General

how to convert dump is s3 into lookup file

This message originated from Cribl Community Slack.Click here to view the original link.I need to access a rest api to grab okta logs. I see an okta pack but dont see rest api stuff. Do I need to roll ny own?

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, I’m currently working on naming conventions for Cribl Stream and thinking through a few things. I’m wondering how, for example, setting tags on objects like sources, destinations, and routes can help with identifying related objects. I’d also like to make the best possible use of the Cribl Stream search bar that’s shown in the top right within a worker group to find objects more easily. Are there any filtering options for this, such as tag=prod? I haven’t been able to find anything on either topic in the documentation.

This message originated from Cribl Community Slack.Click here to view the original link.i have a rest feed that sends data to splunk on a daily basis. i’d like to also send that data to another destination but only once a week. I was thinking of using an output router, but is there a way to look at the day of week in the filter? Open to other suggestion on how to do this.

This message originated from Cribl Community Slack.Click here to view the original link.Hello team, I need one clarification on - Zscaler log source can be ingested in CRIBL via Amazon S3 ??

This message originated from Cribl Community Slack.Click here to view the original link.In general... should I need to import the default Cribl certificate when attempting to connect one of our AWS EC2 Linux-based Splunk Heavy Forwarders to a Splunk TCP Source hosted in a Cribl Cloud's AWS workgroup? We've confirmed that we have connectivity using netcat, but when I configure the TA in question to send data to the Cribl workgroup (using the FQDN in outputs.conf), the IP addresses fail after 3 attempts and are quarantined. I've reviewed the splunkd logs on the heavy forwarder, but they have yielded little so far.

This message originated from Cribl Community Slack.Click here to view the original link.I'll preface this by stating that I've searched the community here, and have seen some rumblings but nothing concrete. Has anyone successfully load balanced Windows Event Forwarding with an F5?

This message originated from Cribl Community Slack.Click here to view the original link.When migrating Leader Nodes from and old server to a new server (on-prem) it says to start the new Leader node, apply the license and just zip up the existing $CRIBL_HOME/groups directory and unzip it onto the new Leader node. What about for Edge Fleets?

This message originated from Cribl Community Slack.Click here to view the original link.what would be the best way to report on log stats (volume, drops) for a period of a year? Should I just query an endpoint and save them to a lookup, or is there a way to do it that won’t take forever to run a report. I’d probably want avgs/peaks and also by some other criteria (routes, destinations). I know cribl vsision can do a lot of this, but my concern is that rrunning it ffor longer periods of time would take forever.

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, im trying to forward logs from stream to snowflake. Has anyone tried doing this before? There is no native destination and i tried searching for workarounds but no luck so far

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, we're trying to setup log forwarding from Cyberark Audit to cribl. Could you please help with that

This message originated from Cribl Community Slack.Click here to view the original link.Can we set up volume notifications on worker group level instead of source and destination?

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to collect CATO logs using the REST Collector. The current issue is that logs retrieved via the REST API are being duplicated. When retrieving CATO logs through the REST API, I would like to avoid collecting data that was already fetched previously. Is it possible to prevent previously collected data from being ingested, for example by using timestamp information? If this is not supported as a built-in Cribl feature, could you please share any best practices to handle this?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a per GB dollar cost calculator for using Lakehouse?

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to leverage the send command in Cribl Search. I have enabled a Cribl HTTP source in Cribl Stream that listens on port 10200 listening from all addresses. The worker group that this source is enabled on is a hybrid worker group hosted in my team's AWS account. Is there a list of IP addresses I need to allowlist on my AWS account's side?

This message originated from Cribl Community Slack.Click here to view the original link.It looks like the database collector is automatically turning MSSQL date and time fields into text versions of full timestamps complete with a hallucinated timezone. E.g. '2025-06-26' --> "2025-06-26T00:00:00.000Z", '13:09:11.0000000' --> "1970-01-01T13:09:11.000Z" Is there a way to stop this behavior at the collector, or do I have to undo the damage in a pipeline?

This message originated from Cribl Community Slack.Click here to view the original link.Hi Folks, I think I am missing a trick here. I am trying to create a Stream API collector to Salesforce Marketing Cloud, and I get the “Error: read ECONNRESET at TLSWrap.onStreamRead” error. I have configured the collector correctly, so I was wondering if there is any way to confirm connectivity from Cribl Cloud to the Salesforce Marketing Cloud URL to confirm that part is working at least? Also, any suggestions I can try? Has anyone successfully managed to create a connector to Salesforce Marketing Cloud?

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, is there anyone having experience to reduce Network device logs(VPN,IPS,FW)? We are currently working on a proposal for log reduction on Cisco ASA devices for our customer. But the customer mind if reduction logs have impact on their SIEM operation. Based on our analysis, we believe that certain logs—such as informational-level messages (e.g., session teardown notifications, routine status updates)—are generally low-value for SIEM correlation and threat detection, and can be safely excluded. So if you have an experience about similar log reduction strategies for Cisco ASA or other network devices, could you share with me?

This message originated from Cribl Community Slack.Click here to view the original link.Am I allowed to register an On-Prem cribl worker to a cribl.cloud leader? It looks like I do not have access to the auth-token for the default group

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, Does Cribl support OAuth2.0? Can we integrate with BOX with Cribl?

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, I would like to know about "Enforce License Quotas" in Cribl Stream(On-Prem, not Cribl.Cloud). The docs state that there will be no restrictions if the license quota is exceeded for an Enterprise license. Is there a restriction like Splunk where data cannot be imported if the license quota is exceeded a certain number of times within a certain period of time? Of course, we are assuming that it should not be exceeded, but we are concerned about the impact if a spike occurs due to maintenance, etc. and the license is exceeded. > Enforce License Quotas > If your data throughput exceeds your license quota: > • Free and Standard licenses enforce data ingestion quotas through limits on the number of Worker Groups/Fleets and W

This message originated from Cribl Community Slack.Click here to view the original link.If we're implementing Github/Github Ops, should the repo be read-only. If I'm correct, you won't want to modify Cribl through anything but the UI unless it's specific .yaml files on servers right?

This message originated from Cribl Community Slack.Click here to view the original link.Hello all, working on trying to find volume for destination for each fleet, monitoring only allows for the last 1 day. Are there any specific logs that I can collect from the edge to be able to perform a search on the fleet to be able to see volume over a period of time, ideally at least the last 7 days. Thanks in advance.

This message originated from Cribl Community Slack.Click here to view the original link.In stream is there anyway to drop cribl metric events out of a pipeline?

The first step in setting up SSO is to make a ‘backup access’ account with an email NOT in the domain being SSO’d. Can anyone say if this needs to be a working account or is it just a Cribl-specific username/password which doesn’t need to receive emails?