Solved

This message originated from Cribl Community Slack.Click here to view the original link.Should I be able to click on a column in search table to change the sort on rows?

This message originated from Cribl Community Slack.Click here to view the original link.How can I see concurrency metrics? Almost every dashboard panel is getting queued, but I don't see how many searches are actually being run at once so I dont know how much adjustment to usage groups I need to do

This message originated from Cribl Community Slack.Click here to view the original link.Am I allowed to register an On-Prem cribl worker to a cribl.cloud leader? It looks like I do not have access to the auth-token for the default group

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, Does Cribl support OAuth2.0? Can we integrate with BOX with Cribl?

This message originated from Cribl Community Slack.Click here to view the original link.Hi all, I would like to know about "Enforce License Quotas" in Cribl Stream(On-Prem, not Cribl.Cloud). The docs state that there will be no restrictions if the license quota is exceeded for an Enterprise license. Is there a restriction like Splunk where data cannot be imported if the license quota is exceeded a certain number of times within a certain period of time? Of course, we are assuming that it should not be exceeded, but we are concerned about the impact if a spike occurs due to maintenance, etc. and the license is exceeded. > Enforce License Quotas > If your data throughput exceeds your license quota: > • Free and Standard licenses enforce data ingestion quotas through limits on the number of Worker Groups/Fleets and Worker/Edge Node Processes. > • *Enterprise license keys turn off all enforcement.* > • When an Enterprise or Standard license expires, Cribl Stream will attemp

This message originated from Cribl Community Slack.Click here to view the original link.If we're implementing Github/Github Ops, should the repo be read-only. If I'm correct, you won't want to modify Cribl through anything but the UI unless it's specific .yaml files on servers right?

This message originated from Cribl Community Slack.Click here to view the original link.Hello all, working on trying to find volume for destination for each fleet, monitoring only allows for the last 1 day. Are there any specific logs that I can collect from the edge to be able to perform a search on the fleet to be able to see volume over a period of time, ideally at least the last 7 days. Thanks in advance.

This message originated from Cribl Community Slack.Click here to view the original link.In stream is there anyway to drop cribl metric events out of a pipeline?

The first step in setting up SSO is to make a ‘backup access’ account with an email NOT in the domain being SSO’d. Can anyone say if this needs to be a working account or is it just a Cribl-specific username/password which doesn’t need to receive emails?

I'm seeking assistance with connecting a Cribl Stream worker (running on a GCP VM) to our Cribl Cloud Leader. We are encountering a persistent connection handshake timeout error, despite extensive troubleshooting that indicates the network path through our corporate proxy is otherwise functional.Environment Details:Cribl Version: Latest (installed via install-worker.sh script) Worker OS: Ubuntu (GCP VM){"time":"2025-11-11T17:11:14.026Z","cid":"api","channel":"ProcessMetrics","level":"info","message":"stats","cpuPerc":0.69,"eluPerc":0.41,"mem":{"heap":108,"heapTotal":117,"ext":3,"rss":201,"buffers":0}}{"time":"2025-11-11T17:11:16.589Z","cid":"api","channel":"MetricsStore","level":"info","message":"active metrics","numMetrics":29}{"time":"2025-11-11T17:11:23.433Z","cid":"api","channel":"output:DistWorker","level":"warn","message":"sending is blocked","since":1762880150,"elapsed":932,"endpoint":{"host":"main-lucid-turcic-cir6n25.cribl.cloud","port":4200,"tls":true,"rejectUnauthorized":fal

Can i install Cribl Edge on my worker nodes without any production impact. `I want to use Cribl  Edge to monitor my Cribl Workers and certain files

Is there a way of directly integrating netskope with cribl using rest api’s without using s3 Buckets for transactional logs

Hi all, I just completed the Level 3 Prerequisite exam but I have a question.One of the questions was as follows:What would be the result of the Mask function with the following settings Match Regex =`(user_id=) (d+)" Replace Expression = C. Mask. random( ${g2}') on the event host=server. local user_id=12345?A)host=server. local aeQI9B) host=server. local user_id=fe8780bd8237b0388df7175034db75d6C) host=server. local user_id=aeQI9D) The event would remain unchanged because the Match Regex is invalid.I chose option D. But apparently this was the wrong answer. But I think it shouldn't be… Here is why.The event host=server.local user_id=12345….(user_id=) (d+) matches “user_ID=”(d+) is incorrect, d is just a literal d and not a digit in this case, it should have been \d+. There is also a space in the regex, but the event itself does not have a space. “user_id=12345”This is why the event would remain unchanged because the match regex is invalid. If I am wrong, please explain to me where I am

Hi everyone,Does any of you ever tried to use the Logging level  known as silly? I’ve tried to use it for troubleshooting an issues on my env, but after less than 10 minutes, my three worker nodes were experiencing memory issues. One of my nodes went completely down, the other two remained with less than 1 GB of RAM (starting from 9 GB of free space in the beginning). I just want to know your experience/opinion on this, is it possible that my memory was not enough? 

