Products

Every time we update openshift in azure, my cribl config is lost. since we have the free version, we cannot use git repository. would using persistent storage helps keep the config because the update process drains the node from the cluster and restart them on another node. I suspect this is why the config is not kept.

Is it possible to install cribl stream and use node-oracledb in thick mode or there is no way to let cribl stream know that there is an oracle instant client package installed available in the podman container? thanks

An export of code is done to a json fromat only while on servers is used a yml fromat.IMHO, it should be possible to do import/export also in yml format. :)

Does Cribl have any documentation for pulling Workday report logs?

Hi,I am facing an issue while using a REST API source (Cohesity audit logs).The API returns a valid JSON response in this format:However, in Cribl preview/capture, the data is not coming as a single complete JSON object. Instead:One event contains the correct full JSON Other events are split fragments (starting mid-string, not valid JSON)Example behavior:Event 1 → valid JSON object ({"auditLogs": [...]}) Event 2+ → partial JSON fragments (missing opening {, starting inside fields)Because of this:JSON.parse(_raw) fails or behaves inconsistently JSON Unroll cannot work reliably Derived fields (e.g., TimeGenerated) are null Parsing becomes impossible for many eventsObservations:cribl_breaker shows OData JSON:single-object Sometimes fallback behavior is applied Custom event breaker with JSON Array also did not produce consistent results Pipeline-level filtering/parsing only works partially because upstream data is already fragmentedQuestionHow can we ensure that the REST API response is tr

In a Cribl source could be added fields https://docs.cribl.io/stream/sources-tcp-raw#fields.So just wondering if such option could be possible also in destinations.PS: yes, I know I can use post-processing pipelines.

I'm getting 400 responses on a POST Body that I'm trying to pass through the state.latestTime within the POST body. I would like to know what is being posted.I don't seem to be able to get a debug log out of my REST Collector to see what it is POSTing. What it's deriving from state.latestTime.Anyone know where I can find this? The debug logs seem to only show the URL, not the POST Body

Hi all i am having issue parsing nested Json the event goes like {  "records": [    {      "time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}{"time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}  ],  "_time": 1766078828.252,  "index": "index",  "sourcetype": "sourcetype",  "source": "source"}so basically, records field have multiple Json event Nested in it  i want to extract to individual events with parent fields like metadata carried to each right now when i use event breaker i am getting no change can someone help me  

This message originated from Cribl Community Slack.Click here to view the original link.hello im having issues with JSON Unroll and I'm not sure why it's not working. I've tried everything imaginable path with quotes, without quotes, etc. but it still does not work. total.in_bytes is the name of the array every element of which should be extracted to a field test as a new event. But it is not workingLinks for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.We have 10 workers, do we normally put a load balancer in front of the workers, or the data is being routed straight to the workers?

This message originated from Cribl Community Slack.Click here to view the original link.We set up Cribl TCP destination to send logs to a Cribl TCP source in another Worker Group. We are sending a high-volume source (~1TB/day) and using Always On source persistent queuing. The Cribl TCP destination does not have persistent queuing enabled and is set to drop events when backpressure signals are received from the destination (the Cribl TCP source) as we felt that using PQ on both sides would be redundant and we don't want to place any additional load on the sending Worker Group. However, we are seeing events being dropped at the destination with this configuration, and it looks like the Cribl TCP source is constantly exerting backpressure, even in Always On mode with plenty of disk available to queue logs. Any ideas why this would happen? I would expect the queue disk to fill up for a Worker Process before the source would excerpt backpressure. I read this (https://docs.cribl.io/stream/p

This message originated from Cribl Community Slack.Click here to view the original link.We have a Cribl environment with one leader and ten workers which was designed to ingest 5 TBs of data, but unfortunately, our system is being sunsetted, and at the moment, we are ingesting 340 GBs a day. Management is pushing me to remove Cribl altogether, but I'm thinking that the best way would be to move to the free license of 1 TB with no time constraint. Is there a way to keep the architecture as is, with these 11 VMs, while switching the workers one by one, to the free license. If I manage to move one worker, the pressure will be off my back :sweat_smile:.

This message originated from Cribl Community Slack.Click here to view the original link.What is the best way to determine if a slow pipeline is causing backpressure that is impacting sources? I am most interested in S3/SQS sources like CrowdStrike FDR that appear to stop downloading new messages https://docs.cribl.io/stream/backpressure-impacts-sources/#pull-sources. I checked the Cribl Internal Metrics source but only see destination backpressure metrics https://docs.cribl.io/stream/internal-metrics/.

