Skip to main content

General

Can't find what you're looking for? Ask it here!

  • 423 Topics
  • 2,585 Replies
423 Topics
K
kpimentelParticipating Frequently
asked in General
Passing the message field in JSON to Splunk

I'm having trouble getting the JSON under the "message" field recognized in splunk. Is there something simple I'm missing on the Cribl side of things to break this json out of message, or only keep the JSON in the message as the event?

015
K
Q
Quinn StevensonKnown Participant
asked in General
How can I access the name of the Cribl Group in a pipeline?

How can I access the name of the Cribl Group in a pipeline? I'd like to use that value in a field

010
D
P
Paul DottKnown Participant
asked in General
What happens with retention setting in Splunk with timestamp from Replay?

:question: on S3 Replay -> Splunk. Is it necessary for the destination Splunk Index to have retention settings that honor the timestamps of the replayed data? For example, If my index 'proxy-logs' has a retention of 180 days, and I replay data into it with timestamps that is > 200 days, I presume that data would be immediately evicted/frozen by Splunk?

05
D
K
Kevin MorrisInspiring
asked in General
What happens during a restart and is the restart done in a rolling fashion?

I'm reading https://docs.cribl.io/stream/configuration-files#section-configurations-and-restart and can't seem to figure out much on what happens during a reload. Is it done in a rolling fashion and if a reload does interrupt data flow?

04
B
J
Jon RustEmployee
asked in General
How do you get the workers to send metrics (like CPU usage, etc.) to Splunk?

Noob question here... How do you get the workers to send metrics (like CPU usage, etc.) to Splunk? We have the Leader sending cribl metrics, but not the workers.

021
J
H
hgoolyaKnown Participant
asked in General
How can we get cribl to keep the time within the log?

How can we get cribl to keep the time within the log?

037
H
K
Kevin MorrisInspiring
asked in General
Is there a way to add a field from a REST Collector’s `Discover` phase to the collection results?

Is there a way to add a field from a REST Collector's `Discover` phase to the collection results? My Discover has metadata that I'd like to use to enrich the child records.

010
K
N
nicktankKnown Participant
asked in General
Is Cribl Search functionality available for on prem Cribl deployment?

Is Cribl Search functionality available for on prem Cribl deployment? If so, under what license?

03
C
J
Jaime SanchezKnown Participant
asked in General
Trying to a SED like search and replace?

[SOLVED] Hello, I have a few events which contain a raw field with multiple [ ]'s. I'd like to replace all occurances with " ". I tried in a Eval function: _raw=_raw.replace(/[]+/, " "). This works for the first occurance, but not the others. I also tried with replaceAll, but that just crossed out the entire field. Is there a simple way to just do a SED like search and replace?

017
J
L
LovetheBeachKnown Participant
asked in General
Deleting what is matched in REGEX

If I'm using the Mask function, and I've crafted a "Match Regex" to target what I want removed (not replaced), what is the "Replace Expression" to use to just delete it?(I want to delete what I've matched via regex)

05
J
C
Catlin CarterNew Participant
asked in General
Notifications are through on messages and not notifications

I'm sure I am doing something silly, but I have setup notifications for some of my sources and see them come through on the "messages" drop-down on the leader (the little bell icon). However, I am not seeing them when I look in monitoring under notifications. Any ideas?

04
C
S
Steve BridgeKnown Participant
asked in General
Passing data to another host with no extra meta data

Hello all. I feel this should be simple, but not working for me. I receive lots of different data types on one port. For one particular type, I want to just forward it on, completely untouched, to a different host on a different port as JSON. I am using the TCP JSON output. The issue is, Cribl is setting the metadata and parsing fields, such as _raw. I don't want any parsing, no fields, no metadata- just the raw data. I must be missing something? Thanks in advance for any suggestions.

035
J
S
Shawn CannonKnown Participant
asked in General
Anyone every pulled in events from Box?

Anyone every pulled in events from Box? We use the Box add on for Splunk today and have started having some issues with it. Pretty sure it is API based.

08
S
C
Cam BorgalParticipating Frequently
asked in General
Way to recreate 30 pipelines for different business unit

So, I need to recreate 30 pipelines for a different business unit that goes to a different Splunk index... what's the fastest way to do that? Or is it just a tedious export/rename/import sequence I have to follow? :see_no_evil:

029
X
L
Louise TangInspiring
asked in General
Wondering if it's at all possible to do a lookup with multiple match criteria?