How can I get a list of users that includes their sso/mfa status?

How can I use a Cribl endpoint to retrieve a list of API Credentials created? I’m looking for a programmatic way to do this, not looking at a list via the interface. /system/secrets and /system/keys don’t seem to be the right endpoints. 

Hi,I'm working on code that uses an API key to access my data in Cribl. I started by creating API credentials (client_id and client_secret) and built a simple script to obtain an access token, which I plan to use for querying logs.Here’s the code I wrote:import requestsclient_id = 'XXX'client_secret = 'XXX'auth_url = 'https://XXX.cribl.cloud/api/v1/auth/token'payload = {'grant_type': 'client_credentials','client_id': client_id,'client_secret': client_secret,'audience': 'https://api.cribl.cloud'}headers = {'Content-Type': 'application/json'}response = requests.post(auth_url, data=payload, headers=headers)When I run this, I receive a 200 response, but the content is not in JSON format. Instead, the content is:you need to enable JavaScript to run this app.It seems to be returning the web application HTML rather than a JSON response with an access token. My goal is to use this token in a query to fetch logs.Could you please help me understand why the token request is returning HTML instead

Hi,Is there a way to find out which worker node processed an event, does it inject a field or can we configure it?Reason is we have some issues and this could narrow it down to a particular worker node.Cheers,Jay

How does the 'teleporting' function work on a technical level? Based on the documentation on ports (https://docs.cribl.io/stream/ports/), it seems no inbound ports need to be opened on worker or edge nodes for the feature to work. The leader node handles teleport functionality via port 4200. When teleporting to a node, does it simply stream the UI data to the leader, essentially mirroring the node's interface rather than establishing a direct session? I couldn’t find detailed documentation on this, and tools like TCP dump/Wireshark or internal logs haven’t provided further insights.Thank you :) https://docs.cribl.io/stream/ports/

We are running a PowerShell scrip to collect AD Computers using the Get-ADComputer cmdlet and we are receiving this type of response in Cribl which is not what we are expecting to receive:{"time":"2024-09-20T14:40:32.097Z","cid":"w0","channel":"input:test-retrieve_ad_computers","level":"error","message":"error from child process","data":{"0":65,"1":116,"2":32,"3":108,"4":105,"5":110,"6":101,"7":58,"8":49,"9":32,"10":99,"11":104,"12":97,"13":114,"14":58,"15":49,"16":53,"17":54,"18":13,"19":10}}

I’m attempting to leverage the REST collector to collect logs from Duo. The REST API requires authentication to be in the form of an HMAC-SHA1 signature in hex ASCII format. Instructions can be found here: Duo Admin API | Duo Security.At the very least, I’m curious if this is possible, and if so, how would one go about setting this up? Thanks!

I'm new to Cribl, so at this point we have single-instance Cribl Stream installed on premise. We just got a new SE, and he stated I need to move the Leader Node to the cloud as it's easier for him to troubleshoot. I have a cloud account created.I presume this is the distributed deployment, but the menus described in the documentation don't seem to align with what I see in the UI. https://docs.cribl.io/stream/deploy-distributed/ I'm not confident I have the correct software. Can Stream be converted into a worker node? Do I need the distributed deployment? Can anyone point me to a video that describes the process? I've looked on YouTube, but I've not had any luck.

How I can Parse Array of array in cribl stream. Each array element contains multiple strings.

I am trying to forward an exact duplicate of the syslog message. I have the route going thru passthru to not change the data. But I am getting the timestamp and original message host added to the message. Thoughts?Source: Syslog on 514/tcp/udp.Pipeline: passthruSource Data:<164>:Jul 23 12:34:15 CDT: %ASA-auth-4-987654: Group = 1234567890, Username = efghijk, IP = aaa.bbb.ccc.ddd, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:30m:29s, Bytes xmt: 0, Bytes rcv: 0, Reason: Idle TimeoutDestination Data:<164>Jul 23 12:34:15 lll.mmm.nnn.ppp :Jul 23 12:34:15 CDT: %ASA-auth-4-987654: Group = 1234567890, Username = efghijk, IP = aaa.bbb.ccc.ddd, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:30m:29s, Bytes xmt: 0, Bytes rcv: 0, Reason: Idle Timeout

Hello, I would like to ask about Cribl software support policy. In other words - where I can find info about how long is particular Cribl release supported and about End of support dates? Is it for Cribl available something like this docu for Splunk - https://www.splunk.com/en_us/legal/splunk-software-support-policy.html? Thanks in advance for help. Best regards Lukas Mecir