Skip to main content

Popular articles

Load Balancer Example Configurations for Syslog

This document provides configuration examples and reference links for setting up third-party load balancers with Cribl Stream syslog deployments. Load...

REST Collector - Salesforce Records and Events Log Files

Acknowledgements: Many thanks to Tomás García Hidalgo and Roberto Moreda for their creation and contribution of this collector!Salesforce provides an ...

Linux auditd Logging with Cribl Edge

This article covers how to read auditd logs on a Linux machine with Cribl Edge. Prerequisites Needed:Root access to a Linux machine with Edge installe...

Latest Articles

Retrieving the UUID for Your Azure VM

Your Cribl login password is the UUID of the Azure VM. There are three ways to retrieve it, depending on your access.## Method 1 — From inside the VM...

The 2026 Guide to Advanced Cribl Deployments

This is an article to outline the highest standards of a Cribl deployment and to aid administrators and architects in building it. These recommendatio...

Cribl Search Federated v1 Queries Fail When summarize Has Very High Cardinality

SymptomA Search query that uses summarize ... by across too many unique values can fail on federated v1 datasets because the coordinator must hold a v...

Handling Cisco ISE Repeated Step Fields in Splunk and Cribl Stream

SymptomWhen sending Cisco ISE syslog events that contain multiple Step= fields within a single event, only a single Step value is retained. The remain...

Cribl Stream Route Filter Using host.includes Stops Matching After Hostname Case Change

SymptomA Cribl Stream Route that uses a JavaScript filter similar to host.includes('LI1SOINDC01') suddenly stops matching events after an upgrade to C...

Splunk Universal Forwarder Fails to Connect to Cribl Cloud Splunk TCP with sslVerifyServerCert Enabled

SymptomSplunk Universal Forwarder cannot connect to a Cribl Cloud Splunk TCP endpoint when sslVerifyServerCert = true is enabled, logging TLS client i...

Cribl Stream Ingestion Issues with Azure Event Hubs After Cribl Cloud Upgrade

SymptomIngestion from Azure Event Hubs in Cribl Stream stops after a Cribl Cloud upgrade or other worker rollout. You may see errors similar to: SASL...

Meet Apps: Custom Tools You Build Right Inside Cribl

An App is a standalone web application that you create in Cribl and that runs right inside the Cribl UI. It takes a workflow that normally means too m...

Persistent Queue Does Not Drain When Ingesting UDP Syslog with Cribl Stream

SymptomPersistent Queue (PQ) on one or more worker nodes is not draining efficiently after upgrading Cribl Stream. One worker process accumulates sign...

Enable Customer-Managed Keys (CMK) for Cribl Lake Azure Storage Locations

OverviewBy default, the storage account created for your Cribl Lake Azure Storage Location encrypts all data at rest with Microsoft-managed keys. If y...

Do I need 1 vCPU and 2GB RAM per Cribl Edge fleet on the Leader?

QuestionDoes Cribl Edge require 1 vCPU and 2 GB RAM per fleet on the Leader? For example, do eight Edge fleets require eight vCPUs and 16 GB RAM on th...

Persistent Pending Commit on GitOps Prod Leader Caused by Cribl Self-Healing .gitignore on Service Restart

SymptomAfter merging a .gitignore change from a dev branch to the prod branch and performing a POST /version/sync on the Prod Leader, a persistent "Pe...

Terms & ConditionsAccessibility statement