Skip to main content

Products

Get answers, share tips, and explore best practices across the entire Cribl product suite.

  • 762 Topics
  • 0 Replies
762 Topics
V
VenkatNew Participant
asked in General
Query on SIEM parsing

Hi All,We are managing Crowdstrike NGSIEM  in our network and all the data sources are routed to Cribil and from Cribil , we are forwarding the logs to NGSIEM. Data source → Cribil →  NGSIEM I understand , we require parsers in NGSIEM to read the relevent logs received from the  datasources but I wish to know ,is there any parser concept present in cribil to onboard the logs from the different datasources.    

40
V
Louise Tang
Louise TangKnown Participant
asked in General
How do I create a REST API Collector that needs to reference a dynamic bearer token?

This is an example of how we can reference a value provided by Discover Type HTTP Request in the REST API Collector which will correctly save a bearer token value which will expire (default time 5 minutes) using a named Token attribute: token, Authorization header `Bearer $(token)` and Authentication expression `Bearer $(token)` The initial authorization request:curl -X POST 'http://localhost:9000/api/v1/auth/login' -H "Content-Type: application/json" -d '{ "username": "admin", "password": "<password value here>" }' Run a Discover request to generate a bearer token: The above request will return a value something like: {"token":"abcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKEN","forcePasswordChange":false} The Collect layer will use the information pulled during discover to pull the following: The Encode operation is not necessary but provided for illustration purposes.‘ite

241
Louise Tang
N
nada28.7.1996@gmail.comNew Participant
asked in Stream
enrich data with API

hello,i need options on how to enrich data coming from zabbix as a source on cribl stream before it reaches the destination by API or Http requestthe data is on database i need to call the database by API to fetch the data using fields in the data payload from zabbix and enrich the data received from zabbix then forward it to destinationnote : i want to get the data on fly and the API call will use attributed from the data payload this is the URL that i want to use and will take the massagegroup and the application value from the data payload to call the needed data to be enrichedhttp://IP:25050/3i_service.php?MESSAGEGROUP=X&APPLIKATION=Yi tried by code on the pipeline to do httprequest but it didn't work

130
N
J
jaycriblNew Participant
asked in Stream
Is there a list of links for cribl upgrade files?

Had a situation where the automatic upgrade was not working, so had to manually upgrade.From the logs it was trying to download ARM version not X64 version.Fortunately managed to figure out the correct weblink by changing the file name slightly: https://cdn.cribl.io/dl/4.10.1/cribl-4.10.1-45136dbb-linux-x64.tgz.Are these links listed anywhere on the cribl website, or how would we manually upgrade?

201
J
J
Jari WeststrateParticipating Frequently
asked in Stream
filter expresion and route order

Hello,I noticed a strange thing maybey anyone can explain.I have 3 syslog sources: syslog:514: ,syslog:51402: and syslog:51403:Three routes for these sources, each with a different pipeline attached. The order off the routes are 514 then 51402 and at last 51403.The filter in de routes are __inputId.startsWith('syslog:514:') &&  __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51402:') && __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51403:')&&  __srcIpPort.includes('10.10.1.112')(same host with different syslog outputs)In this order the 514 port gets a load off events, the 51402 lesser and teh 51403 nothing. That surpised me because when a check the source side i can capture 51403 events from this sourceip.For test i moved the 514 route after the 51403 route. Just a feeling. but what??.. the 51403 gets suddenly l the events it was missing. And here it gets strange. Just as if the 514 filter takes al the events from the 51403. But

106
J
A
Arnold JohnsonNew Participant
asked in Stream
Bootstrap worker from cribl cloud leader UI access

HiI setup a worker node on premise by running the script captured from cribl leader cloud. I enabled UI access for worker node. I can open the link in browser but what will be the credentials for it ?Thanks

52
A
A
a.pietersen@eremote.nlParticipating Frequently
asked in General
Cribl Edge (standalone): Windows Metrics - Splunk, do not result in actionable information

I am new with Cribl.Cribl Edge (standalone, installed on Windows 10 laptop for test/evaluation): Windows Metrics do not return actionable information when forwarding to a standalone Splunk Enterprise instance. What am I doing wrong or what I am missing here?Windows Eventlog cribl-source is correctly received in json. But adding the Windows Metrics cribl-source to the same (working) Splunk Destination (default forwarding to port 9997) it shows:All relevant metric_names seems to be received correctly, but no Values to find. Besides, do not understand the metric_type "g". I would expect a value-field in bytesI have tried many things sofar, including Cloud Stream, searching in the docs and and start some basic first lessons on Cribl Universty. Neither an overall and understandable Google search explanation about type g. Stuck now!Does somebody has a clue, suggestion, tip or direction to search in other sources?ThanksAshleyP

84
A
P
Prabhat SharmaNew Participant
asked in General
Best way to send logs from Cribl to OpenObserve

I am trying to send logs from cribl to OpenObserve.OpenObserve accepts data in a JSON array format.e.g.[ { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }, { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }]What is the best way to do this?

