Products

It’s not clear to me how it’s enforced.

I need to change the IP addresses of a couple of Stream workers. Curious how the app will handle it - should I just stop it/delete it and then re-install?

Can a filter use a lookup table?

If so, is that function available to pipelines outside of the pack or can I only use it in pipelines within the pack?

How many worker groups can a Cribl Stream leader support?

For example: firewall logs that has the same IPs and ports in Windows of time 10 sec.

How can I persist modified data between different containers or ephemeral instances?

I’d like to grab a sample file from production, work with it in a local dev environment, copy/paste the pipeline, then upload it back to production.

For example, I have name=domain\\username, but I want to remove the extra slash.

Here's the scenario:I have a rest call that pulls in csv data, translates it into kv pairs, but now I want to filter out events where a certain field (non-indexed) are equal to a certain value.

create a series of REGEX functions that apply to different fields or _raw, and then select the '...' (ui element) at the right of the Function. Then select the Create Group option. Drag all the REGEX functions into the group. These groups can expand and collapse for clarity. This technique can be applied to all of our functions.

2048 MB are allocated to each Worker Process by default. How do I allocate more?

I need to turn a string field value into an integer, how do I do that?

I want to eval the size in bytes of _raw. How do I do that in Stream?

LogStream is reporting “Error: read ECONNRESET at TCP.onStreamRead (internal/stream_base_commons.js:209:20)”Help.

How is data total throughput calculated?

When upgrading a pack on a stand-alone server, does cribl need to be restarted?

In the Palo Alto Network Pack, what purpose does the index index || ‘firewall’?

Which TCP/UDP port is used to distribute the worker binaries when I do version upgrade from the web interface?

I need to change the authToken on my LogStream cluster. How do I change the token for the workers?

How can I migrate my current workers to a new leader and maintain the configuration in a new worker group?

Looking to understand which formats Stream supports for my Splunk HTTP Event Collectors (HEC)?

What does mtimeMs show in the logs?

Attention all data lovers! Cribl is thrilled to announce the latest and greatest version of platform, Cribl v4.1! This update is so hot, it’ll make your data sizzle!So, what’s new you ask? There is a lot. Here are the first few items that we are talking about for each product. There are too many new features to talk about in an announcement. Stream (release notes):Persistent Queues Predictability: When you configure Persistent Queues on Sources, Always on is the new default mode for greater reliability.Connections and Load Throttling: Along with the new PQ options, we've provided new controls to prevent connections from overloading Workers. At Group Settings > Worker Processes, you can now limit how many connections each Worker will accept upon startup or restart. You can also determine how long after startup to impose that limit.New Sources and Destinations: We've added a new Raw UDP Source. We've also added a new Data Lakes > Amazon S3 Destination to stage data for Cribl Search

This post will help you setup a trust between your Cribl Cloud instance and your AWS account. It follows the steps documented on the docs page for Cross-Account data collection.This Rapid Adoption CloudFormation template can help automate the trust between your Cribl Cloud stack and your AWS Account. In order to keep the IAM policy limited to only resources that Cribl Cloud should have access to, the template will ask for specific S3 buckets and related SQS's.