Hi All,
In an architecture I work with, we forward Splunk data through Cribl. We noticed that no data came in anymore after upgrading the Splunk sender to 10.4.x.
We use the recommended settings on the Cribl Source Documentation page, and additionally we have TLS implemented.
After some digging in the logs we noticed that Cribl thinks the data is compressed, despite data compression being disabled on both sides.
I tried to reproduce the issue on a minimal installation to prevent the possible effect of hidden configuration somewhere, and this exact issue comes up on a Splunk TCP sender + Cribl source with TLS enabled. When TLS is disabled on the Cribl source, forwarding works fine. The simple workaround without disabling TLS is to change the default Compression=Disabled to Compression=Automatic in the Cribl source.
Hope this helps!