General

This message originated from Cribl Community Slack.Click here to view the original link.Does anyone know if Cribl Edge can handle xpath filtering on the windows log ingestion side? IE I can feed it the xpath that I want for logs and it honors that

This message originated from Cribl Community Slack.Click here to view the original link.If I apply a TLS cert to our workers' distributed TLS settings through the UI (or via console, in instance.yml), one by one, and then apply the cert to the leader, control plane communication will be down for each worker until I finish with the leader. Will other communication (data plane, in particular) be broken during that time, as well? I'd like to know if I should plan for data loss during that period.

This message originated from Cribl Community Slack.Click here to view the original link.Hi, I am using Google pub/sub source in Cribl stream with Manual Authentication(with Service account creds in Json format) I am getting Permission denied error but the same creds are working when tested with python code from my local. Below is the sample screenshot what values(not the actual values though) I have provided for my source I have tried couple of other ways to troubleshoot but getting same error. Verified that the Service account and subscription are from same project and have the required access Below are the errors that I am seeing message: Error listing subscription permissions err: message: 7 PERMISSION_DENIED: User not authorized to perform this action. I do have a question that Is there a requirement on GC

This message originated from Cribl Community Slack.Click here to view the original link.Hi all - I have a QQ on Azure Blob Collectors. We have databricks pushing logs into a databricks development container and files for \audit, and \query. Ive tried adhoc pull but with no success. This is set up exactly like our prod Stream -> container. Im getting the "This request is not authorized to perform this operation using this permission. Are the permissions different for when we need to pull logs in from that container rather than push into it?

This message originated from Cribl Community Slack.Click here to view the original link.Anyone with experience polling Tenable.SC and Nessus Manager for Asset inventory, vulnerabilities, plugins, and agent status? We used to poll this via Splunk apps / custom Python but I've been tasked with leveraging Cribl API methods to ingest into our new SIEM. I've been looking at this article in the meantime: https://www.aplura.com/news/cribl/tenable/2025/08/06/tenable_sc_logs_with_cribl.html Sorry in advance: I'm a Unix beard but very new to Cribl.

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to send a datagen of syslog data to a syslog destination. The format of the beginning of the _raw message being sent in the datagen is <187>1 2026-04-17T14:13:25-0400 hostname The destination syslog (I ran TCPDUMP to see it) is receiving it like this <187>Apr 17 14:13:25 hostname the 1 is gone after the <> and the date format is completely different. As the receiving syslog is getting the changed message, is Cribl changing something in the _raw data before it sends out over the wire to the syslog destination?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a way to create knowledge (lookup) for all workergroups at once?

This message originated from Cribl Community Slack.Click here to view the original link.Quick question about the Cribl Terraform provider. Wen you push changes via Terraform, do you still need to commit and deploy them in the UI?

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone successfully configured an Akeyless audit logs TCP listener with TLS? Ours works without TLS, but when we try to enable regular TLS or mTLS, we stop receiving events. We have other log sources successfully using TLS in the same worker group from the same network

This message originated from Cribl Community Slack.Click here to view the original link.is netflow (https://docs.cribl.io/stream/sources-netflow/) default udp or tcp?

This message originated from Cribl Community Slack.Click here to view the original link.Hi community, does Stream support file encryption in the S3 staging location?

This message originated from Cribl Community Slack.Click here to view the original link.Hey, can anyone give me a pointer on what I may be missing in my S3 path. I have an s3 destination and am setting up a s3 source to "rehydrate" logs. I used the destination to populate the source as recommended and copied over the same partition expression I have in the destination but am not getting any results back. It is consistently being written to. Destination configurations - Bucket Name: archive path: palo_alto/${C.Time.strftime(Date.now()/1000, '%Y-%m-%d-%H:%M')} File name prefix expression: CriblOut File name suffix expression: .${__format}${__compression === "gzip" ? ".gz" : ""} Example from on premise s3 storage: /palo_alto/2026-04-07-00:01/CriblOut-zsf3kU.json.gz Source

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone figured out the optimal number of receivers for FDR/SQS based ingestion? We have around 1.5TB of daily volume from CS FDR but 6 receivers and 10 message limit is not keeping up

This message originated from Cribl Community Slack.Click here to view the original link.I was wondering if Cribl allow us to pull data from GraphQl ?

This message originated from Cribl Community Slack.Click here to view the original link.Does the REST API collectors use a different cert store other than the operating system? I have a cert for a server that is trusted by the server but when running it through the rest collector get a self-signed error.

This message originated from Cribl Community Slack.Click here to view the original link.Anyone have success with creating custom pipeline functions? I essentially need the "Mask" function but have it ONLY mask on capture groups. We have some regexes that will match on PII, except when wrapped in special tags added by our logging library. Only the capture groups need to be masked, everything in the tags is "matched" but actually safe. I was thinking of copying and pasting the mask function and editing it but it seems to be minified, am I able to access the source for this somehow? I also saw something about being able to compile the functions to WebAssembly? The article I was reading is 8 years old at this point so I'm not sure how much has changed.

This message originated from Cribl Community Slack.Click here to view the original link.I have a REST API collector source that appears to be having issues. I am trying to look at the job for more details but the FreeDiskSpaceJobArtifactReaper keeps reaping the job and now allow me to view any of the data. Is there a way to disable this? I have tried raising the artifact reaper period but it seems to still remove it immediately after it's run.

This message originated from Cribl Community Slack.Click here to view the original link.Is it possible to send to AWS GovCloud via Databricks destination?

This message originated from Cribl Community Slack.Click here to view the original link.At what exact moment does Cribl record the license consumption in Stream? Asking for an API that returns JSON with ridiculous amounts of whitespace, and wondering if it makes sense to try and reduce that in event breaker somehow, or if it's too late at that point

This message originated from Cribl Community Slack.Click here to view the original link.Hi everybody, I'm migrating my clients infra to a new datacenter (leader node + central worker group and multiple worker nodes). What is in your opinion the best way, to migrate the LN? It will be a new VM with new ip/dns

This message originated from Cribl Community Slack.Click here to view the original link.Is there an easy way to get the download URL for past Cribl release versions? For example, we are upgrading to 4.16.1 and I want to figure out where I can find this: https[:]//cdn.cribl.io/dl/4.16.1/cribl-4.16.1-20904e45-linux-x64.tgz so I can configure it in the path settings in the upgrade section of the UI. My solution now is to download the version I want, copy the file name, and reconstruct the URL. I would like to simplify this if possible.

This message originated from Cribl Community Slack.Click here to view the original link.Whats the syntax for doing a toLowerCase for a field like tenant.id or anything that contains a special character?

Hi everyone,I'm currently working through the CC Admin – Stream | Final Review Lab, and I'm stuck on Task 18, which asks to add a Lookup function to the pipeline named networkData.The Lookup function is present in the pipeline and appears correctly configured, yet the task still shows as failed.Any thoughts about this error ?Thank you,Phillip 

This message originated from Cribl Community Slack.Click here to view the original link.Hello community, is there a Cribl Cloud API endpoint I can hit to add multiple CIDR Ranges to the Workspace --> Access Control List? I have been scanning the API documentation for such an endpoint.

This message originated from Cribl Community Slack.Click here to view the original link.This may be a silly question, but regarding the Azure Event Hub source, let's say I have to restart my Stream workers or otherwise take them down briefly for maintenance. Once they come back up, they'll just resume the data ingestion where they left off, right? Do I need to do anything "special" to make sure it keeps track of where it needs to pick back up reading data?