Lake

This message originated from Cribl Community Slack.Click here to view the original link.Hello team! I’d like to understand the difference between sending only the _raw field to Lake, and sending _raw along with some extracted/parsed fields. I assume it will affect the size of the event, but more importantly, how does it affect the performance in Cribl Search? Additionally, are there any recommendations for using JSON/Parquet data format?

This message originated from Cribl Community Slack.Click here to view the original link.Need some clarificaton regarding Splunk DSS and Cribl lake. The doc says: “In Cribl Lake, deleting a Splunk Cloud Self Storage Source means that you will lose all your Splunk data archived here. Also, Splunk Cloud will no longer be able to write to Cribl Lake through this integration. However, this deletion will not affect your data flow and storage within Splunk Cloud.” Does this mean that if I delete a Splunk Cloud Self Storage connection to Cribl Lake that I’ll lose all capability to communicate with Splunk DSS and Cribl lake - including future ones - or just this individual connection?