Hello everyone,
is there a “best practise” way to collect internal and metrics logs from the cribl leader?
For worker is an existing Source called “Cribl Internal”.
Thank you
Question
Cribl Leader Logs to Splunk
Best rec right now is to install Edge on the Leader host and collect the logs using that. You can also opt for any of the other agents.
I believe you could join the Leader as a managed node. You could also install Edge and run it as a singleton. Access it on port 9420 and configure a file monitor on /opt/cribl/log.
Another option is to use the agent you are familiar with like the Splunk UF or a FileBeat. Logs then get forwarded to your worker group.
Another way would be be to collect them using the REST API. A thread on Community Slack: Slack
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.