Solved

This message originated from Cribl Community Slack.Click here to view the original link.Hi everybody, I'm migrating my clients infra to a new datacenter (leader node + central worker group and multiple worker nodes). What is in your opinion the best way, to migrate the LN? It will be a new VM with new ip/dns

This message originated from Cribl Community Slack.Click here to view the original link.Is there an easy way to get the download URL for past Cribl release versions? For example, we are upgrading to 4.16.1 and I want to figure out where I can find this: https[:]//cdn.cribl.io/dl/4.16.1/cribl-4.16.1-20904e45-linux-x64.tgz so I can configure it in the path settings in the upgrade section of the UI. My solution now is to download the version I want, copy the file name, and reconstruct the URL. I would like to simplify this if possible.

This message originated from Cribl Community Slack.Click here to view the original link.Whats the syntax for doing a toLowerCase for a field like tenant.id or anything that contains a special character?

Hi everyone,I'm currently working through the CC Admin – Stream | Final Review Lab, and I'm stuck on Task 18, which asks to add a Lookup function to the pipeline named networkData.The Lookup function is present in the pipeline and appears correctly configured, yet the task still shows as failed.Any thoughts about this error ?Thank you,Phillip 

Hi TeamI have completed the Tasks list as provided , but  for below TASK failed though i have completed as per the lab document, could you please help me apart from this everything shown as green. Attached screenshot for the reference   Task 11Make sure you have selected the "mobileOrders" Pipeline between the 'mobileOrders' source and the 'mobileOrders' destination.

This message originated from Cribl Community Slack.Click here to view the original link.Hello community, is there a Cribl Cloud API endpoint I can hit to add multiple CIDR Ranges to the Workspace --> Access Control List? I have been scanning the API documentation for such an endpoint.

This message originated from Cribl Community Slack.Click here to view the original link.This may be a silly question, but regarding the Azure Event Hub source, let's say I have to restart my Stream workers or otherwise take them down briefly for maintenance. Once they come back up, they'll just resume the data ingestion where they left off, right? Do I need to do anything "special" to make sure it keeps track of where it needs to pick back up reading data?

This message originated from Cribl Community Slack.Click here to view the original link.I know that Cribl added the ability to include Source and Destinations in the Pack. I was looking at using this, and I can see in the routing that there is an option "Send to Worker Group routes". How do I actually access this data in the Worker Group routes?

This message originated from Cribl Community Slack.Click here to view the original link.Quick question.. Whats the simplest way to get the cribl audit logs from the leader node to a destination. The docs say the audit logs are written to the leader node logs dir; but i need to send these to a custom destination

This message originated from Cribl Community Slack.Click here to view the original link.I am using Cribl Cloud and have configured a REST Collector that stores a value named 'latestLoginTime' in state management. Should I be able to access that in a preprocessing pipeline using the following syntax? It doesn't appear to be present. __state.latestLoginTime

This message originated from Cribl Community Slack.Click here to view the original link.For setting up a trust with AWS in cribl cloud stream is there a global eternal id to provide to AWS or is it collector by collector?

This message originated from Cribl Community Slack.Click here to view the original link.Hi Team. I am trying to onboard Fortinet firewall logs in Cribl with UDP port 514. I am not receiving data in Cribl, I have asked the Fortinet team to route to different UDP port such as 1514 or 5514. But the team wants to send the data only in 514 port in UDP. Is it possible to onboard the data from Fortinet with UDP port 514?

This message originated from Cribl Community Slack.Click here to view the original link.Hi, I have an on prem stream single instance and i want to install Cribl edge on several servers to collect and forward logs to this stream instance. In this case what is the right architecture here? Can this Cribl stream single instance act as a leader for the edge nodes? or they require a separate leader ? If i install edge as a single instance on each machine i wish to collect from, does it consume a lot of resources? or should i install a separate leader node and all edge nodes connect to it?

