General

Splunk Enterprise Security… there's a lot of SPL out there that leverages the date_ fields that the TAs on splunk HFs create when parsing time. How is everyone dealing with lack of these fields, and aliasing to CIM etc by Splunk TAs when leveraging cribl stream?

Hey everyone, I am currently working on building a custom collector in CRIBL. I am about 99% of the way there, so that is exciting! I wanted to check if anyone knew how to get the current mode the collector is running in (e.g., Preview, Discovery, or Full Run). I have a unique use case and the collector needs to act differently in these 3 states. I checked the entire "opts" json object and I didn't see anything referencing the mode. I also checked in "jobs" object and didn't see anything there. Could anyone point me in the right direction? If nothing exists, I may just add a simple Boolean setting in the UI of the collector.

We have a database collector that works fine. When we add a field, the field shows up in preview but when sent to syslog the field doesn't show up. We have rebooted our cribl server. Any ideas?

Hi folks, apart from /opt/cribl/local/cribl directory structure for the Leader, is there any other directory structure I need to look out for? I am trying to get a list of all the directories we need in the repo for Github

Is there a way to download the captured data locally?

Is there a quick list of all functions that support querying a URL (like the Redis function) from within a pipeline for enrichment purposes?

If anyone is still successfully collecting logs via Cribl's Office 365 Message Trace collector, using *Oauth2* authentication, can you please provide the "Report URL" you are using?

How to integrate Cribl with Databricks(Destination) ? as per the Cribl doc it says "the S3 Destination can be adapted to send data to services like Databricks". So, can we use the pre-configured s3 destination connector to integrate Databricks ?If yes, what are the changes required in s3 destination ?

Anyone doing any with netapp fpolicy and syslog? A long shot question for this group — but giving it a try.

I have a timestamp field inside JSON in the format "2023 April 18 15:00:00 UTC". I cannot get Stream to recognize it. It keeps using current time. Any ideas?

MS Sentinel gurus - Does anyone know if it's possible to take advantage of Microsoft log sources being <https://learn.microsoft.com/en-us/azure/sentinel/billing?tabs=free-data-meters#free-data-sources|free to ingest into Sentinel> (Such as Azure Activity Logs, Office 365 etc) while still sending the logs in via Cribl Stream?Obviously the preference would be to send everything via Cribl, but I presume the free ingestion of Microsoft logs will be calculated/only count via the built in Sentinel data connectors for each of those log sources - Whereas if you start ingesting those through Cribl, you'd have to send it through a log source like syslog in which case you then get billed for everythingAnyone with experience using Cribl with Sentinel - Is that right, or is there a sneaky workaround?

Hey,Is there any workaround to send uncooked data from Splunk HF to Cribl? (dest::Splunktcp)The issue is that the EB(Cribl) is not taking any effect (I'd read before it will be skipped by design limitations).tried to set sendCookedData = false but the data flow had stopped eventually, then added negotiateProtocolLevel = 0 but it didn't help, other trial was to use dest::tcp source but ingestion has stopped as well. Any ideas how we can overcome this scenario.

Which port opening (on Cribl and Graylog) is needed such as source and destination, unidirectional or bi-directional.

my raw event looks like this α    _raw: `*Mar 31 09:21:11 10.x.x.x* time=1680239950|hostname=D-xxxx|product=test` I want to drop only the syslog header part (shown in Bold above) I am trying to use parse with extract and serialize. I also tried with parse (reserialize) but the full event length is going high, I need to drop header and reduce the size of full event as well... how can I do this?

Hello.How can I troubleshoot a cribl destination (Splunk HEC) not sending data? destination is seen live/green check, but no data flowing per tcpdump on source or destination. this goes out through a router and same data arriving in the main index correctly but want in a separate one. curl from cribl to splunk works (`curl -vk https://172.16.x.y:8088/services/collector/event -H 'Authorization: Splunk TOKEN' -d '{"event":"test"}'`)Thanks

does Cribl is it possible to have snmpTrap (but with part of that snmpTrap have MIBs loaded in the processing layer)

In HTTP request, getting token directly in text response without any field. Then how would I extract that token in Cribl REST collector authentication.

Azure Data Explorer question. Is it possible to have dynamic table mapping/schema? I want to create a table that functions like a Splunk index where it ingests all sorts of data that I can't create a mapping/schema for due to not knowing what the fields are. In Sentinel, custom logs have dynamic schemas.

Destination is presently experiencing severe problems. Below are details -error is Write ECONNRESETany suggestion how to fix this ?the same destination is receiving another log stream very well

I need to drop computer account name ending with $ sign,the Drop function is not recognizing itany suggestion for alternate way of dropping all "computer-name$" ??

this is beyond my skillset, so was hoping someone could help me. I have netscaler logs that come in that are key<space>value and was hoping there was a regex to extract them all.Goes like this:```Source 1.2.3.4:18356 - Vserver 4.5.6.7:389 - NatIP 8.9.0.1:18356 - Destination 6.6.6.6:389 -```That's just one sample. The rest are sending in a similar format. Was looking for one regex to extract them and put them in fields.

Hello all, I am facing an issue where one of the Workers in one of the Worker Groups seems to be stuck in deploying a version while the other worker updated the version correctly as per the attached screenshot, Have anyone faced the same issue and what kind of troubleshooting / workaround can be done , Worth mentioning that I have tried rebooting the stuck worker twice and rebooted the leader as well.

Does the cribl Stream leader do anything on port 3128?

Trying to hit the Cribl APi in postman and successfully able to get the output but while hitting the API with same configurations in the Cribl Rest collector it gives status code 400, any reason?

Hi Folks,Is it possible to ingest logs from Containerized Applications with Cribl?I.e., logs from any application running inside a docker container.If anybody has experience with this, please let me know what potentials issues can arise in this scenario..