Search

This message originated from Cribl Community Slack.Click here to view the original link.I have data that gets processed in STREAM that I want to send to LHE. Do I send it to search, destination or do I send it to something like a HEC destination and then plugin the endpoint that’s provided in the search sources?

This message originated from Cribl Community Slack.Click here to view the original link.can cribl search read splunk frozen buckets that I store in my own S3?

This message originated from Cribl Community Slack.Click here to view the original link.i have some data that is getting processed in stream and I want to send it to search LHE. Will search take the timestamp that has already been created for the event within the pipeline, or do I need to create an additional timestamp config via datatypes?

This message originated from Cribl Community Slack.Click here to view the original link.Hello Team, have a weird issue with a token in a dashboard in Cribl Search. I have a dropdown input that is populated by a search, which is working fine, however it has a value being returned that is Software/Technology I am trying to use the value to filter results in a table in one of the visualizations however I am getting an error because of the / character in the value. The error is Search failed: mismatched input '/' expecting {<EOF>, ';'}; token: /; line: 1 column: 119 is there any way to sanitize the token so that it can just search on the text?

This message originated from Cribl Community Slack.Click here to view the original link.I am considering scheduling a search to return if any IOCs are found from various sources I get e.g. CISA, MSISAC, EDR company, etc. I have a basic lookup: ip,source_desc 5.252.179.169,waterisac 5.252.179.89,waterisac I tried what I thought would work in search and then went to AI to refine it because it was returning my internal IPs not the IPs in the lookup:Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.i have a situation in search/LHE where fields are getting duplicated, and the duplicated ones are prefixed with the phrase “data_“. Anyone ever see that? The datatype that I want is being used.Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Has anyone got any strategies for managing alert suppression? Looking at using search as a complete search & alerting platform but worried about alert management

This message originated from Cribl Community Slack.Click here to view the original link.How do you handle masking/redacting in Cribl Search?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a way to do a cumulative sum on log events in Search? Or even with metrics? I'm not seeing anything mentioning cumulative in the stats functions in the docs. I would like to graph at what time a service reached 1,000 total requests, or when a service first had 100 unique clients IPs. I currently only have the events with this data, but if I need to convert these to metrics in Stream and send them over to Search as well I can, I'm just not sure Search supports cumulative queries

This message originated from Cribl Community Slack.Click here to view the original link.can search send data to http listeners, or does it have to go through stream?

This message originated from Cribl Community Slack.Click here to view the original link.Should I be able to click on a column in search table to change the sort on rows?

This message originated from Cribl Community Slack.Click here to view the original link.How can I see concurrency metrics? Almost every dashboard panel is getting queued, but I don't see how many searches are actually being run at once so I dont know how much adjustment to usage groups I need to do

In both the API Reference (with authenticated session) and via Python, I started running into an issue with submitting queries to the POST /search/jobs API to submit a remote query to Cribl Search.Despite the fact that it's a POST endpoint, and I'm using the headers generated by the API Reference, I receive the following error<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot POST /api/v1/search/jobs</pre></body></html>In the API Reference this is the payload I am POST'ing with application/json as the accept and Content-Type - the Auth comes from my session automatically{ "query": "cribl dataset=\"cribl_internal_logs\" | limit 10 "}In Python, I attempted to recreate it as well, I can confirm that the Client ID and Client Secret are valid and I receive a valid token. Here is the relevant portion of that script.def generateBearerToken() -> str: url = "https://

We are wanting to use Cribl to repopulate cloud trail logs from S3 into Splunk on-demand for review/audit/analysis purposes. Ideally, we would be able to request from within Splunk, but we could also query within Cribl to pull the data if necessary. Are there any best practices or use-cases that you can provide?

Hi,Excuse me for my "not knowing", maybe a easy answer for all of you.I am in the process of migrating our Heavy Forwaders to Cribl . One off the inputs is for Cisco IOS devices. The props.conf has a Regex in it to change the sourcetype with help of a transforms. The props uses a regex to select the events.Where and how do i put the regex which is used in the props.conf for filtering the events. Do i have to place this regex in the "filter expresion" in the route? Or in a pre-pipeline? And how do i do it?Thanks in advancegreetingsJari