This message originated from Cribl Community Slack.Click here to view the original link.Hi :wave: Apologies if this has been solved, I haven't been able to find anything using Slack's search option. The scenario is that we have a REST endpoint that we need to call to download a report with data, but in order to download the right report we need to first query a slightly different endpoint to get the last report ID. :sigh: Cribl's REST can do OAuth -> API call just fine, but then I need to store the returned value in a global variable so that the second REST call can look it up and use it. Not pretty, it's what we have. So the question is, is there an internal call that can perform an update of a global variable, or a REST/HTTP call that I can set as the destination to do this? The CoPilot AI says I can use /lib/vars/ endpoint to do this, however I can't find that endpoint in the API docs. The second problem I've run into is that there doesn't appear to be a REST destination that I c

This message originated from Cribl Community Slack.Click here to view the original link.Hi team, I’m configuring a Cribl File Monitor source to ingest multiple files under the same path, but it looks like only the first file in the list is actually being ingested. Has anyone run into this behaviour before? Max Depth is unlimited.Links for this message:Screenshot 2026-03-06 at 12.55.56 PM.png

 Hi,I would like advise seek advise regarding the CC Admin-Edge Final Review Lab. I have a task that keeps failing to clear.  I'm unsure which step I may have missed out. Please see details and screenshots below Task 11: Add Mask function to obfuscate VISA, Mastercard, and Discover credit cards numbersTask 11 InstructionsMask Function, Masking Rules createdMatch Regex and Replace Expression for Visa, Mastercard and Discover Applied to fields _raw from captured Sample Data Masking rules for VisaMatch Regex and Replace Expression Sample input/output results from captured sample data Masking rules for MastercardMatch Regex and Replace Expression Sample input/output results from captured sample dataMasking rules for DiscoverMatch Regex and Replace Expression Sample input/output results from captured sample data 

I need to open a support case

How can I customize the port HTTP (or raw HTTP) source listens on in Cribl.Cloud?10080 is the default, and https://docs.cribl.io/stream/ports/#cloud-ports seems to indicate that I can only use 20000-20010 for additional sources?I am trying to get a webhook configuration working for DocuSign and it looks like Docusign only supports 443, 1443, 2443, etc (https://support.docusign.com/s/document-item?language=en_US&bundleId=vob1727899215236&topicId=zjq1665170940873.html&_LANG=enus).Seems like this won't be the only challenge I’ll need to overcome based on the authentication methods DocuSign and Cribl support, but it's the first obstacle i see.I tried enabling an HTTP source to listen on 1443, but when testing with https://www.geocerts.com/ssl-checker it's telling me that this port isn't responding (while 10080 is), so it appears something on Cribl side….

I’m having an issue with the setup of SSO, using Entra.  99% of it is up and working, and users are able to get in. My issue with Organization level permissions. I want the users of a particular group to have Owner permissions, at the Organization level. Per documentation, that would be set in Entra. As best I can tell, I have gone through all of the related documentation and adjusted my settings to match, but I can’t get it to work. When we log in with an SSO account, the users do have Owner rights from the Workspace down (as that is set in the Teams page), but not at the Org level. I’m sure it’s an easy setting that I’m just missing, and I’m hoping someone could point me in the right direction. 

I want a method to know (within Splunk) that edge is working properly.

This message originated from Cribl Community Slack.Click here to view the original link.Hi All. I am creating a pipeline at worker group level (I have 2 worker nodes in the group) , in which I want to amend worker node name in _raw file. I tried using __cribl_worker field but I am getting value as undefined. Can someone help in getting the worker node name to amend to my _raw field

This message originated from Cribl Community Slack.Click here to view the original link.Hello, I have configured a rest collector to fetch Fastly WAF requests. the collector is working and getting the correct requests. due to limitations in the API I have to fetch 1000 requests and then utilize a suppression in the pipeline to deduplicate the requests that have already been fetched in prior runs. The problem I am running into is that the collector job is running on both workers in my WG. I tried to disable the source on one of the workers manually but the rest sources are not present in the individual worker UI. does anyone have any recommendations for configuring this so that this collection only runs on one worker? do I need to run this in a worker group with only a single worker?

This message originated from Cribl Community Slack.Click here to view the original link.Can we connect cribl Search with Azure cold storage? And be able to pull data if organized in proper monthly datasets?

This message originated from Cribl Community Slack.Click here to view the original link.Hello All. I am deploying Cribl for one of my customer where we need to collect data from a syslog server and I have 2 Cribl worker nodes to collect the data. Customer is having some concerns in getting the load balancer to distribute the traffic to my 2 worker nodes. What are the other options to send the traffic from Syslog server to 2 Cribl worker nodes? Is there any Cribl internal LB or any other recommended options?

This message originated from Cribl Community Slack.Click here to view the original link.Do people typically spin up Leader nodes inside of a DMZ to control Edge clients in there?