Solved

I was asked by the customer if it is possible to configure Cribl to sign the commits to github? They use remote git for backing up the configurations.

Hello , I am trying to change the format of Timestamp within _Raw using Mask function, Can you help to convert 2023-05-24T12:34:37.490Z into 05-24-2023 12:34:37 format. I do not want to create a sperate field for the converted time instead I want to see the changes with _Raw.

Where abouts on a windows system would Cribl Edge have local application logs stored? trying to troubleshoot

my raw event looks like this α    _raw: `*Mar 31 09:21:11 10.x.x.x* time=1680239950|hostname=D-xxxx|product=test` I want to drop only the syslog header part (shown in Bold above) I am trying to use parse with extract and serialize. I also tried with parse (reserialize) but the full event length is going high, I need to drop header and reduce the size of full event as well... how can I do this?

Does Edge have any local application debug / error logs? Dug through the install directory and nothing seemed to jump out as an obvious log file.

:question: on S3 Replay -> Splunk. Is it necessary for the destination Splunk Index to have retention settings that honor the timestamps of the replayed data? For example, If my index 'proxy-logs' has a retention of 180 days, and I replay data into it with timestamps that is > 200 days, I presume that data would be immediately evicted/frozen by Splunk?

Anyone know where the the Auth logs for cribl are? Can't seem to find them in my workers...

Hello.Has anyone here used API calls to perform Health Checks from a F5 VIP to the Worker Nodes? From the following link… https://docs.cribl.io/stream/usecase-syslog/It mentions to do the following… If UDP data is being sent, the load balancer has no way to automatically detect whether the destination is up. Configure the load balancer to use API calls to the Worker Nodes to check the health status of each Node.If you have done this, what API call should be performed?

Is it possible to use the REST API to run a collector job?

Random question, and doesn’t really affect me or customer base atm, but is something that ALWAYS comes up with Splunk SaaS. When we say that that Cribl.Cloud instance is deployed within a VPC, is this VPC individual to the customer, or are they a tenant?Original Post is from https://cribl-community.slack.com/archives/C022FME74PM/p1664401586748939

For the on-prem workers in a hybrid deployment, which ports need to be open inbound?  Doc mentions 4200 and 443 outbound to Cribl cloud, but is communication from the Cloud back to the worker also on 4200? Or another port?

Hello, I haven't logged into my free instance for a while.  But now my commit buttons are greyed out with an error "Commit message must be at least 2 characters long".

Hi guys, we are trying to configure Cribl Search to query S3 bucket but have been facing error that says "Error initializing task queue" .... "Access Denied"We are seeing the Cribl Stream worker AssumeRole into our AWS account for the existing S3 Source Collector that we have configured previously but, we’re not seeing any Cloudtrail logs in our SIEM to show that the Cribl Search role (new role that we created in AWS to configure Cribl Search only) is able to AssumeRole into our account i.e we’re not seeing any STS logs in SIEM for Cribl Search role.Can anyone provide help on this?

Any plans to make a more mobile friendly search page or even an app?

Can search read gzip files?

In the “File Monitor” Allowlist, can I use REGEX expressions like \d{2} or just ! & *?

If all owner/admin access is lost to a Cribl Cloud org/tenant that is currently setup to use SSO then how does anyone re-gain admin access?

Afternoon (at least on my side).Need some help on my side. I've got a Splunk HF cluster sending events to my Cribl cluster. The HFs are experiencing this issue every now and then:08-16-2023 09:29:32.056 +0200 WARN  TcpOutputProc [12084 indexerPipe_1] - The TCP output processor has paused the data flow. Forwarding to host_dest=xx.xx.xx.xx inside output group cribl_out_group from host_src=xxxxxx has been blocked for blocked_seconds=10. This can stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.It's not happening too often, so I guess the questions are:Should I be worried?If yes, where do I start looking for what might be causing the issue on the Cribl side?

Can Cribl Stream read AWS S3 tags? I know there are multiple places where you can add tags to parts of the stream, such as in the Source or in a Pipeline, but I want my stream to be able to read the tags that are assigned via S3 in order to filter them. If that's not possible, would I be able to call a Lambda function and use that to manage the tags instead?

How do I write a database query for a DB Collector that uses state-tracking for MS SQL?

For a JSON log using the default Cribl JSON event breaker, do you know what the name is of the top most object?  For instance, _raw is an object, but what is the name of the object containing _raw?

In the monitoring section, how is Free Memory calculated per worker?

The host name was showing up properly in the old version 4.1.0, but now the host shows up as the ip address of the first interface on the box.  This is bare metal

Does anyone have a splunk universal forwarder config they typically use for forwarding?Original Question: https://cribl-community.slack.com/archives/CPYBPK65V/p1690293855973699Original Author: Matt

Just curious. I find the lack of support and community to make it harder to work with Cribl compared to other services.