Skip to main content

Products

Looking for quick answers or pro-level tips? This category is your space to ask questions, share insights, and learn best practices across the entire Cribl product suite. Whether you're stuck, curious, or optimizing your setup, the community is here to help you level up.

937 Topics
ashu
ashuNew Participant
asked in Stream
vivek.rajkumar
vivek.rajkumarNew Participant
asked in Stream
Invoke Crowdstrike API outside Rest Collector

Hi Team,I am currently working on one POC. I have created a Rest Collector, In the discovery section I have configured Crowdstrike API 1 which returns the list of resource ids. Post that, I am using a format discover results section to read all the resource ids one after the other in JS. These ids are dynamically passed to the query parameter of the next API 2 in the collect section. From API 2 response, I need to fetch an attribute related to device id and pass this attribute in the query parameter of the final API 3 whose response will be sent to the Splunk HEC destination.  I am currently not understanding how can I call this third API because Rest Collector doesn’t have  multiple collect sections and when I moved my data to pipeline to implement a code function to call the API 3, looks like its a limitation, I was not able to call external API from code function and I could not see any other functions in cribl that can support this. Is it possible to chai

610
vivek.rajkumar
Angelo Michele Pizzi
Angelo Michele PizziInspiring
asked in Stream
Raffaele
RaffaeleNew Participant
asked in Stream
ashu
ashuNew Participant
asked in Stream
J
Jonathan RauNew Participant
asked in Search
Cannot POST /api/v1/search/jobs

In both the API Reference (with authenticated session) and via Python, I started running into an issue with submitting queries to the POST /search/jobs API to submit a remote query to Cribl Search.Despite the fact that it's a POST endpoint, and I'm using the headers generated by the API Reference, I receive the following error<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot POST /api/v1/search/jobs</pre></body></html>In the API Reference this is the payload I am POST'ing with application/json as the accept and Content-Type - the Auth comes from my session automatically{ "query": "cribl dataset=\"cribl_internal_logs\" | limit 10 "}In Python, I attempted to recreate it as well, I can confirm that the Client ID and Client Secret are valid and I receive

761
rcalvert
R
redukNew Participant
asked in Stream
D
Daniel JordanEmployee
asked in Stream
V
VenkatNew Participant
asked in General
Louise Tang
Louise TangEmployee
asked in General
How do I create a REST API Collector that needs to reference a dynamic bearer token?

This is an example of how we can reference a value provided by Discover Type HTTP Request in the REST API Collector which will correctly save a bearer token value which will expire (default time 5 minutes) using a named Token attribute: token, Authorization header `Bearer $(token)` and Authentication expression `Bearer $(token)` The initial authorization request:curl -X POST 'http://localhost:9000/api/v1/auth/login' -H "Content-Type: application/json" -d '{ "username": "admin", "password": "<password value here>" }' Run a Discover request to generate a bearer token: The above request will return a value something like: {"token":"abcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdef

1531
Louise Tang
N
nada28.7.1996@gmail.comNew Participant
asked in Stream
J
jaycriblNew Participant
asked in Stream
J
Jari WeststrateParticipating Frequently
asked in Stream
filter expresion and route order

Hello,I noticed a strange thing maybey anyone can explain.I have 3 syslog sources: syslog:514: ,syslog:51402: and syslog:51403:Three routes for these sources, each with a different pipeline attached. The order off the routes are 514 then 51402 and at last 51403.The filter in de routes are __inputId.startsWith('syslog:514:') &&  __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51402:') && __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51403:')&&  __srcIpPort.includes('10.10.1.112')(same host with different syslog outputs)In this order the 514 port gets a load off events, the 51402 lesser and teh 51403 nothing. That surpised me because when a check the source side i can capture 51403 events from this sourceip.For test i moved the 514 route after the 51403 route. Just a feeling. but what??.. the 51403 gets suddenly l the events it was missing. And here it

886
Jon Rust
A
Arnold JohnsonNew Participant
asked in Stream
A
a.pietersen@eremote.nlParticipating Frequently
asked in General
P
Prabhat SharmaNew Participant
asked in General
Best way to send logs from Cribl to OpenObserve

I am trying to send logs from cribl to OpenObserve.OpenObserve accepts data in a JSON array format.e.g.[ { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }, { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }]What is the best way to do this?

