Stream

I am new to cribl and trying to setup Splunk HEC destination from cribl sanbox stream instance. I have provisioned a free splunk cloud instance and setup HEC. While I can send data via: curl -k "https://<host>:8088/services/collector" -H "Authorization: Splunk 38aa4a38-8fd5-4faa-afc4-9b3533ac39c7" -d "{"event": "Hello, world!", "sourcetype": "manual"}"I am unable to run destination test from cribl with the exact endpoint or with /services/collector/event. Everytime the request time out with error:2025-02-20T14:23:57.956αtime:2025-02-20T14:23:57.956Zαcid:w0αchannel:output:splunkαlevel:errorαmessage:error while flushingαioName:splunk_hecαioType:destination{}error:αmessage:request timeoutαstack:Error: request timeout at /opt/cribl/bin/cribl.js:15:9721630 at new Promise (<anonymous>) at p.doHttpRequest (/opt/cribl/bin/cribl.js:15:9721585) at runNextTicks (node:internal/process/task_queues:60:5) at process.processTimers (node:internal/timers:509:9) at async p.buildRecProm

I am trying to pull in DNS Logs from Cisco Umbrella. I have my S3 Connector configured to pull down the logs every 5 minutes. The problem is that it pulls down all the logs. I only want the new logs. I have tried adding the follow to my Conf section of the JSON configuration but it doesn't appear to work."trackProgress": true,      "trackMode": "file",      "trackField": "s3.object.etag",      "useLastModifiedTime": true

Hi, I have gone through the cribl university user and admin courses and setting up the product is quite easy however am constantly stuck trying to parse or extract strings of data into fields so that we can search or use the information.For systems which send in JSON or CSV it is very simple, however most of ours are embedded Linux or network devices which give something like the following:<183> 02/06/2025:00:24:20 GMT NYDC1VPX01-DMZ 0-PPE-0 : default SSLLOG SSL_HANDSHAKE_SUCCESS 9838002 0 : SPCBId 33168208 - ClientIP 10.1.1.130 - ClientPort 57486 - VserverServiceIP 10.200.80.80 - VserverServicePort 443 - ClientVersion TLSv1.2 - CipherSuite "TLS1-AES-256-CBC-SHA" - Session New - HandshakeTime 47 msShowWhat combination of functions can split this out into fields such as hostname, clientip, clientport, etc.I have tried using ChatGPT to help and can get regex and grok expressions from the AI however these don't work when applying to cribl. I don't see many questions on this topic

Hi EveryoneWe have integrated Azure Storage Account and Azure Application Gateway with CrowdStream (Cribl Stream) via EventHub. Since logs are in nested JSON format, we used unroll function to convert them into individual events before forwarding them to CrowdStrike NGSIEM.Currently, we are observing that Bytes Out size is twice that of Bytes In. While we understand that event count should double, our concern is why Bytes Out size is also doubling compared to Bytes In. Additionally, we have not observed any duplicate events in CrowdStrike NGSIEM.

Hi everyoneI have different locations which need to have separate cribl stream installed on each location .. Which means standalone deployment. In this case how the license will be deployed .. Will it have separate enterprise license applied to each Cribl instance ?

I have installed cribl standalone on a VM , but need to change it to leader ..Do I need a worker node or only a leader can do the processing work as a stream ?If worker node is required, can the same VM be a leader and worked node together ?

Hello,I'm new to Cribl stream and am having difficulty translating the API spec from the documentation. I can get all the curls working fine, but I don't know how they translate to cribl. For example, if I'm trying to use cribl for this type of curl:curl --location --request GET 'https://public-api.cloud.meater.com/v1/devices' \--header 'Authorization: Bearer <JWT>'What would my discover and collect headers look like to include the "Authorization: Bearer <JWT>?Cribl is authenticating correctly (I managed to figure that out), but all my requests result in a 400. My authorize expression is `Bearer ${token}`Any help/insight would be greatly appreciated.

Hi,Is there a way to find out which worker node processed an event, does it inject a field or can we configure it?Reason is we have some issues and this could narrow it down to a particular worker node.Cheers,Jay

I am attempting to record which server logs are being collected, e.g. last seen, and I haven't found that capability yet. I am thinking I need something custom, maybe write to a file or a lookup. The cribl documentation doesn't provide much in the way of specifics when it comes to implementing scripts, except an ominous warning. I am new to the product and any help is greatly appreciated.

I would like define a Readis connection at the beginning of pipeline and reuse by a code functions through all an event live-time.Something like "C.Lookup" expression.PS: A Redis function is not applicable for my needs :).

Hi I am having some problem to get the host name out of some sample log files, the format is RCF 3164. And thru the documentation it says Cribl will try to parse that itself, do I need to decelerate that it syslog as a source?