Hi Team,Wondering if it's at all possible to do a lookup with multiple match criteria?Currently I am looking up the "index" value from a lookup.csv file based on matching hostname regex, which works fine as expected.But some customer index routing decisions need to match both hostname and appname (tag). So the logic would be something like:If hostname regex matches this pattern AND appname regex matches this pattern, take this index value as "index" field.I suspect this isn't possible with a lookup function... any ideas apart from many eval statements for each case?

06
L
A
Andrew DucaNew Participant
asked in General
Storing Windows Event Logs in XML with each event in a single file

Hi everyone.I need some help please. I have a requirement from the vendor Hunters where I need save Windows Event Logs in S3 in XML format, but it is mandatory one event per file. Is it possible configure this in Cribl?

04
A
S
saurabh.guptaKnown Participant
asked in General
Why is passthrough reducing events?

trying to understand passthrough, not sure why its reducing events.

010
S
M
Mike DupuisParticipating Frequently
asked in General
Using regex to extract fields

Hello everyone, qq, I am trying to get a regex extract field extractions from _raw, the regex seems to be fine, but somehow I cant get the field to show up as an extracted field. Im using a capturing group to do this.. any ideas

04
M
E
Eric ReuscheKnown Participant
asked in General
How to parse a JSON object?

I have a JSON object that I'm trying to pull apart using the parser function but it's as if the parser doesn't see it as a json object. I put it into other JSON extraction tools and it works but not in Cribl. It should just be a standard "Extract JSON Object from _raw"

114
J
P
Paul DottKnown Participant
asked in General
How are you handling token persistence?

I imagine a lot of people are using the Splunk Load Balanced destination with indexer discovery. How are you handling token persistence? We patch/recycle our Cluster Master monthly so looking for a method to "restore" the tokens without impacting data delivery.I believe tokens are stored in the kvstore, $SPLUNK_HOME/etc/passwd and $SPLUNK_HOME/auth/splunk.secret files.

030
R
T
Tomer ShvueliKnown Participant
asked in General
Does anyone know how to create a Webhook endpoint on Cribl?

Hello all,I have a case whereby data is sent using webhook to Cribl. Does anyone know how to create a Webhook endpoint on Cribl? Perhaps point me in the right direction?I also need to decode the data being sent but I would like to start with creating the endpoint.Thank you,Marc

02
T
N
Nick Kwiecien Nick KwiecienKnown Participant
asked in General
Looking for recommendations for a good services/processes config for a 1000+ edge node deployment?

Can anyone here recommend a good services/processes config for a 1000+ edge node deployment? We are running into an issue where edge nodes are pegging at 100% CPU after updating cribl to 4.0.3. I wonder if our leader is overwhelmed with requests from all of our edge nodes and if our leader configs could use some tweaks. We are running pretty beefy leader/worker nodes so CPU and memory are not an issue, I am wondering if its more of an IOPS thing. Thoughts?

02
B
R
Raanan DaganEmployee
asked in General
Looking for insight on the *Time Range* selection when running against an Amazon S3 bucket

Hi Cribl community. Could anyone provide some additional insight on the Time Range selection when running against an Amazon S3 bucket? The S3 bucket is full of .gz csv logs which are updated periodically (8 files per 10 minute period). See attached.Beginner's naivety suggested that setting a Relative time (-30m as an example) would only pull files in S3 last updated within that relative time. However, it pulls all files as if I had not set a time filter at all.Another thought is that this time range does not apply to the files themselves, but to the EVENT times contained within the files. In that case, Cribl would need to pull all files before it could filter on event time? https://docs.cribl.io/stream/collectors-schedule-runThank you!(as an alternative, we could use the Amazon S3 specific collector which uses event notifications/SQS, but would like to at least understand the above)

017
R
J
Jim ApgerParticipating Frequently
asked in General
Looking to enrich my data by doing a reverse ip lookup and setting that as the source

Hello, total noob looking for some help. I installed edge/stream on Rocky 8. It is running, but I am having trouble figuring out how to manipulate data in a source.The source is syslogng, destination is splunk. I want to take the data from the source, do a reverse lookup of the IP that sent the data, then replace the system name or add a field with the result from the reverse lookup.The reasoning behind this is that the syslog senders are part of a virtualization cluster, but each cluster re-uses the name(s) "node(X)" internally, so within splunk there's duplicate entries from each cluster. A reverse lookup should give us unique names for splunk

018
S
A
Anson VanDorenInspiring
asked in General
What are the steps to backup an old Cribl instane?

Question - can I backup an old cribl by1. stop the service2. cp -a /opt/cribl /opt/cribl_backup3. ?

01
A

Badge winners

Show all badges
Terms & ConditionsCookie settings