I'd like to search a CloudTrail S3 bucket. What I want to search is "in all accounts" and only in "US-EAST-2" region for event name:"Assume Role". I'm not sure if I configured the Dataset correctly and/or how to do the search. Regarding the Dataset bucket path. This is the S3 folder layout: AWSLogs/subfolder/<ACCOUNT>/CloudTrail/<REGION>/YYYY/MM/DDIn the Dataset config, i'm not sure what to put in the bucket path. Especially for the <Account> and <Region> parts My guess is something like this AWSLogs/subfolder/${ACCOUNT}/CloudTrail/${REGION}/${_time:%Y}/${_time:%m}/${_time:%d}Regarding search: What I want to search is "in all accounts" and only in "US-EAST-2" region for event name:"Assume Role" When I did: dataset="CloudTrail_DATASET_NAME" | limit 1000 it returns no results. Not sure what I'm missingThanks

How to search ipv4 range through Cribl search. What would be the syntaxI want to know whether we can search fields from raw logs or only parsed fields can be searched?

Dear all,Coming up with yet another question as I couldn't find similar from the history of available requests. I have created the HTTP RAW Source and able to push the data and process it in the pipeline. However, I have observed that when I POST the valid JSON format(all the attributes with double quotes), Cribl http source is parsing them into individual fields after the source process, and if the posted content is not JSON parsable, then the content is available under the key "_raw".As per my requirement, I would like to keep the input JSON object as is, since I was trying to validate the whole json with the schema stored in the Knowledge. If it's not getting parsed then I was able to run my use case as expected. In other case where the JSON is parsed into individual fields, I couldn't find any internal key which holds all these variable to format them back to JSON object to validate against the schema.Hence, reaching out for any suggestions in this. Thanks in advance!NOTE: Would be

I'm attempting to extract values from a JSON string field. However, it seems, that none of the below methods are working for referencing or obtaining the value using a JSON path or dot notation type of approach. I've even tried the "extract_json" function, but to no avail.KQL in Azure has the bag_unpack function, but I noticed this is not supported in Cribl Search.Below are my queries and results.| extend json=parse_json(_raw)| extend test1=_raw._raw.kubernetes.container_name| extend test2=json._raw.kubernetes.container_name| extend test3=json['_raw']['kubernetes']['container_name']| extend test4=extract_json("$._raw.kubernetes.container_name", json, typeof(string))| limit 10

Hello all,I have recently started working with Cribl and my question may seem to be easier one, however, I couldn’t find an option to do this in right way and hence reaching out for help.In one of my use case I am getting a json from source and my requirement is to check whether the attributes in the object are matching with some of the existing Regexes in Crible knowledge section. I was expecting something like below,For ex: To access Schema, we use C.Schema(‘Schema Name’).Validate()In the same way can we do C.Regexes(‘Name of the regex’).test()Please advise on this with any suggestions. Thanks in advance!

I have a field that is nested. I can search with the full name without an issue but when I try to use it with project, I do not get any values back. I have tried to wrap the field with single and double quotes. That results in the value for the field to be the name of the field.The goal is to get a list of all the different values of the payload.comment.commentID field. What do I need to do to use the payload.comment.commentID field? dataset="MyDataSet" sourcetype="MySourceType" payload.comment.commentID=* | project payload.comment.commentID

My Cribl Cloud URL seems to prefix a main-  when navigating to leader URL from the Cribl Cloud home page. Is this prefix standard for all URLs? Are there scenarios where this might be a different prefix?Original Question asked on https://cribl-community.slack.com/archives/C03HK1K33FA/p1685111839249629

Is there any info on Search costs when searching AWS S3 buckets?   Specifically on how data transfer works.  For example, does Search hit S3 from US East and is $.01 per GB against my AWS account?  Is Search caching at all? https://aws.amazon.com/s3/pricing/?p=pm&c=s3&z=4 Original post was from https://cribl-community.slack.com/archives/C03HK1K33FA/p1678133798883439

Very excited about scheduled searches!   Couple of questions:What’s the most direct method of finding your completed scheduled searches?  Is it search->history->scheduled?I don’t see a way to see anything but the most recent runs of a search.  Am I missing something?Original Message was from https://cribl-community.slack.com/archives/C03HK1K33FA/p1685111839249629

Hi guys, we are trying to configure Cribl Search to query S3 bucket but have been facing error that says "Error initializing task queue" .... "Access Denied"We are seeing the Cribl Stream worker AssumeRole into our AWS account for the existing S3 Source Collector that we have configured previously but, we’re not seeing any Cloudtrail logs in our SIEM to show that the Cribl Search role (new role that we created in AWS to configure Cribl Search only) is able to AssumeRole into our account i.e we’re not seeing any STS logs in SIEM for Cribl Search role.Can anyone provide help on this?