L.s.,Maybe easy answer for all of you . We have got an HEC input and when i capture the live data i see as host the Cribl worker which is recieving the data. Why is that host filled?In the message itself there is also a host, but the right one. So i send the message in _raw to Splunk and delete the rest (also the wrong host). But tadaa.. there are two host in Splunk. The reciever Cribl and the one from the message.Any clue why?Thanks in advanceJari

Hi,Maybe a simple answer (i hope). For a route we want to filer the host.name, but there are a lot of host in the list so a wildcard is the best way to filter.So doing like 'drnms10*.dmz.somewhere.nl' in the filter for the servers matching with this wildcard. But with a filter 'host == 'drnms10*.dmz.somewhere.nl'' wil not work. What is the best way to do this?I tried with a C.lookup and a lookup file.. it wil work. But stil have top maintain a list. And is a C.lookup not very slow in a filter?Thanks for the answer :)greetsJari

I am getting the following error in stream from REST Collection. message:Validation error (WrongType@[events]) : argument 'between.startTime' with value 'StringValue{value='`${C.Time.strftime(new Date((earliest * 1000.toISOString()}`'}' is not a valid 'DateTime'Here is the schema for GraphSQL and Collect POST body i am using. What am i doing wrongly? can any help with setting the correct time value.GraphSQLbetween: { startTime: "`${C.Time.strftime(new Date((earliest * 1000.toISOString()}`" endTime: "`${C.Time.strftime(new Date((latest * 1000.toISOString()}`"}Collect POST bodybetween: { startTime: \"`${C.Time.strftime(new Date((earliest * 1000.toISOString()}`\" endTime: \"`${C.Time.strftime(new Date((latest * 1000.toISOString()}`\" }

Hi, i'd like know what is recommended method to save Zabbix event data (source) to mysql (destination). I understand that mysql is not typical and preffered destination but thats my use case. Thank you

we are removing some fields using Eval function but the bytes_in and bytes_out are still the same. But, in the pipeline statistics we can see the bytes_out is reduced but it is not reflecting in the Monitoring → Flows.

I am getting data into Cribl and it is by default breaking on each line (also when there is no timestamp). So, i have added manual event breaking based on timestamp. But it still the same behavior. Is there a way to disable line breaking on each line?

Akamai has the SIEM API which allows to capture security events generated on the Akamai platform. We have been getting these events to Splunk via Splunk Add-on earlier https://splunkbase.splunk.com/app/4310/ and decided to try Cribl REST collector. After giving collect URL's & required credentials in collector's config, I can't see the events from Akamai and getting 400 error. not sure what's getting missed. "type": "https://problems./-/pep-authn/request-error", "title": "Bad request", "status": 400, "detail": "Authorization header missing",

I want to report on logs ingested with Cribl in the Splunk environment. The logs will remain stored on the Cribl side, but the reporting will be done in Splunk. How can I achieve this?The logs are NOT forwarded to Splunk.thank you in advance for your answers

I have tried Event Breaker on this type of data but it didn't work, it can't separate the record into individual events note: this is the live data streamed from Azure event hub and this is the event breaker configuration but if I use the same pipeline or the event breaker at the knowledge with the data in that shape it works fine and splits every record into an event I tried to use unroll but also didn't work so any suggestion on how can i solve this issue?thanks,

Hello, I would like to ask one thing: is it possible to use some database (SQL etc.) as a data source for lookup? One of our customers has a database that contains data that he would like to use to enrich events processed on Cribl Stream. The idea is that he would read the data from the database into Cribl Stream using a suitable connector, save it as a CSV file and then use that as the source for a lookup to use in the pipeline. Since I don't have experience with something like this yet, I would like to ask: Is there anyone who has experience with this? Is this a feasible way? And if so, is it suitable or are there better ones? What is there to be careful about performance, load on Cribl and the database, etc.? (Enrichment would involve about 200 events per second, the database is in the lower tens of thousands of rows, and the data in the lookup should be refreshed once per hour.) Any experience, ideas or recommendations would be greatly appreciated.Thank you very much.Lukas Mecir

Hi,I'm trying to setup a Splunk HEC within Cribl Stream, and I'm encountering the error "malformed HEC event." I've encountered that error when setting up HECs in Splunk, and to correct the problem I have to go to Source type > Select Source Type > Structured > _json when editing the HEC's settings. I've been looking and reading search results, but so far I haven't found the equivalent setting in Cribl Stream. Where can I find that setting for the HEC please?

We are planning to enable gitops workflow for production and from the docs we understood that the production environment will be “read only” if the gitops workflow is set to “push”. What if there is outage with “git” and we can’t do the release? What is the alternative to push the code without git?

How I can Parse Array of array in cribl stream. Each array element contains multiple strings.

I am trying to forward an exact duplicate of the syslog message. I have the route going thru passthru to not change the data. But I am getting the timestamp and original message host added to the message. Thoughts?Source: Syslog on 514/tcp/udp.Pipeline: passthruSource Data:<164>:Jul 23 12:34:15 CDT: %ASA-auth-4-987654: Group = 1234567890, Username = efghijk, IP = aaa.bbb.ccc.ddd, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:30m:29s, Bytes xmt: 0, Bytes rcv: 0, Reason: Idle TimeoutDestination Data:<164>Jul 23 12:34:15 lll.mmm.nnn.ppp :Jul 23 12:34:15 CDT: %ASA-auth-4-987654: Group = 1234567890, Username = efghijk, IP = aaa.bbb.ccc.ddd, Session disconnected. Session Type: LAN-to-LAN, Duration: 0h:30m:29s, Bytes xmt: 0, Bytes rcv: 0, Reason: Idle Timeout