This message originated from Cribl Community Slack.Click here to view the original link.Good morning everyone, I have maybe a crazy question. Is it possible somehow to delete data in an S3 bucket within Cribl? Like some REST POST on the S3 delete endpoint that runs everyday on the workers and deletes data in the bucket older than 30 days? For some reason, S3 lifecycles are not possible in this situation (don't ask me why..) and it seems the only option is to phase out the data over the API somehow. Thanks for any insight

This message originated from Cribl Community Slack.Click here to view the original link.Running our setup in Cribl.cloud we have a number of sources with IP restrictions setup and they all seemed to break recently cause the cloud egress IP addresses had changed. Is there a notification of these addresses changing expected to be sent out?

This message originated from Cribl Community Slack.Click here to view the original link.I am shipping log data to an OTEL destination and I keep getting a RESOURCE_EXHAUSTED: gprc: received message after decompression larger than max 4194304 I am not really sure what I need to be tuning for this, in my pipeline I have my function set to batch in size of 4096 (see screenshot) and my destination is configured to have a body limit size of 4096 KB (see screenshot) - which should place me under that threshold per batch Has anyone encountered this or like error with an OTEL destination? any tips on what I can check out?Links for this message:image.pngimage.png

This message originated from Cribl Community Slack.Click here to view the original link.Hey all. I'm relatively new to Stream so I might be missing some fundamental knowledge here, but I'm working through some data input consistency... can someone explain why I'm seeing drops in the Stream Home charts, but not when looking at cribl_metrics and total.in_bytes? What drives the Stream Home charts? I had a similar issue where my workers showed 0 free memory and CPU load average for a 90min window (and my route sparklines were flat), yet I have logs for that time period... I need to be sure that I haven't lost data and produce an accurate picture of what happened and why it looked like stuff went offline, or significantly dipped.Links for this message:Screenshot 2026-05-05 at 10.30.47 AM.pngScreenshot 2026-05-05 at 10.30.59 AM.png

This message originated from Cribl Community Slack.Click here to view the original link.IHAC that either wants us to write a data set(specific logs) to disk for an EFTU transfer to pick up from our workers, or for us to send to a windows file share. For the Filesystem destination Need clarification on output location. Not seeing clear details on configuring that in the docs. Does File system just write locally? Does file system write locally then you use file monitor from sources to pick up and send to a location? Is a shared windows folder an available destination? Thank you in advance, this is in PubSec very locked down environment

This message originated from Cribl Community Slack.Click here to view the original link.I have data that gets processed in STREAM that I want to send to LHE. Do I send it to search, destination or do I send it to something like a HEC destination and then plugin the endpoint that’s provided in the search sources?

This message originated from Cribl Community Slack.Click here to view the original link.can cribl search read splunk frozen buckets that I store in my own S3?

This message originated from Cribl Community Slack.Click here to view the original link.I've poked around a bit in the #channel history and didn't find a direct answer to this, so forgive me if I missed it. What is the simplest, most direct way to observe when a node becomes disconnected from the leader, preferably when it has been disconnected for x consecutive minutes? We're ingesting Cribl Stream logs into Splunk. Is this information in those? If not, which server-side logs might contain this information?

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone had their destinations drop off but only for the UI? I had about 8 Cribl TCP destinations drop off the UI but when I open an individual node that is on the current config, I can see all 8 destinations showing as green. Data is still flowing from those nodes too but I can't edit the destinations due to this issue. (empty screenshot is from fleet management, filled one is teleported inside a node in the same fleet, no pending commits)Links for this message:Screenshot 2026-04-28 at 12.05.05 PM.pngimage.png

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone successfully used a lookup file to do Edge node mappings? I might be approaching this the wrong way but trying to move 100+ Edge nodes to a new fleet without having to re-deploy the nodes. Is there a better approach to what I am doing or are the only options: re-dploy edge nodes or use the world's longest mapping filter

I am seeking technical guidance on configuring a Database Collector to connect to a Windows SQL Server using Domain/Windows Authentication from a Linux-based Worker Node.We are currently running Cribl Stream version 4.17.Our Worker Nodes are running on Linux, and we need to authenticate against a remote MSSQL instance using a service account within our Active Directory domain. While standard SQL authentication (local DB users) works as expected, we are looking for the best practice to implement integrated Windows authentication in this cross-platform scenario.

Our current license is at 5 TB quota, and we ingest only 337 GBs/day. In the learning material of Cribl University, I saw a reference to a free license of up to 1 TB without distributed administration to the workers, is it possible for us to move from our current 5 TBs license to a free one?