51
J
A
Angelo Michele PizziNew Participant
asked in Stream
Distributed deployment planning with compressing g-zip Destination?

Hello everyone,I have the following problem. I'm designing a distributed deployment. I have to create an environment for data reduction but before that I need to send the data to a blob storage, for compliance reason, as you can imagine. Now, all of these is achieved but I have some doubts. When I use the Azure blob storage as only destination, all the 100% of the data goes in there but, the Monitoring Page, is telling me that the data that comes in are the same as the data that goes out (sometimes, the data that goes out are even more), even with compression enable. As said, I have the g-zip compression enabled on the Azure Destination page. I've checked the storage and I found out that the data are really compressed. So, my point is the following: when I try to estimates the possible number of workers and their capabilities, should I trust the monitoring page and consider DATA IN = DATA OUT (since the data is not processed by any pipeline at all) or I can consider the quantity of byt

13
J
J
jbos@svb.nlNew Participant
asked in Edge
Updating Windows Agents Through the UI

Hi,We are currently working on updating our Cribl Edge Agents. While our Linux agents successfully auto-update through the UI, we are encountering issues with our Windows agents. Specifically, the Windows agents display an error during the download process and fail to update.Manual updates are possible by logging into the system and running the update script; however, the UI-based update consistently fails. We have confirmed that port 4200 is open, and there are no indications of blocked or dropped traffic. Additionally, all platform-specific packages, including the corresponding hash files, have been prepared and placed in the appropriate Cribl temporary directory.Given these conditions, what could be causing this issue?

71
J
S
Somnath BhattacharyaNew Participant
asked in Stream
Unable to perform Destination test with Splunk HEC

I am new to cribl and trying to setup Splunk HEC destination from cribl sanbox stream instance. I have provisioned a free splunk cloud instance and setup HEC. While I can send data via: curl -k "https://<host>:8088/services/collector" -H "Authorization: Splunk 38aa4a38-8fd5-4faa-afc4-9b3533ac39c7" -d "{"event": "Hello, world!", "sourcetype": "manual"}"I am unable to run destination test from cribl with the exact endpoint or with /services/collector/event. Everytime the request time out with error:2025-02-20T14:23:57.956αtime:2025-02-20T14:23:57.956Zαcid:w0αchannel:output:splunkαlevel:errorαmessage:error while flushingαioName:splunk_hecαioType:destination{}error:αmessage:request timeoutαstack:Error: request timeout at /opt/cribl/bin/cribl.js:15:9721630 at new Promise (<anonymous>) at p.doHttpRequest (/opt/cribl/bin/cribl.js:15:9721585) at runNextTicks (node:internal/process/task_queues:60:5) at process.processTimers (node:internal/timers:509:9) at async p.buildRecProm

71
J
A
Ashley PietersenNew Participant
asked in General
Yesterday started Cribl-Cloud (stream), now my Splunk License is chocking with data from it

Hi Anyone/supportYesterday, started Cribl-Cloud (stream), just for testing, now my Splunk License is chocking with data from it Crible Cloud :-(.Tried to delete all things I could delelte, still chocking my Splunk license. Deactivating my subscriiption says: We're sorry to see you go!We are processing the cancellation of your Cribl.Cloud organization. This process takes up to 30 days and you will get an email 7 days before the cancellation is final. If you didn't mean to cancel or having second thoughts, contact support@cribl.io.How can I interrupt this data-stream. I had to stop my Splunk Enterprise instance for this…Hope someone can help out.Ashley Pietersen

35
A
S
Steve BennettParticipating Frequently
asked in Stream
Full Read of S3 Bucket for only new items

I am trying to pull in DNS Logs from Cisco Umbrella. I have my S3 Connector configured to pull down the logs every 5 minutes. The problem is that it pulls down all the logs. I only want the new logs. I have tried adding the follow to my Conf section of the JSON configuration but it doesn't appear to work."trackProgress": true,      "trackMode": "file",      "trackField": "s3.object.etag",      "useLastModifiedTime": true

114
S
J
jaycriblNew Participant
asked in Stream
Having hard luck with parsing logs - tips?

Hi, I have gone through the cribl university user and admin courses and setting up the product is quite easy however am constantly stuck trying to parse or extract strings of data into fields so that we can search or use the information.For systems which send in JSON or CSV it is very simple, however most of ours are embedded Linux or network devices which give something like the following:<183> 02/06/2025:00:24:20 GMT NYDC1VPX01-DMZ 0-PPE-0 : default SSLLOG SSL_HANDSHAKE_SUCCESS 9838002 0 : SPCBId 33168208 - ClientIP 10.1.1.130 - ClientPort 57486 - VserverServiceIP 10.200.80.80 - VserverServicePort 443 - ClientVersion TLSv1.2 - CipherSuite "TLS1-AES-256-CBC-SHA" - Session New - HandshakeTime 47 msShowWhat combination of functions can split this out into fields such as hostname, clientip, clientport, etc.I have tried using ChatGPT to help and can get regex and grok expressions from the AI however these don't work when applying to cribl. I don't see many questions on this topic

