uuid":"659ec8ad-80e8-4182-a7b6-28e0d08260e5","category":"Informational","compliance":false},"device":{"ip":"0.1.2.3","hostname":"test-device.example.com","macaddress":"00:11:22:33:44:55","vendor":"Test Vendor","label":"Test Device","did":0,"sid":0,"uuid":"79e50b72-50b3-449a-ss29-788ac44a9e0f"},"triggeredComponents":[{"metric":{"label":"Test Metric"},"triggeredFilters":[{"comparatorType":"display","filterType":"Test Metric Filter","trigger":{"value":"Test filter value"}}]}],"sourceIP":"0.1.2.3","percentScore":100,"breachUrl":"","pbid":123,"score":1,"creationTime":1771253796

This message originated from Cribl Community Slack.Click here to view the original link.any hints on how much time it takes for the Lake data/consumption to appear in FinOps center? same question for Lake monitoring, we are pouring some data for like 12 hours and there is nothing in FinOps and also monitoring is empty

This message originated from Cribl Community Slack.Click here to view the original link.Hello Team, If i had setup like that below 30 days, splunk, then move to AWS can cribl read my aws data via cribl search, without the need for additional parsing etc etc.

This message originated from Cribl Community Slack.Click here to view the original link.Hi, is it possible to capture the originating IP for syslog sources? My customer has a specific requirement.

This message originated from Cribl Community Slack.Click here to view the original link.In cribl, how do i convert a json event into splunk metrics to be sent to the indexer as s2s? { average: 885463040 count: 2 maximum: 908546048 metricName: AverageMemoryWorkingSet minimum: 862380032 region: Central US time: 2026-02-11T08:51:00.0000000Z timeGrain: PT1M total: 1770926080 }

This message originated from Cribl Community Slack.Click here to view the original link.I am planning to create a custom table in Microsoft Sentinel for Zscaler Deception logs using DCR/DCE. The intended table schema contains 124 SOC‑relevant fields. However, the source logs are event‑driven, and at present only 59 fields are being populated. These 59 fields are already parsed, normalized, and enriched in Cribl before being sent to the Sentinel destination. If I define a custom table schema with all 124 fields, will the incoming logs from Cribl correctly map the available 59 fields to their respective columns, while the remaining fields stay empty/null when querying data in Sentinel? Additionally, can someone guide me on which parsing and transformation functions should be used (for example, in Cribl and/or DCR transformations) to ensure proper field mapping and schema alignment?Links for this message:Screenshot 2026-02-13 181231.png

This message originated from Cribl Community Slack.Click here to view the original link.Quick question - are we able to host the install-edge.sh script ourselves in our own s3 bucket?

This message originated from Cribl Community Slack.Click here to view the original link.hello, i tried searching how to change a Cribl project name, but was not able to figure out a way to do this! so is there any workaround to do this, as there are are multiple projects need to be renamed and each project has bunch of subscriptions/pipelines/destinations, so re-doing the work again in a new project isn't the best option here. cribl version 4.15.1. your support is appreciated

This message originated from Cribl Community Slack.Click here to view the original link.I have a dict that contains base64-encoded fields. How can I decode them all without knowing their names?

This message originated from Cribl Community Slack.Click here to view the original link.If I have a data with some File Paths in it. Example A:\Program Files\SplunkUniversalForwarder B:\Program Files\SplunkUniversalForwarder C:\Program Files\SplunkUniversalForwarder D:\Program Files\SplunkUniversalForwarder And I want to Drop events with SplunkUniversalForwarder in the value.... How do I do that in 1 C.Lookup function? Right now, I have C.Lookup('myLookup.csv').match(fieldName) where fieldName is the field where both my values above exist. But I have to add each one of those full paths into my Lookup file. I'm trying to avoid putting the entire file path into my CSV file since it changes so often. Would rather just put a constant in there if possible.

This message originated from Cribl Community Slack.Click here to view the original link.Hey all, just want to make sure i'm not missing something here but is there a way to get a notification that a Cribl Edge node has gone offline?

This message originated from Cribl Community Slack.Click here to view the original link.trying to drop a bunch of netbios noise from linux syslog and while my function PROTO === "UDP" && (DST.endsWith(".255") || DPT === 137) works, it doesn't account for non /24 subnets, any advice?

