Solved

How much data can I use before I need to upgrade from the free version?

What free or open source software does Cribl Stream use?

Is there a way for edge to check that a process is running and if not, generate an event?

In other words, what’s the best way to create a whitelist when evaluating log data?

If Splunk Universal Forwarders are configured with compressed = true in the outputs.conf, can the Cribl Stream SplunkTCP source receive from them properly?

The Filesystem destination allows setting a prefix and suffix for the filename. However, I don’t see a place to set the actual base filename, or to just not have one. I don’t want the 6 random character base filename. How can this be removed? Also, I’d prefer not to have file staging, since I am not compressing files, is there a way to just write raw output to disk in real-time? Using the staging dir creates latency.

I have a question about persistent queues. I thought their behavior was such that if you have a persistent queue, blocking signals would only be sent upstream to sources if that PQ is full. I seem to be seeing behavior that does not match that. I am seeing blocked TCP JSON destination that keeps flapping due to output is experiencing increased load errors. It has a PQ and the PQ is empty. This is causing syslog source and elasticsearch sources to drop.What should we expect to see when a destination is blocking and it has a configured PQ. Should sources be blocking?

When trying to attach ./scope to PID in Docker, I receive the error, you must have ptrace capabilities to attach to a process .

The log looks like this:2022/04/26 12:00:00 INFO foo bar stuff hereOther time formats also fail. Why?

Are there any limitations to the file size or events when importing data using an object store collector (s3, azure, gcp, on-prem obj store)?

Had a situation where someone added a bunch of files for an upgrade that was committed on the leader node but not deployed. I want to revert back but the UI is broken for this. Can I do a revert back from the cli to force it to a good version?

If I add an additional node only for traffic passthrough, does the additional hop affect the total amount of traffic that counts against the Cribl license? How is Stream → Stream or Edge–>Stream traffic marked and tracked for billing purposes? ie what needs to be set to make sure it doesn’t double count?

Is there a way to measure the size of a field and then only keep XX bytes of it? I have some huge events coming in from Corelight and it’s all from one field within the event.

What permissions are needed for Cribl Stream to pull an S3 bucket? I’m creating a role for it to use.

After being processed by Stream, is there a way have those source log files either be moved, renamed or deleted?

Any suggestions for the best function to use if I need to pull out a substring (a key=value pair to be exact) from my _raw, and put it at the beginning of the event?In summary, trying to go from:raw=,<my_KV_pair>, to:raw=<my_KV_pair>,

I believe I correctly added Humio as an Elasticsearch destination, it's showing as healthy (green check in my screenshot). However when I test it, I get the error "Error: Send failed: SyntaxError: Unexpected token < in JSON at position 0, status: Sender is blockedDetails: undefined" Not sure what I'm doing wrong, any suggestions?

I have a rest pull that is one giant json event - doesn’t appear to have new-line entries. The events get broken up incorrectly, so I’m assuming that my event breaker needs work, but the only json event breaker that I see is for json with new-lines. How should I handle this?

It’s not clear to me how it’s enforced.

I need to change the IP addresses of a couple of Stream workers. Curious how the app will handle it - should I just stop it/delete it and then re-install?

Can a filter use a lookup table?

If so, is that function available to pipelines outside of the pack or can I only use it in pipelines within the pack?

How many worker groups can a Cribl Stream leader support?

When deploying Stream in containers local configuration changes will not persist. Is there a setting to fix this?

For example: firewall logs that has the same IPs and ports in Windows of time 10 sec.