Skip to main content

Popular articles

Load Balancer Example Configurations for Syslog

This document provides configuration examples and reference links for setting up third-party load balancers with Cribl Stream syslog deployments. Load...

REST Collector - Salesforce Records and Events Log Files

Acknowledgements: Many thanks to Tomás García Hidalgo and Roberto Moreda for their creation and contribution of this collector!Salesforce provides an ...

Linux auditd Logging with Cribl Edge

This article covers how to read auditd logs on a Linux machine with Cribl Edge. Prerequisites Needed:Root access to a Linux machine with Edge installe...

Latest Articles

Windows: Cribl Binaries Default to localhost When Leader/Outpost Settings Are Not Found

SymptomWhen you run a Cribl CLI command manually on Windows, it might not use the configuration stored in C:\ProgramData\Cribl. As a result, commands...

Cribl Search Parquet Code 117 Errors from Mixed JSON and String Fields

SymptomCribl Search returns a query_execution_error when querying Parquet files written by Cribl Stream from Office 365 Activity data. The error inclu...

Cribl.Cloud Destinations Page Shows an endsWith JavaScript Error

SymptomWhen you navigate to the Destinations page in Cribl.Cloud, the page fails to load and displays:Cannot read properties of undefined (reading 'en...

Tutorial

How to Investigate Delayed Events in Cribl Stream

ObjectiveIdentify whether delayed events originate in the downstream system, Cribl Stream Destination, Cribl Stream Source, or sending application.Env...

Tutorial

How do I avoid having a plaintext password in .git/config with Cribl Stream?

ObjectiveConfigure a Cribl Stream remote Git repository without storing a plaintext password in .git/config.EnvironmentCribl Stream Leader On-premises...

Cribl Search Users Cannot Access Datasets Shared with a Team

SymptomIn Cribl Search, users added to a Usage Group cannot access a Dataset shared with a Team. Existing Team members can access the Dataset, while n...

F.A.Q.

Why does Cribl Stream File Monitor attempt to open excluded directories?

QuestionWhy does Cribl Stream File Monitor attempt to open unrelated subdirectory when Filename allowlist targets a file (e.g. /var/log) in the direct...

Cribl Stream HEC Pipeline for Double-Encoded JSON Arrays

SymptomCribl Stream receives an HEC event whose body field contains a JSON array encoded as a string. The array is not available for direct unrolling....

Cribl Stream WEF Event 4688 CommandLine Is Missing After Migration

SymptomWindows Security Event 4688 records arrive through a Cribl WEF Source, but the CommandLine field is null or absent for some events or endpoints...

Kafka Bootstrap Succeeds but Broker Fetch Fails with SASL Kerberos in Cribl Stream

SymptomA Cribl Kafka Source connects to the bootstrap endpoint, joins the consumer group, and receives a partition assignment, but Events In remains a...

F.A.Q.

Does an Empty Kafka Partition Assignment Indicate an Ingestion Outage with Cribl Stream?

QuestionDoes an empty Kafka or Event Hubs partition assignment mean that the Cribl Source is unhealthy or losing data?EnvironmentCribl Stream Kafka or...

SNMP Trap OID Is Not Translated by the Varbind Translation Pack with Cribl Stream or Cribl Edge

SymptomAn SNMP trap arrives in Cribl, but its notification OID remains numeric instead of being translated to a trap name or expected fields. Other st...

Terms & ConditionsAccessibility statement