This message originated from Cribl Community Slack.Click here to view the original link.Anyone have any information on how the Javascript process works in Cribl. Things like how many processes are there, how can we create or access memory objects in process memory. Are processes shared between pipelines, between functions in the same pipelines? For example, can we create variables in one Code function and access them in another?

This message originated from Cribl Community Slack.Click here to view the original link.I am new to Cribl Search. We have our Palo Alto traffic logs backed up to AWS S3 buckets. We're being asked to search for four or so src/dest IP addresses over a 6-month period. Are there any tips to a speedy search - would it be better to kick off one search and just wait, or divide it into six separate concurrent searches, each over one month?... I am currently doing one month at a time, example: set global:max_executors="auto"; dataset="S3_PAN_Traffic" earliest=1759276800 latest=1761955200 (src_ip in ("IPwhatever", "IPwhatever", "IPwhatever", "IPwhatever") OR dest_ip IN ("IPwhatever", "IPwhatever", "IPwhatever", "IPwhatever"))

This message originated from Cribl Community Slack.Click here to view the original link.I setup a S3 Data Provider & Dataset with appropriately regex'd directory pathing (tested to validate and it passes everytime)... but even with that, I am unable to search data within the S3 bucket. I have two primary root directories in this S3. Within the Datasets I have two bucket paths defined. One is working fine, but the other successfully searches, but generates no results and gives me no errors... It's very hard to troubleshoot / debug when you get no errors. I'd even take a 'no such directory/path exists', that would at least help me define my troubleshooting pathway. Anyone have any words of wisdom to impart so that I can try to fix this path search?

What's new at Cribl? Check out this video to find out. (Spoiler: Insights,  Outpost, Packs, and more!)  

This message originated from Cribl Community Slack.Click here to view the original link.I teleported into a worker node and I was checking the CPU usage of the the Worker Processes. Are the data points in percentage?Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, is there anything that could trip us up if we wanted to run a collect job for data stored in Amazon Security Lake S3?

This message originated from Cribl Community Slack.Click here to view the original link.Question: Is Cribl Stream basically the cloud‑hosted platform, while Cribl Edge is the on‑prem agent that runs on your own servers or VMs?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a way to dynamically set Datadog tags in a Datadog log destination?

This message originated from Cribl Community Slack.Click here to view the original link.Hi team, quick question about SSL/TLS. Outbound traffic from Edge/Stream to S3 is already encrypted, but we want to ensure inbound data sent to Cribl is encrypted if it may cross the internet. Do we need to enable SSL/TLS on the Listener for inbound data in that case Can Edge/Stream use a self‑signed certificate If so, is adding that cert to the sender’s trust store the correct approach

This message originated from Cribl Community Slack.Click here to view the original link.Struggling with understanding pagination on a particular REST API: https://docs.dynatrace.com/docs/discover-dynatrace/references/dynatrace-api/environment-api/rum/user-sessions/table#parameters The data that comes in does not explicitly include an indicator for which one of these to use: https://sandbox.cribl.io/coursedocs/rest/docs/7_pagination#offsetlimit https://sandbox.cribl.io/coursedocs/rest/docs/7_pagination#pagesize I've tried both and it either never goes past the 5000 records collected or the job continuously runs without stopping, running the same query over and over again for each page per collector job. Based on the latter, I believe I need to be using Offset/Limit, but the parameters explicitly say pageSize & pageOffset

This message originated from Cribl Community Slack.Click here to view the original link.I am working on collecting Workday Sign-on Activity logs in Cribl I am having issues in obtaining Access token. How I can configure this in Cribl Authorization to get this working. <#C08L895TEEQ|> This is how I am doing it in Postman and it returns me access token, create a new POST request. Set the URL to: https://<your_workday_domain>/ccx/oauth2/token Go to the Authorization tab: Type: Basic Auth Username: Client ID Password: Client Secret Switch to the Body tab and select x-www-form-urlencoded Add the following key-value pairs: grant_type: refresh_token refresh_token: _token_value_

This message originated from Cribl Community Slack.Click here to view the original link.Hi. I created a raw HTTP/S source in Cribl on port 10081. When a .NET client tries pushing JSON data to the endpoint a 403 response is received. It's not an issue with proxies/firewalls and not due to any problems with auth tokens. We aren't having this issue using our other sources in Cribl Cloud. Has anyone run into similar issues and if so, how were they resolved?