631
Jon Rust
Angelo Michele Pizzi
Angelo Michele PizziInspiring
asked in Stream
Distributed deployment planning with compressing g-zip Destination?

Hello everyone,I have the following problem. I'm designing a distributed deployment. I have to create an environment for data reduction but before that I need to send the data to a blob storage, for compliance reason, as you can imagine. Now, all of these is achieved but I have some doubts. When I use the Azure blob storage as only destination, all the 100% of the data goes in there but, the Monitoring Page, is telling me that the data that comes in are the same as the data that goes out (sometimes, the data that goes out are even more), even with compression enable. As said, I have the g-zip compression enabled on the Azure Destination page. I've checked the storage and I found out that the data are really compressed. So, my point is the following: when I try to estimates the possible number of workers and their capabilities, should I trust the monitoring page and consider DATA IN = DATA OUT (since the data is not processed by any pipeline at all) or I c

753
Jon Rust
J
jbos@svb.nlNew Participant
asked in Edge
S
Somnath BhattacharyaNew Participant
asked in Stream
Unable to perform Destination test with Splunk HEC

I am new to cribl and trying to setup Splunk HEC destination from cribl sanbox stream instance. I have provisioned a free splunk cloud instance and setup HEC. While I can send data via: curl -k "https://<host>:8088/services/collector" -H "Authorization: Splunk 38aa4a38-8fd5-4faa-afc4-9b3533ac39c7" -d "{"event": "Hello, world!", "sourcetype": "manual"}"I am unable to run destination test from cribl with the exact endpoint or with /services/collector/event. Everytime the request time out with error:2025-02-20T14:23:57.956αtime:2025-02-20T14:23:57.956Zαcid:w0αchannel:output:splunkαlevel:errorαmessage:error while flushingαioName:splunk_hecαioType:destination{}error:αmessage:request timeoutαstack:Error: request timeout at /opt/cribl/bin/cribl.js:15:9721630 at new Promise (<anonymous>) at p.doHttpRequest (/opt/cribl/bin/cribl.js:15:9721585) at runNextTicks (node:internal/process/task_queues:60:5) at process.processTimers (node:internal/timers:509:9)

671
Jon Rust
A
Ashley PietersenNew Participant
asked in General
S
Steve BennettParticipating Frequently
asked in Stream
J
jaycriblNew Participant
asked in Stream
Having hard luck with parsing logs - tips?

Hi, I have gone through the cribl university user and admin courses and setting up the product is quite easy however am constantly stuck trying to parse or extract strings of data into fields so that we can search or use the information.For systems which send in JSON or CSV it is very simple, however most of ours are embedded Linux or network devices which give something like the following:<183> 02/06/2025:00:24:20 GMT NYDC1VPX01-DMZ 0-PPE-0 : default SSLLOG SSL_HANDSHAKE_SUCCESS 9838002 0 : SPCBId 33168208 - ClientIP 10.1.1.130 - ClientPort 57486 - VserverServiceIP 10.200.80.80 - VserverServicePort 443 - ClientVersion TLSv1.2 - CipherSuite "TLS1-AES-256-CBC-SHA" - Session New - HandshakeTime 47 msShowWhat combination of functions can split this out into fields such as hostname, clientip, clientport, etc.I have tried using ChatGPT to help and can get regex and grok expressions from the AI however these don't work when applying to cribl. I d

994
Jon Rust
K
kiran kNew Participant
asked in Stream
O
openwebspaceNew Participant
asked in General
A
Arnold JohnsonNew Participant
asked in Stream

Badge winners

Show all badges
Terms & ConditionsAccessibility statement