Skip to main content

Currently I'm ingesting Windows Classic and Windows Sysmon XML using Splunk UF, and apply corresponding packs to convert to JSON and some custom modifications. Until few days everything worked, but now we are receiving empty or broken messages.

I'm running Splunk UFs 9.0.4/Splunk Cloud 9.0.2209.4 and Cribl 4.2.2.

Config on UFs, as recommended in the docs. On Cribl Worker s2s is v4.

[tcpout]

disabled = false

defaultGroup = cribl-worker-1

[tcpout:cribl-worker-1]

sendCookedData = true

server=x.x.x.x:9997

I noticed that Cribl defaults to fallback event breaker. No error/warnings in Cribl logs.

412_da1172831cbf494ebd6174a47721296e.jpg


412_bef16b6e1fa7441e8c6311440e9d8140.jpg

Did this issue start after you upgraded to 4.2.2? Any other changes around the same time that you noticed this issue?

There were some errors regarding s2s, which were solved by upgrading from 4.1.X to 4.2.2, but event braking problems were there before the upgrade.

Just for someone who have the same issue, changing s2s from v4 to v3 solved the issue.

Reply


Terms & ConditionsCookie settings