Products

I have a JSON object that I'm trying to pull apart using the parser function but it's as if the parser doesn't see it as a json object. I put it into other JSON extraction tools and it works but not in Cribl. It should just be a standard "Extract JSON Object from _raw"

I imagine a lot of people are using the Splunk Load Balanced destination with indexer discovery. How are you handling token persistence? We patch/recycle our Cluster Master monthly so looking for a method to "restore" the tokens without impacting data delivery.I believe tokens are stored in the kvstore, $SPLUNK_HOME/etc/passwd and $SPLUNK_HOME/auth/splunk.secret files.

Hello all,I have a case whereby data is sent using webhook to Cribl. Does anyone know how to create a Webhook endpoint on Cribl? Perhaps point me in the right direction?I also need to decode the data being sent but I would like to start with creating the endpoint.Thank you,Marc

Can anyone here recommend a good services/processes config for a 1000+ edge node deployment? We are running into an issue where edge nodes are pegging at 100% CPU after updating cribl to 4.0.3. I wonder if our leader is overwhelmed with requests from all of our edge nodes and if our leader configs could use some tweaks. We are running pretty beefy leader/worker nodes so CPU and memory are not an issue, I am wondering if its more of an IOPS thing. Thoughts?

Hi Cribl community. Could anyone provide some additional insight on the Time Range selection when running against an Amazon S3 bucket? The S3 bucket is full of .gz csv logs which are updated periodically (8 files per 10 minute period). See attached.Beginner's naivety suggested that setting a Relative time (-30m as an example) would only pull files in S3 last updated within that relative time. However, it pulls all files as if I had not set a time filter at all.Another thought is that this time range does not apply to the files themselves, but to the EVENT times contained within the files. In that case, Cribl would need to pull all files before it could filter on event time? https://docs.cribl.io/stream/collectors-schedule-runThank you!(as an alternative, we could use the Amazon S3 specific collector which uses event notifications/SQS, but would like to at least understand the above)

Hello, total noob looking for some help. I installed edge/stream on Rocky 8. It is running, but I am having trouble figuring out how to manipulate data in a source.The source is syslogng, destination is splunk. I want to take the data from the source, do a reverse lookup of the IP that sent the data, then replace the system name or add a field with the result from the reverse lookup.The reasoning behind this is that the syslog senders are part of a virtualization cluster, but each cluster re-uses the name(s) "node(X)" internally, so within splunk there's duplicate entries from each cluster. A reverse lookup should give us unique names for splunk

Question - can I backup an old cribl by1. stop the service2. cp -a /opt/cribl /opt/cribl_backup3. ?

I am trying to create an event breaker to add to a HEC source. Can you use __hecToken as a filter condition for the breaker or does the breaker happen before that internal field gets added?

Hi All,I need some info , I'm trying to migrate existing syslog server to cribl stream , I have a doubt if the cribl server shuts down for any reason , Is there any way we can get the logs in the timeperiod when the server is down.Note : I'm having only one syslog server.

Has anyone had to backpressure a destination via Persistent Queue? We moved our SIEM appliance today to another building and built up about 95g into the 100g queue. When the SIEM came back online all 95g went in 5 min....is there a way to slow that down? The SIEM could not handle that amount events that quick.

hello. does anyone have any instructions on how to update SSL certs using CLI?

Is there a way we can add our own edge node info? We'd like to add some metadata that we can use for our mappings

Hey, I also have a kinda dumb question. Is it possible in worker mappings to filter by CIDR, like conn_ip is in 10.0.0.0/24? If so what is that syntax? I did Google for more than a minute, but I will be honest it was <5 mins.

Hey Folks, i have a silly Q, I am using GeoIP with maxminddbs and it adds a json array like it should. When it gets into Splunk, the only way to search elements in the array requires an | spath command and cant search like a normal key=value. is it recommended to do a json extract after the GeoIP function? if not, how should I pull those fields?

Question - how can I have script collector to run every 30 seconds?

Hi all,Is the method that is setup to use Cribl WEC/WEF that same approximate setup that is used when Windows Events are routed to a WEC server? Going to approach my windows admins about potentially changing how we do this, and want to make sure that I have my facts straight.

what is the best way to remove a JSON array from _raw JSON data and reserialize to _raw? I have a section of JSON data that I want to remove.

Hello,Is there any checkpoint mechanism in REST collector?orDoes anyone know alternative to implement checkpoint in Cribl REST collector?Thanks in advance!!

Hi, any idea how I can add a field with its value to an existing ? In this example operationName should be added under properties.

Before I attempt this, curious if anyone has a way to show splunk license utilization and cribl savings on the same chart.

Can we limit the number of lines per event instead of the max bytes?

Is anyone aware of why the leader needs to restart in order for auth changes for a given worker group to be saved? Seems like it would only need to restart for auth changes to the leader...

Anyone know where the the Auth logs for cribl are? Can't seem to find them in my workers...

Hello everyone, I am having an interesting use case that I am curious if Cribl offer any solution for or not, Now we need to perform Data Enrichment on the fly using cribl stream, The enrichments are based on a CSV lookup, this CSV file will be updated on a daily basis based on new findings and new enrichments rules are added everyday. I am hosting this CSV file at Github, The Question now Is there any functionality in Cribl that can capture such CSV file once committed and pushed to github to reflect directly in Cribl Stream Knowledge > Lookups Library.I know I can workaround such by having a CI/CD pipelines updating the backend `$CRIBL_HOME/groups/<groupname>/data/lookups/` But I am just checking if anyone had similar problem before and what was the solution you thought of ?

I've looked for this online, but couldn't find anything. I have a lookup that I added an entry to at the bottom of the CSV. I was hoping that it would just load that up after the commit and deploy, but it hasn't started working with that entry yet. Is there something that I have to do to make it accept and push the change into place on the workers other than that, or do I just have to wait for enough time to pass that it updates the lookup file that the workers are using?