Skip to main content

Products

Get answers, share tips, and explore best practices across the entire Cribl product suite.

  • 760 Topics
  • 0 Replies
760 Topics
S
Shane DanielsEmployee
asked in General
Is there a way to filter out multiple IP address without using multiple drop functions?

In other words, what’s the best way to create a whitelist when evaluating log data?

01
J
D
davecNew Participant
asked in General
SplunkTCP Source with UF using compress=true

If Splunk Universal Forwarders are configured with compressed = true in the outputs.conf, can the Cribl Stream SplunkTCP source receive from them properly?

10
C
S
Steve BridgeKnown Participant
asked in Stream
Logstream Filesystem output

The Filesystem destination allows setting a prefix and suffix for the filename. However, I don’t see a place to set the actual base filename, or to just not have one. I don’t want the 6 random character base filename. How can this be removed? Also, I’d prefer not to have file staging, since I am not compressing files, is there a way to just write raw output to disk in real-time? Using the staging dir creates latency.

02
H
J
jccurtisNew Participant
asked in General
Persistent Queue Question and Upstream Block Signals

I have a question about persistent queues. I thought their behavior was such that if you have a persistent queue, blocking signals would only be sent upstream to sources if that PQ is full. I seem to be seeing behavior that does not match that. I am seeing blocked TCP JSON destination that keeps flapping due to output is experiencing increased load errors. It has a PQ and the PQ is empty. This is causing syslog source and elasticsearch sources to drop.What should we expect to see when a destination is blocking and it has a configured PQ. Should sources be blocking?

02
J
J
John PondromParticipating Frequently
asked in General
Missing permission message when trying to use ./scope in Docker

When trying to attach ./scope to PID in Docker, I receive the error, you must have ptrace capabilities to attach to a process .

00
P
J
Jon RustEmployee
asked in General
Why is Auto Timestamp failing to extract a timestamp?

The log looks like this:2022/04/26 12:00:00 INFO foo bar stuff hereOther time formats also fail. Why?

01
J
J
Jon RustEmployee
asked in General
Is there a limit to file size when importing data from object stores?

Are there any limitations to the file size or events when importing data using an object store collector (s3, azure, gcp, on-prem obj store)?

04
B
E
Erin SweeneyEmployee
asked in Stream
Can I do a revert back from the CLI in Stream to force it to a good version?

Had a situation where someone added a bunch of files for an upgrade that was committed on the leader node but not deployed. I want to revert back but the UI is broken for this. Can I do a revert back from the cli to force it to a good version?

01
B
E
Erin SweeneyEmployee
asked in Stream
How is Stream -> Stream or Edge-->Stream traffic marked and tracked for billing purposes?

If I add an additional node only for traffic passthrough, does the additional hop affect the total amount of traffic that counts against the Cribl license? How is Stream → Stream or Edge–>Stream traffic marked and tracked for billing purposes? ie what needs to be set to make sure it doesn’t double count?

01
J
E
Erin SweeneyEmployee
asked in General
Is there a way to measure the size of a field and then only keep XX bytes of it?

Is there a way to measure the size of a field and then only keep XX bytes of it? I have some huge events coming in from Corelight and it’s all from one field within the event.

00
B
E
Erin SweeneyEmployee
asked in Stream
What permissions are needed for Cribl Stream to pull an S3 bucket? I’m creating a role for it to use

What permissions are needed for Cribl Stream to pull an S3 bucket? I’m creating a role for it to use.

12
B
E
Erin SweeneyEmployee
asked in Stream
Is it possible to get the worker id in an expression? Or make it available during processing?

Is it possible to get the worker id in an expression? Or somehow make it available during pipeline processing?

01
B
E
Erin SweeneyEmployee
asked in Stream
How do I assign a current timestamp to an event vs. the event timestamp?

I have this really simple function enabled to configure current time as timestamp, but it doesn‚'t seem to work. it's still taking timestamp from event.

20
B
E
Erin SweeneyEmployee
asked in Stream
After processed, is there a way have those source log files either be moved, renamed or deleted?

After being processed by Stream, is there a way have those source log files either be moved, renamed or deleted?

00
B
E
Erin SweeneyEmployee
asked in General
How do I pull out a substring from my _raw, and put it at the **beginning** of the event?

Any suggestions for the best function to use if I need to pull out a substring (a key=value pair to be exact) from my _raw, and put it at the beginning of the event?In summary, trying to go from:raw=,<my_KV_pair>, to:raw=<my_KV_pair>,

01
J
E
Erin SweeneyEmployee
asked in General
How can I add Humio as an Elasticsearch destination?

I believe I correctly added Humio as an Elasticsearch destination, it's showing as healthy (green check in my screenshot). However when I test it, I get the error "Error: Send failed: SyntaxError: Unexpected token < in JSON at position 0, status: Sender is blockedDetails: undefined" Not sure what I'm doing wrong, any suggestions?

01
B
E
Erin SweeneyEmployee
asked in General
How can I correctly break up giant JSON events?

I have a rest pull that is one giant json event - doesn’t appear to have new-line entries. The events get broken up incorrectly, so I’m assuming that my event breaker needs work, but the only json event breaker that I see is for json with new-lines. How should I handle this?

01
R
E
Erin SweeneyEmployee
asked in Edge
Does Cribl Edge send any sort of heartbeat?

I want a method to know (within Splunk) that edge is working properly.

12
P
E
Erin SweeneyEmployee
asked in Stream
How does Cribl Stream enforce license limits?

It’s not clear to me how it’s enforced.

51
S
E
Erin SweeneyEmployee
asked in Stream
How do I change the IP addresses of Stream workers?

I need to change the IP addresses of a couple of Stream workers. Curious how the app will handle it - should I just stop it/delete it and then re-install?

21
S
S
Shane DanielsEmployee
asked in Stream
Can a filter use a lookup table?

Can a filter use a lookup table?

02
J
S
Shane DanielsEmployee
asked in Stream
Can I distribute a custom function in a pack?

If so, is that function available to pipelines outside of the pack or can I only use it in pipelines within the pack?

11
E
S
Shane DanielsEmployee
asked in Stream
How many worker groups can a Cribl Stream leader support?

How many worker groups can a Cribl Stream leader support?

01
E
K
Kyle McCririeEmployee
asked in Stream
When using containers, is there a way to make local changes persistent?

When deploying Stream in containers local configuration changes will not persist. Is there a setting to fix this?

00
B
T
Tony REmployee
asked in General
How do I aggregate multiple logs into a single output?

For example: firewall logs that has the same IPs and ports in Windows of time 10 sec.

01
P

Badge winners

Show all badges
Terms & ConditionsCookie settings