Products

This message originated from Cribl Community Slack.Click here to view the original link.i have a rest feed that sends data to splunk on a daily basis. i’d like to also send that data to another destination but only once a week. I was thinking of using an output router, but is there a way to look at the day of week in the filter? Open to other suggestion on how to do this.

This message originated from Cribl Community Slack.Click here to view the original link.Hello team, I need one clarification on - Zscaler log source can be ingested in CRIBL via Amazon S3 ??

This message originated from Cribl Community Slack.Click here to view the original link.In general... should I need to import the default Cribl certificate when attempting to connect one of our AWS EC2 Linux-based Splunk Heavy Forwarders to a Splunk TCP Source hosted in a Cribl Cloud's AWS workgroup? We've confirmed that we have connectivity using netcat, but when I configure the TA in question to send data to the Cribl workgroup (using the FQDN in outputs.conf), the IP addresses fail after 3 attempts and are quarantined. I've reviewed the splunkd logs on the heavy forwarder, but they have yielded little so far.

This message originated from Cribl Community Slack.Click here to view the original link.I'll preface this by stating that I've searched the community here, and have seen some rumblings but nothing concrete. Has anyone successfully load balanced Windows Event Forwarding with an F5?

This message originated from Cribl Community Slack.Click here to view the original link.When migrating Leader Nodes from and old server to a new server (on-prem) it says to start the new Leader node, apply the license and just zip up the existing $CRIBL_HOME/groups directory and unzip it onto the new Leader node. What about for Edge Fleets?

This message originated from Cribl Community Slack.Click here to view the original link.Going through the interface of configuring an Edge node on Windows - there's a toggle for Windows Event Logs to collect in XML or JSON. JSON isn't native, so is there something behind the scenes going on with Edge that allows this? Traditionally with Steam you use the Windows pack to do the conversions

This message originated from Cribl Community Slack.Click here to view the original link.what would be the best way to report on log stats (volume, drops) for a period of a year? Should I just query an endpoint and save them to a lookup, or is there a way to do it that won’t take forever to run a report. I’d probably want avgs/peaks and also by some other criteria (routes, destinations). I know cribl vsision can do a lot of this, but my concern is that rrunning it ffor longer periods of time would take forever.

Hi All i am migrating some sources from source →lb → syslog →  splunk to source → lb → cribl → splunk I am seeing few big events landing on plunk via syslog but the same event when i search on cribl syslog source the events are not visible at all can anybody suggest if there are any setting at cribl that can cause this drop.

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, im trying to forward logs from stream to snowflake. Has anyone tried doing this before? There is no native destination and i tried searching for workarounds but no luck so far

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, we're trying to setup log forwarding from Cyberark Audit to cribl. Could you please help with that

This message originated from Cribl Community Slack.Click here to view the original link.Can we set up volume notifications on worker group level instead of source and destination?

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to collect CATO logs using the REST Collector. The current issue is that logs retrieved via the REST API are being duplicated. When retrieving CATO logs through the REST API, I would like to avoid collecting data that was already fetched previously. Is it possible to prevent previously collected data from being ingested, for example by using timestamp information? If this is not supported as a built-in Cribl feature, could you please share any best practices to handle this?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a per GB dollar cost calculator for using Lakehouse?

I’m looking to better understand how to monitor employee access to different applications via SSO. What approaches or best practices are others using?

This message originated from Cribl Community Slack.Click here to view the original link.For a File Monitor input: If I have a path say /foo/bar/ And inside of there are 4 sub folders. We'll call it A/ B/ C/ and D/ ; and I want Edge to monitor all CSV files inside /foo/bar/ except for anything in A/ Can I do this in 1 combination of "Search Path" and "Filename allowlist" ? Or do I need to create 3 specific file monitors with their direct paths?

This message originated from Cribl Community Slack.Click here to view the original link.What's the safest way to clone a currently top-level fleet to be a child fleet? On-prem deployment, and the top level fleet will be a freshly created fleet We're reshaping out fleet architecture right now and there is a lot to move I manually moved everything in lower but it was such a pain, I kept missing pieces so I'd like to do it in a more quick and safe way if possible.

This message originated from Cribl Community Slack.Click here to view the original link.I am trying to leverage the send command in Cribl Search. I have enabled a Cribl HTTP source in Cribl Stream that listens on port 10200 listening from all addresses. The worker group that this source is enabled on is a hybrid worker group hosted in my team's AWS account. Is there a list of IP addresses I need to allowlist on my AWS account's side?

This message originated from Cribl Community Slack.Click here to view the original link.It looks like the database collector is automatically turning MSSQL date and time fields into text versions of full timestamps complete with a hallucinated timezone. E.g. '2025-06-26' --> "2025-06-26T00:00:00.000Z", '13:09:11.0000000' --> "1970-01-01T13:09:11.000Z" Is there a way to stop this behavior at the collector, or do I have to undo the damage in a pipeline?

This message originated from Cribl Community Slack.Click here to view the original link.Hi Folks, I think I am missing a trick here. I am trying to create a Stream API collector to Salesforce Marketing Cloud, and I get the “Error: read ECONNRESET at TLSWrap.onStreamRead” error. I have configured the collector correctly, so I was wondering if there is any way to confirm connectivity from Cribl Cloud to the Salesforce Marketing Cloud URL to confirm that part is working at least? Also, any suggestions I can try? Has anyone successfully managed to create a connector to Salesforce Marketing Cloud?

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, is there anyone having experience to reduce Network device logs(VPN,IPS,FW)? We are currently working on a proposal for log reduction on Cisco ASA devices for our customer. But the customer mind if reduction logs have impact on their SIEM operation. Based on our analysis, we believe that certain logs—such as informational-level messages (e.g., session teardown notifications, routine status updates)—are generally low-value for SIEM correlation and threat detection, and can be safely excluded. So if you have an experience about similar log reduction strategies for Cisco ASA or other network devices, could you share with me?

This message originated from Cribl Community Slack.Click here to view the original link.Hello team! I’d like to understand the difference between sending only the _raw field to Lake, and sending _raw along with some extracted/parsed fields. I assume it will affect the size of the event, but more importantly, how does it affect the performance in Cribl Search? Additionally, are there any recommendations for using JSON/Parquet data format?

This message originated from Cribl Community Slack.Click here to view the original link.Need some clarificaton regarding Splunk DSS and Cribl lake. The doc says: “In Cribl Lake, deleting a Splunk Cloud Self Storage Source means that you will lose all your Splunk data archived here. Also, Splunk Cloud will no longer be able to write to Cribl Lake through this integration. However, this deletion will not affect your data flow and storage within Splunk Cloud.” Does this mean that if I delete a Splunk Cloud Self Storage connection to Cribl Lake that I’ll lose all capability to communicate with Splunk DSS and Cribl lake - including future ones - or just this individual connection?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a way to do a cumulative sum on log events in Search? Or even with metrics? I'm not seeing anything mentioning cumulative in the stats functions in the docs. I would like to graph at what time a service reached 1,000 total requests, or when a service first had 100 unique clients IPs. I currently only have the events with this data, but if I need to convert these to metrics in Stream and send them over to Search as well I can, I'm just not sure Search supports cumulative queries

This message originated from Cribl Community Slack.Click here to view the original link.can search send data to http listeners, or does it have to go through stream?

This message originated from Cribl Community Slack.Click here to view the original link.Should I be able to click on a column in search table to change the sort on rows?