24
J
K
kiran kNew Participant
asked in Stream
Crowdstream - Bytes out size doubled

Hi EveryoneWe have integrated Azure Storage Account and Azure Application Gateway with CrowdStream (Cribl Stream) via EventHub. Since logs are in nested JSON format, we used unroll function to convert them into individual events before forwarding them to CrowdStrike NGSIEM.Currently, we are observing that Bytes Out size is twice that of Bytes In. While we understand that event count should double, our concern is why Bytes Out size is also doubling compared to Bytes In. Additionally, we have not observed any duplicate events in CrowdStrike NGSIEM.

29
J
O
openwebspaceNew Participant
asked in General
Updating a lookup table with a pipeline function

I read that Cribl has the ability to update lookup tables using REST API and with a search string, but I'm looking for a way to do it during the processing stage. Is this possible? I see a Redis function and read something about that. If the values go there, is there a way to automatically lookup the results?

22
O
A
Arnold JohnsonNew Participant
asked in Stream
Cribl License

Hi everyoneI have different locations which need to have separate cribl stream installed on each location .. Which means standalone deployment. In this case how the license will be deployed .. Will it have separate enterprise license applied to each Cribl instance ?

262
A
A
Arnold JohnsonNew Participant
asked in Stream
Cribl leader and worker node on same VM

I have installed cribl standalone on a VM , but need to change it to leader ..Do I need a worker node or only a leader can do the processing work as a stream ?If worker node is required, can the same VM be a leader and worked node together ?

103
J
R
RexNew Participant
asked in Stream
Having difficulty translating API header to Cribl

Hello,I'm new to Cribl stream and am having difficulty translating the API spec from the documentation. I can get all the curls working fine, but I don't know how they translate to cribl. For example, if I'm trying to use cribl for this type of curl:curl --location --request GET 'https://public-api.cloud.meater.com/v1/devices' \--header 'Authorization: Bearer <JWT>'What would my discover and collect headers look like to include the "Authorization: Bearer <JWT>?Cribl is authenticating correctly (I managed to figure that out), but all my requests result in a 400. My authorize expression is `Bearer ${token}`Any help/insight would be greatly appreciated.

03
J
S
Steve BennettParticipating Frequently
asked in General
Creating New Fields from _raw

I want to create new fields from values in _raw. See below. I want to create a series of folders based off the year, month, date and hour. 2025 (parent folder) - 01(subfolder) - 12(sub under 01) - 23(subfolder under 12)._raw:"2025-01-12 23:59:56","Another Value","Dummy Data","","Something Really Cool"I'm using Regex Extraction and I can see the selection in the preview as Group 1, Group 2, etc.However, I can not convert these into individual fields. Any suggestions?

2011
J
J
jaycriblNew Participant
asked in Stream
Find which worker node processed an event

Hi,Is there a way to find out which worker node processed an event, does it inject a field or can we configure it?Reason is we have some issues and this could narrow it down to a particular worker node.Cheers,Jay

81
H
H
HT GoatKnown Participant
asked in General
Secure Communication between CriblCloud Leader node and Hybrid Worker/ Edge nodes !!!

Hi,I would like to secure the communication between the Cribl managed Leader node and the Hybrid Workers and edge nodes currently located on Prem . I understand that the communication between the Leader node and Hybrid Workers / Edge nodes is already encrypted ( port 443 ) . How are those entities being currently authenticated ? I can also see that the recommendation is to implement mutual authentication but not sure about the best way to go about it ?Any advice would be be very much appreciated .Thank You

02
H
S
Sai Lalith kumar T N VNew Participant
asked in General
Is there a way to Get Cribl Cloud leader's Internal/metrics logs to our Splunk

We are having Hybrid Cribl Cloud Setup where leader resides in Cloud. Is there a way to Get Cribl Cloud leader's Internal/metrics logs to our Splunk

51
D
A
Allen McLeodNew Participant
asked in Stream
A working example of a script in Stream - Help me keep track of my goats

I am attempting to record which server logs are being collected, e.g. last seen, and I haven't found that capability yet. I am thinking I need something custom, maybe write to a file or a lookup. The cribl documentation doesn't provide much in the way of specifics when it comes to implementing scripts, except an ominous warning. I am new to the product and any help is greatly appreciated.

31
D
P
Pawel KwiatkowskiInspiring
asked in Stream
Redis. How to use a Redis query in a code function?

I would like define a Readis connection at the beginning of pipeline and reuse by a code functions through all an event live-time.Something like "C.Lookup" expression.PS: A Redis function is not applicable for my needs :).

13
B

Badge winners

Show all badges
Terms & ConditionsCookie settings