Skip to main content
Solved

Do I Send It To Search, Destination Or Do I Send It To Something Like A HEC Destination And Then Plugin The Endpoint…

  • May 6, 2026
  • 3 replies
  • 1 view
S
This message originated from Cribl Community Slack.
Click here to view the original link.

I have data that gets processed in STREAM that I want to send to LHE. Do I send it to search, destination or do I send it to something like a HEC destination and then plugin the endpoint that’s provided in the search sources?

Best answer by David Cavuto

"Cribl Search" is a destination tile in Stream worker groups. That should be automatically configured to the correct endpoint and default port for the Cribl_HTTP source in LHE. You shouldn't have to change any of the defaults if you're using that single channel. If you add an additional Cribl_HTTP source, it will have to be on a different port, so you'll have to customize the port in the Cribl Search destination tile in Stream.

3 replies

David Maislin
You send it to the Search Destination
David Maislin
Which lands in the LHE on that same port.

Links for this message:
Screenshot 2026-04-30 at 9.41.23 AM.png
Screenshot 2026-04-30 at 9.41.47 AM.png
D
  • David Cavuto
  • Employee
  • Answer
  • May 6, 2026
"Cribl Search" is a destination tile in Stream worker groups. That should be automatically configured to the correct endpoint and default port for the Cribl_HTTP source in LHE. You shouldn't have to change any of the defaults if you're using that single channel. If you add an additional Cribl_HTTP source, it will have to be on a different port, so you'll have to customize the port in the Cribl Search destination tile in Stream.
Terms & ConditionsAccessibility statement