Products

We had an outage over the January 21st weekend. Please let Tony Reinke (Slack - Tony Reinke (Cribl) or Email - treinke@cribl.io) know if you are still running in to any issues. Thanks.

How do I dynamically create multi value fields in Cribl?For example, I would like to take the following and send it as a multi value event in Splunk: cs19=00:40:03:05:79:e1;00:40:03:05:79:d1;00:40:03:05:7a:25;00:40:03:05:7a:89;00:40:03:05:79:f1;00:40:03:05:7a:4d;00:40:03:05:79:cd;00:40:03:05:79:dd;00:40:03:05:7a:51;00:40:03:05:79:fd;00:40:03:05:78:c9;00:40:03:05:78:f1;00:40:03:05:79:0d;00:40:03:05:79:2d;00:0a:f7:fb:77:58;64:00:6a:7c:65:48;64:00:6a:7c:6d:26;64:00:6a:7c:66:d5;64:00:6a:7c:5f:66;14:18:77:6b:31:01;00:40:03:05:78:cd;64:00:6a:7c:65:b4;00:40:03:05:79:05;64:00:6a:7c:66:f2;00:40:03:05:7a:91;00:40:03:05:7a:69;00:40:03:05:79:75;00:40:03:05:79:25;00:40:03:05:7a:09;00:40:03:05:79:35;64:00:6a:7c:6d:ce;64:00:6a:7c:6b:79;14:18:77:6b:63:81For example, this sample event can come in with anywhere from 1 to 50 different MAC addresses.

When I run an event through Cribl Stream on premises and then send to Cribl Cloud, I end up with duplicate cribl_pipe events. How can I remove the duplicate?

I want to use the API to export a Pack from one worker group and merge it to another. How do I do that?

When deploying Stream in containers local configuration changes will not persist. Is there a setting to fix this?

After being processed by Stream, is there a way have those source log files either be moved, renamed or deleted?

I have this really simple function enabled to configure current time as timestamp, but it doesn‚'t seem to work. it's still taking timestamp from event.

Is there a way to measure the size of a field and then only keep XX bytes of it? I have some huge events coming in from Corelight and it’s all from one field within the event.

When trying to attach ./scope to PID in Docker, I receive the error, you must have ptrace capabilities to attach to a process .

If Splunk Universal Forwarders are configured with compressed = true in the outputs.conf, can the Cribl Stream SplunkTCP source receive from them properly?

Is it possible to stream logs and events to Cribl Stream, send a copy of that event to S3 (or similar) for archive, and then process/parse/enrich the logs before sending them to another destination? The use cases I’m thinking of are as follows:(Primary Use Case) If a security incident occurs and we need to present evidence in court, how do we protect the forensic integrity of an event/log/etc. if the event is being changed in flight before going to an archive or analysis tool?If we needed to replay a series of logs for some reason or another, it might be helpful to do so from the source events, unmodified by Cribl.The downstream, long-term storage solution may also serve as a repository of data for other teams to use. Providing unmodified events for those teams may be preferred in that case.Thanks!

I am new to the distributed world, so please bear with me. I have a distributed setup with 2 worker groups(default & 2ndgroup). I have assigned nodes to each of the above 2 groups. In the leader ui when I navigate into the "2ndgroup" and make changes to my pipelines and commit and distribute the changes, it gets pushed to my git repo(remote) & the worker nodes.When I further navigate into the worker nodes and do a live capture of events and make changes to the pipelines, how do I push these changes to the git remote and further when I view it in the leader node under group view reflect the changes that were done at the node level? May be I am missing something obvious, can somebody shed some light on what I am not getting right in this flow?

Is there a way to set up a Destination as a POST request (w/authentication)? I tried using Code and modifying the code for DNS lookup on this page (https://cribl.io/blog/extending-cribl-building-custom-functions/). I got errors about using Promise.

I’m changing the ip on a couple of my workers - anything that I need to change or be aware of? My assumption is that Stream/Edge will just pickup the change and it will appear on the leader with those changes. Nothing else is changing.

Is there a URL or API endpoint I can use to check the status of a Stream Worker or Leader? If so, what HTTP Status codes does the endpoint return?

Hi all. I have Cribl replacing syslog-ng, but in order to listen on 514 I needed to run it as root. Is there a work-around to drop privileges or switch to user cribl after start-up?

Is there a way that we can search data in Devo using the API?

I am getting the following error in Splunk when sending an event from Stream:04-20-2023 04:21:09.000 +0000 INFO IndexWriter [7972 indexerPipe] - idx=goat: found event timestamped=1681964469123 is out of range. Using 1680307200.Here’s what _time looks like, in Stream, when viewing the data:{“_raw”: “”,“_time”: 1681964469123,“cribl_breaker”: “”,“index”: “”,“source”: “”,“sourcetype”: “”,“cribl_pipe”: “”}

I have a REST collector discovering events but not collecting them when scheduled. It works Ad-hoc, though.Any idea what could be causing this? I do not see errors in the logs.

What's the best way to move a sample data capture into a pack? Seems that exporting it isn't consistent.

This discussion has been moved.

I'm here to give you the 411 on new features of v.4.1.1 with updates to Stream, Edge, Search, and AppScope. Remember, this is just the new feature list, so, it is kind of a big deal. Stream (release notes):This release provides the following improvements: Introducing Stream Projects (Beta). This feature enables Cribl admins to create isolated spaces for teams and users to share and manage their data.New native MSK (Amazon Managed Streaming for Kafka) Source and Destination support accessing Kafka topics via IAM roles.The Mask Function now supports toggling individual Masking Rules on and off, to enable iterative development and debugging. It also now supports the SHA512 hash algorithm.The Redis Function now supports mutual TLS.Destinations' Post-Processing > System fields can now include cribl_route, identifying data's path through a given Route or QuickConnect.Cribl.Cloud users on all plans can now generate diagnostic bundles and send them to Cribl Support, directly from Stream's G

A week from today!  Sunil Kimar Gudivada will work through REST API integration for ServiceNow and Smartsheet.You know you don't want to miss that!

I’m using a code function in my pipeline for some extra custom logic, but exporting that as yml config is kinda ugly. Is there any chance I can load a .js file up and just tell the code function to run the js file? This would make local testing of my custom js a much nicer experience. I am doing this with samples for my test cases where I have the sample file locally and I load it up to the cribl server, and reference the file in my samples.yml. I’d love to do basically the same thing with a code function. Original message in Cribl Community Slack Message:https://cribl-community.slack.com/archives/C02A9EQV61J/p1683553724131069

It’s May, hi, 4.1.2 fixes the problem, it’s May (to the tune of TSwift’s Anti-hero ) Sorry everyone @here, we had to. It just fit so well. Even with  Cribl v.4.1.2 being a “maintenance release”, the team managed to squeeze in a few new features as well as a ton of fixes. AppScope 1.3.3 removes our support for two Go versions that the Go project no longer supports: 1.9 and 1.10. This makes the AppScope code less complicated and more robust. Related issue: #1452.AppScope 1.3.3 was also able to solve the following:1461 - In libc musl environments, attaching to an already-running but idle process now works normally1412 - Node.js apps compiled as Position Independent Executables (PIE) no longer seg fault when scoped.Edge now contains the Prometheus Edge Scraper source. Edge is edgier than ever before thanks to the new Prometheus Edge Scraper Source. In addition to the functionality already supported in the existing Prometheus Scraper, this Source is designed to work seamlessly in Kubernetes