Skip to main content
Question

Questions on expressions

  • March 11, 2025
  • 15 replies
  • 22 views

Hi, I have two questions,The first question, is there an expression available in Cribl to generate a random GUID? The second question, is there an expression that will generate a date in this format `Tue, 24 Nov 2023 12:50:11 UTC`

15 replies

David Maislin

David Maislin

Nice work <@U027B0M9FL4&gt;!!!


Can I paste this right into Cribl as a value? I am getting an error with the above expression


Oh I see. It needs to be a global variable


Jon Rust
Forum|alt.badge.img
  • Employee
  • March 11, 2025

you can put it in a Code function (eval won't work)


what If I want to use it as a payload parameter in a collector?


Jon Rust
Forum|alt.badge.img
  • Employee
  • March 11, 2025

that particular implementation wouldn't work


Is there a workaround?


Jon Rust
Forum|alt.badge.img
  • Employee
  • March 11, 2025

depends on how strict/safe you want your GUID creation to be. Easy enough to fudge a GUID-like string using a hash of a datetime string for example


Jon Rust
Forum|alt.badge.img
  • Employee
  • March 11, 2025

`C.Mask.sha1(Date.now())`


Jon Rust
Forum|alt.badge.img
  • Employee
  • March 11, 2025

(trim, format as needed)


Jon Rust
Forum|alt.badge.img
  • Employee
  • March 11, 2025

2nd ask`C.Time.strftime(Date.now()/1000,"%a, %d %b %Y %H:%M:%S UTC",true)`


Thanks for your help Jon!


I'm trying to set up collectors for mimecast it requires a lot of steps if I were to do it in Cribl. Would you suggest I just do this Something like Lambda and pull them in via S3?