Stream

Hi all,I'm currently testing Cribl's AWS Cloud Connections feature to onboard AWS logging sources across multiple accounts within an AWS Organization.I've followed the organization-wide deployment process: Created an Organization Root connection in Cribl. Deployed the generated CloudFormation template in the AWS Management account to establish organization-wide discovery. Successfully discovered S3 logging buckets in member accounts. Selected an existing S3 bucket and generated the integration CloudFormation template. Deployed that template in the member account (Log Archive), which successfully created the IAM ingestion role, SQS queue and associated policies. The issue:Cribl automatically generates the S3 Source's AssumeRoleArn using the Management account ID, rather than the member account ID where the IAM role was deployed.For example: Management account: 111111111111 Log Archive account: 222222222222 Actual IAM role: arn:aws:iam::222222222222:role/CriblInputRole-exampl

I have an issue where my cloud worker nodes were unable to send data to my S3 buckets and as a result, the data backed up. The issue with the connection to S3 appears to be resolved but the nodes are still errored out:Error: Unable to write to the filesystem, disk space is low.#secondsThrottled:1.188#throttledCount:2αthrottledFirstSeen:2026-09-25T00:47:16.159ZαthrottledLatestSeen:2026-09-25T00:47:17.347Z

 I am currently stuck on the lab (CC Admin - Stream | Stream Projects and Security Lab), specially task 3.2 and 3.3. I was unable to add the team to the project with the Editor role because permissions field was grayed out and did not allow me to select or modify any options. 

During the certificate review lab, we got stuck due to the delection of a dataset.The delection will be done after 24 hours, while the lab enviroment only least for 6 hrs. 

We've noticed that when sending data to Splunk Cloud that originates from an on-prem Splunk Heavy Forwarder (e.g. syslog and API), the Splunk license cost differs depending on whether we send the data via Splunk LB (S2S) or Splunk HEC destiantions. We think that the date_* and timepos fields are responsible for the increase in license usage. If we strip these fields in a Cribl pipeline before sending to Splunk Cloud, license usage looks fine and in line with direct-to-Splunk ingestions, but the events are then missing these expected fields (whereas with native Splunk components, the fields are present). The raw event size doesn't differ (| eval raw_len=len(_raw)). Have you encountered this before, and if so, how did you solve it?

Hi All,In an architecture I work with, we forward Splunk data through Cribl. We noticed that no data came in anymore after upgrading the Splunk sender to 10.4.x.We use the recommended settings on the Cribl Source Documentation page, and additionally we have TLS implemented.After some digging in the logs we noticed that Cribl thinks the data is compressed, despite data compression being disabled on both sides.I tried to reproduce the issue on a minimal installation to prevent the possible effect of hidden configuration somewhere, and this exact issue comes up on a Splunk TCP sender + Cribl source with TLS enabled. When TLS is disabled on the Cribl source, forwarding works fine. The simple workaround without disabling TLS is to change the default Compression=Disabled to Compression=Automatic in the Cribl source.Hope this helps!

I was cleaning my Cribl.Cloud instance, and deleted datasets that I no longer needed, unaware that these datasets were still being used by destinations in Stream. When going back to Stream afterwards, I could not load the Lake destination page and would get the following error:can't access property "filter", p.dependencies[t].oneOf is undefinedSuspecting the root cause, I deleted all my Lake destinations through the API, which went perfect without errors. But still, the Stream Lake destinations page won’t load and gives the same error.I believe this is a bug in the UI since all actions work perfectly through the API.Can anyone advise on how to reset the UI so that it forgets any corrupted history?Possibly unrelated, but since that event I also keep receiving general messages in the UI containing the following:Infrastructure for all Local Search Storage Engines could not be synchronizedWe were unable to update the infrastructure as requested. Please try again. If the issue keeps happeni

Just curious. I find the lack of support and community to make it harder to work with Cribl compared to other services.

Is it possible to install cribl stream and use node-oracledb in thick mode or there is no way to let cribl stream know that there is an oracle instant client package installed available in the podman container? thanks

An export of code is done to a json fromat only while on servers is used a yml fromat.IMHO, it should be possible to do import/export also in yml format. :)

Hi,I am facing an issue while using a REST API source (Cohesity audit logs).The API returns a valid JSON response in this format:However, in Cribl preview/capture, the data is not coming as a single complete JSON object. Instead:One event contains the correct full JSON Other events are split fragments (starting mid-string, not valid JSON)Example behavior:Event 1 → valid JSON object ({"auditLogs": [...]}) Event 2+ → partial JSON fragments (missing opening {, starting inside fields)Because of this:JSON.parse(_raw) fails or behaves inconsistently JSON Unroll cannot work reliably Derived fields (e.g., TimeGenerated) are null Parsing becomes impossible for many eventsObservations:cribl_breaker shows OData JSON:single-object Sometimes fallback behavior is applied Custom event breaker with JSON Array also did not produce consistent results Pipeline-level filtering/parsing only works partially because upstream data is already fragmentedQuestionHow can we ensure that the REST API response is tr

In a Cribl source could be added fields https://docs.cribl.io/stream/sources-tcp-raw#fields.So just wondering if such option could be possible also in destinations.PS: yes, I know I can use post-processing pipelines.

