General

Quick question :I have ingested a CSV file through Cribl into Splunk and the headers from the first line are not showing up as fields in the output .Any idea ? Thanks

Can Cribl monitor a folder, uncompress, and read the csv within the zip?

Hello. Is there a prebuilt pipeline for AWS S3 Access logs?

Hey all,Hope all is well. I have a Cribl distributed deployment environment and every morning when I log into the Cribl leader, I get the following error. I then have to go restart the Cribl leader, does anyone know what the fix for this is?

Hello all, I was wondering how is Cribl implementing OCSF mappings?

hello All, As a cribl beginner, I am looking for resources/guide to achieve below ---I am trying to place Cribl between splunk UF and indexer with TLS encryption enabled.Any pointers/lead/direction will be highly appreciated. more details in thread below...

Hi, I have two questions,The first question, is there an expression available in Cribl to generate a random GUID? The second question, is there an expression that will generate a date in this format `Tue, 24 Nov 2023 12:50:11 UTC`

I'm sending JSON data to Splunk from cribl (Cloudflare logs) and it causes the data to be a horrendous .30:1 index size to raw size ratio I'm sending _raw as text. There are no props for that sourcetype on the indexer side so there is no indexed extractions. Any help appreciated

hey folks, can we use python as a script collector or do I have to write some bash to run some python?

Hello all,I need some help please. I have some data in _raw.body, and I'd like to extract the them into json objects together with the other _raw.items (such as _raw.ctupdate)I'd also like to rename some of the fields. Any suggestions?

Good morning,I'm trying to remove some key/values with null values in a tcpjson event w/ the parser function. I noticed that having Source field equal to _raw doesn't access the JSON parsed log data. What would the Source field be for a json parsed event?

Where do I find the backpressure graphs? I normally stumble-into them but not having luck this am....

Hey everyone, has anyone helped integrate InsightVM Rapid7 security alerts via a postgre database connection or through another way?

Elasticsearch output question. How can I get the default `@timestamp`; on elastic output? It seems like `_time` should be automatically be renamed to `@timestamp`; .

Hello everyone,Quick question please.I would like to start sending data directly from Cribl to SnowFlake, but after reading the documentation looks like there is no any out-of-the-box solution for this.Am I missing something? Is send the data to s3 to SnowFlake read it the only possibility?

I have some JSON that I've extracted via a parser function, manipulated/renamed some fields, and now I have an element of an array that is null. Can anyone point me in the right direction on how I might clean up the null? For reference, my end destination is a GCP storage bucket, so I'm just writing the data out as a raw JSON string.It seems I can serialize the fields back into _raw (which cleans up the null array element), and then extract again, and then remove _raw, but that feels like it is potentially inefficient, 3 step process. Is there a better way to accomplish this?

Good afternoon Cribl people! I'm trying to find the best way to serialize to a delimiter, while removing the risk of having that delimited in a string value.If we serialized to JSON, string data types are put in quotes, and integers aren't. We're trying to do the same for delimited format (e.g., CSV) - encase strings in quotes, and not integers. We believe this will help Splunk parse, because it's expects a string when it reads a double quote.

Hey, sorry for all the messages asks but curious here:Does Cribl provide functionality to compute a network flow hash according to the Community ID Flow Hash specification for given fields and provide the output to a new field? https://www.elastic.co/guide/en/beats/filebeat/current/community-id.html

We're seeing a lot of these 500 errors to our HEC endpoint from Stream. And customers are reporting receiving 503 status codes. Would this be a max active requests settings issue? Maybe something else?

What's the best way to do an if statement for status codes. Like is status=400, a new field is made statusCode = "Bad Request"

Is Cribl search available for on-prem yet?

Hi All,using Redis I like to secure the connection.What I figured is, that I need to use `rediss://[[user][:password@]][host][:port]` instead of `redis:]//[[user][:password@]][host][:port]` (rediss with two s).Deployment Type = StandaloneBut by default, Redis uses mutual TLS and requires clients to authenticate with a valid certificate. How can I tell the Redis Function (on Cribl side) what Certs to use? Or if I set up a new one under 'Group Settings > Security > Certificates' is there a way to kind of make the Redis Function aware of using a specific cert?How does it TLS work with Redis?Best Mario

Hi All,using HEC Input I set meta data fields like index, sourcetype, and so on. Can I filter them in a custom Event Breaker Ruleset?So basically the question is, what is applied first, the Event Breaker Ruleset or Fields?Cheers, Mario

I configured the PALO pack and it's awesome. I have the data going out via HEC. Am I right to assume since Cribl is doing all the hard work, I can remove the palo TA from the indexers? I assume I'd still want it on the search heads

hi all,Looking for some advice to parse FW events coming in from Azure EventHub. I have the feed working, but not having any success parsing the data. I tried running it thru a pipeline using parser, but it's not working. Here's what it looks like coming in:Any suggestions?