Products

Hello. Is there a prebuilt pipeline for AWS S3 Access logs?

Hey all,Hope all is well. I have a Cribl distributed deployment environment and every morning when I log into the Cribl leader, I get the following error. I then have to go restart the Cribl leader, does anyone know what the fix for this is?

Hello all, I was wondering how is Cribl implementing OCSF mappings?

hello All, As a cribl beginner, I am looking for resources/guide to achieve below ---I am trying to place Cribl between splunk UF and indexer with TLS encryption enabled.Any pointers/lead/direction will be highly appreciated. more details in thread below...

Hi, I have two questions,The first question, is there an expression available in Cribl to generate a random GUID? The second question, is there an expression that will generate a date in this format `Tue, 24 Nov 2023 12:50:11 UTC`

I'm sending JSON data to Splunk from cribl (Cloudflare logs) and it causes the data to be a horrendous .30:1 index size to raw size ratio I'm sending _raw as text. There are no props for that sourcetype on the indexer side so there is no indexed extractions. Any help appreciated

hey folks, can we use python as a script collector or do I have to write some bash to run some python?

Hello all,I need some help please. I have some data in _raw.body, and I'd like to extract the them into json objects together with the other _raw.items (such as _raw.ctupdate)I'd also like to rename some of the fields. Any suggestions?

Good morning,I'm trying to remove some key/values with null values in a tcpjson event w/ the parser function. I noticed that having Source field equal to _raw doesn't access the JSON parsed log data. What would the Source field be for a json parsed event?

Where do I find the backpressure graphs? I normally stumble-into them but not having luck this am....

Hey everyone, has anyone helped integrate InsightVM Rapid7 security alerts via a postgre database connection or through another way?

Elasticsearch output question. How can I get the default `@timestamp`; on elastic output? It seems like `_time` should be automatically be renamed to `@timestamp`; .

Does Edge have any local application debug / error logs? Dug through the install directory and nothing seemed to jump out as an obvious log file.

Hello everyone,Quick question please.I would like to start sending data directly from Cribl to SnowFlake, but after reading the documentation looks like there is no any out-of-the-box solution for this.Am I missing something? Is send the data to s3 to SnowFlake read it the only possibility?

I have some JSON that I've extracted via a parser function, manipulated/renamed some fields, and now I have an element of an array that is null. Can anyone point me in the right direction on how I might clean up the null? For reference, my end destination is a GCP storage bucket, so I'm just writing the data out as a raw JSON string.It seems I can serialize the fields back into _raw (which cleans up the null array element), and then extract again, and then remove _raw, but that feels like it is potentially inefficient, 3 step process. Is there a better way to accomplish this?

Good afternoon Cribl people! I'm trying to find the best way to serialize to a delimiter, while removing the risk of having that delimited in a string value.If we serialized to JSON, string data types are put in quotes, and integers aren't. We're trying to do the same for delimited format (e.g., CSV) - encase strings in quotes, and not integers. We believe this will help Splunk parse, because it's expects a string when it reads a double quote.

Hey, sorry for all the messages asks but curious here:Does Cribl provide functionality to compute a network flow hash according to the Community ID Flow Hash specification for given fields and provide the output to a new field? https://www.elastic.co/guide/en/beats/filebeat/current/community-id.html

We're seeing a lot of these 500 errors to our HEC endpoint from Stream. And customers are reporting receiving 503 status codes. Would this be a max active requests settings issue? Maybe something else?

What's the best way to do an if statement for status codes. Like is status=400, a new field is made statusCode = "Bad Request"

Is Cribl search available for on-prem yet?

Hi All,using Redis I like to secure the connection.What I figured is, that I need to use `rediss://[[user][:password@]][host][:port]` instead of `redis:]//[[user][:password@]][host][:port]` (rediss with two s).Deployment Type = StandaloneBut by default, Redis uses mutual TLS and requires clients to authenticate with a valid certificate. How can I tell the Redis Function (on Cribl side) what Certs to use? Or if I set up a new one under 'Group Settings > Security > Certificates' is there a way to kind of make the Redis Function aware of using a specific cert?How does it TLS work with Redis?Best Mario

Hi All,using HEC Input I set meta data fields like index, sourcetype, and so on. Can I filter them in a custom Event Breaker Ruleset?So basically the question is, what is applied first, the Event Breaker Ruleset or Fields?Cheers, Mario

I configured the PALO pack and it's awesome. I have the data going out via HEC. Am I right to assume since Cribl is doing all the hard work, I can remove the palo TA from the indexers? I assume I'd still want it on the search heads

hi all,Looking for some advice to parse FW events coming in from Azure EventHub. I have the feed working, but not having any success parsing the data. I tried running it thru a pipeline using parser, but it's not working. Here's what it looks like coming in:Any suggestions?

Does anyone knows, if Cribl can handle the Splunks functionality of assigning default fields dynamicaly withe the folowing line in the logs: `SPLUNK <metadata field>=<string> <metadata field>=<string> ...` https://docs.splunk.com/Documentation/Splunk/latest/Data/Assignmetadatatoeventsdynamically. If not I would go with a 2 step linebreaking process