I'm getting 400 responses on a POST Body that I'm trying to pass through the state.latestTime within the POST body. I would like to know what is being posted.I don't seem to be able to get a debug log out of my REST Collector to see what it is POSTing. What it's deriving from state.latestTime.Anyone know where I can find this? The debug logs seem to only show the URL, not the POST Body

Hi all i am having issue parsing nested Json the event goes like {  "records": [    {      "time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}{"time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}  ],  "_time": 1766078828.252,  "index": "index",  "sourcetype": "sourcetype",  "source": "source"}so basically, records field have multiple Json event Nested in it  i want to extract to individual events with parent fields like metadata carried to each right now when i use event breaker i am getting no change can someone help me  

I am seeking technical guidance on configuring a Database Collector to connect to a Windows SQL Server using Domain/Windows Authentication from a Linux-based Worker Node.We are currently running Cribl Stream version 4.17.Our Worker Nodes are running on Linux, and we need to authenticate against a remote MSSQL instance using a service account within our Active Directory domain. While standard SQL authentication (local DB users) works as expected, we are looking for the best practice to implement integrated Windows authentication in this cross-platform scenario.

I am attempting to send data to a syslog destination with TLS enabled since it is from Cribl cloud over the internet to a VPS. The VPS has rsyslog listening on port 6514 with TLS and a letsencrypt cert.rsyslog is an rsyslog/rsyslog:latest docker container created yesterday.I have been able to successfully send data to the syslog listener from that same VPS using the following command:echo '<14>1 2026-04-12T14:14:00Z testhost test - - - My TLS log message' | openssl s_client -connect 127.0.0.1:6514 When I am attempting to set up the syslog destination in Cribl Cloud, I have the following settings:load balancing: enabledaddress: fqdn of destination listed in certificateport: 6514TLS: InheritTLS Servername: fqd nof destination listed in certificateloadweight: 1When I look at the config later it shows TLS disabled and the logs cycle through the following messages:“adding sender”“attempting to connect”“sender state change”“connected”“Setting I/O metrics level”When I do a test I get th

I been trying to find some formal documentation on bringing Proofpoint logs into Cribl steam and wonder if anyone had some experience or documentation they could share. At the time of this writing, there's not a cribl available for proofpoint logging.

Hi TeamI have completed the Tasks list as provided , but  for below TASK failed though i have completed as per the lab document, could you please help me apart from this everything shown as green. Attached screenshot for the reference   Task 11Make sure you have selected the "mobileOrders" Pipeline between the 'mobileOrders' source and the 'mobileOrders' destination.

unable to find unified_palo_alto.log in the dropdown present in Datagen Source, hence unable to complete the lab, I don't have chance of manually uploading of the log file to the datagen. Can some one help on resolving the issue

How can I customize the port HTTP (or raw HTTP) source listens on in Cribl.Cloud?10080 is the default, and https://docs.cribl.io/stream/ports/#cloud-ports seems to indicate that I can only use 20000-20010 for additional sources?I am trying to get a webhook configuration working for DocuSign and it looks like Docusign only supports 443, 1443, 2443, etc (https://support.docusign.com/s/document-item?language=en_US&bundleId=vob1727899215236&topicId=zjq1665170940873.html&_LANG=enus).Seems like this won't be the only challenge I’ll need to overcome based on the authentication methods DocuSign and Cribl support, but it's the first obstacle i see.I tried enabling an HTTP source to listen on 1443, but when testing with https://www.geocerts.com/ssl-checker it's telling me that this port isn't responding (while 10080 is), so it appears something on Cribl side….

Good morning. I am new user, and I am going through the DCR section of the Prepare the Azure Workspace walkthrough.  I have found the jsons here, however nowhere in any of the instructions does it say which DCR json to load for this setup process, and none are named in such a way to obviously be the one I’m looking for. Anyone has any advice on this? Or am I just completely reading this incorrectly?

I have a need to send json formatted data to a beats (lumberjack) input. I am new to cribl and wondered if there was a pre-configured output that could be used to send lumberjack protocol based json to a receiver?My current SIEM solution has a json parser, but is using a Beats receiver as the only way to receive it.Thanks,

How do I identify the correct ingest API endpoint (POST /api/v2/logs/ingest) and validate tokens when the UI uses apps.dynatrace.com but the backend lives under live.dynatrace.com?”

Does Cribl Stream evaluate mask rules sequentially, and is there an optimal ordering strategy for high‑complexity regexes?

Hi All i am migrating some sources from source →lb → syslog →  splunk to source → lb → cribl → splunk I am seeing few big events landing on plunk via syslog but the same event when i search on cribl syslog source the events are not visible at all can anybody suggest if there are any setting at cribl that can cause this drop.