Skip to main content

Stream

Ask and answer questions about routing, shaping, and optimizing observability and security data.

  • 286 Topics
  • 610 Replies
286 Topics
P
Pawel KwiatkowskiInspiring
asked in Stream
A which version of the Cribl support integration with the BigPanda?

A which version of the Cribl support integration with the BigPanda?

02
S
H
hannes.leutloff@rentenbank.deNew Participant
asked in Stream
[MinIO Destination] Custom CA for TLS

Hi community,I'm trying to route log data to a self-hosted minio cluster that uses certificates generated using a custom certificate authority. Other destinations allow me to set the path to my CA - the MinIO destination does not seem to have that option.Is there a way to configure a CA so that this works?I have also already tried to disable the "reject invalid ssl cert" option, but the events are still not routed to the destination. It always gives the error "self-signed certificate in chain".Thanks in advance,Hannes

54
H
G
Govardhanen GopalParticipating Frequently
asked in Stream
What cribl internal fields are available to be used in route filters in pre processing packs?

Hello,I am re-factoring a lot of our code + workflow and trying to simplify stuff. I ran into this issue and I wanted to check with the community + cribl folks if they could give some guidance.We have a few groups, some groups have an rsyslogd input configured. This is configured as "networkrsyslogd". As you can imagine we have networking gear sending out its events over. I stood up a new "Pre-Processing-Pack" and I tried to use create a route filtering via the cribl internal field __inputId but alas this did not work, I further configured the above input to include a new field inputName="networkingsyslog" and further when I used this as as a filter in routes, things work. That said, other than fields that are emitted by the source, what cribl internal fields can I use for filtering purposes? I thought logically this should have been stamped on the events as soon as it hits stream or edge, but doesn't look like it does.Thank you!g

134
Jon Rust
M
m_aslamNew Participant
asked in Stream
Syslog unable to connect to Cribl

i am using Syslog-ng to send logs to Cribl (distributed deployment ).In this setup, A cribl leader and one single worker is configured.in the syslog-ng , i configured it to send to Cribl leader IP using port 5514.but i got an error that syslog connection failed:but when i set the Cribl worker as destination in syslog-ng it works!I asssumed initially that the Cribl leader IP should be set in the destination part in syslog-ng config file but doesnt work that way as i had error (mentioned above).Apparently when we have multiple worker nodes. should we redirect to just one worker?how does this works?

52
M
C
chiranjeev singhNew Participant
asked in Stream
can a leader node become worker node of another leader ?

We are trying to build a region based leader worker node configuration and a central leader to manage all those regional leaders .Is this possible ?

03
Jon Rust
J
joe seniorNew Participant
asked in Stream
Cribl distributed upgrade from 3.0.4 to 4.5 question

hi,I will be upgrading Cribl distributed upgrade from 3.0.4 to 4.5 and Just wanted to ask if we need to upgrade worker nodes in the default worker group if we don’t use them and will be decommissioned after the upgrade?thanks

02
J
M
Murugesan MathevanpillaiNew Participant
asked in Stream
Cribl SSL errors when connecting to Splunk Load balancer

Getting SSL errors on Cribl(client) connection to Splunk LB instances at Splunk clod. Getting client disconnected before establishing TSL communication. How do I address this?

51
Jon Rust
T
Teja VivekNew Participant
asked in Stream
How do I create a Pack From API, there is documentation for Wizz API Integration with Cribl?

How do I create a Pack From API, there is documentation for Wizz API Integration with Cribl?

01
A
J
Justin MotaNew Participant
asked in Stream
Configuring S3 bucket for Cisco Umbrella

Has anyone been able to configure an S3 collector for Cisco umbrella? I'm certain the fields for Path and S3 bucket are correct but nothing is being pulled and I'm not sure where the issue is. Any guidance or tips are appreciated.

181
M
B
brandonfNew Participant
asked in Stream
Cribl Metric from Windows Pack

Hi EveryoneI am have a strange problem with metric feed from a route that uses the Windows Pack. I currently forward ALL my Cribl metrics via Quickconnect to Splunk and simply add a index and sourcetype field (no other changes).When run my mstats search on cribl.logstream.route.in_bytes and cribl.logstream.route.out_bytes and split by the route name. The only metric i dont seem to see if the route that uses the Windows pack? I have tested a couple other packs like fortigate and that works. I do however see metrics using cribl.logstream.sourcetype.in_bytes and cribl.logstream.sourcetype.out_bytes when I use event_sourcetype? Find this a bit bizarre?Thanks

01
M
S
Sanvy Ronny SabapatheeNew Participant
asked in Stream
Cribl Parser Question

HiyaI have a pipeline set up from a datagen source (business events) - see attached first imageAs you can see the event has fields, now I want to remove fields - source and sourcetype - no matter what I try in the "fields to remove" nothing gets removed (see output) belowI am trying to get the UI to show in red - the fields that are to be dropped here is something even weirder - when I do "!(name.startsWith('source'))" for filter by expression - it shows me the new JSON payload but the UI still has source and sourcetype in it.

23
S
M
michael.danielsNew Participant
asked in Stream
Rest API - Logs not going to destination. Preview/Discover work.

I'm using a Rest API to grab logs from a cloud provider. I can see the logs are pulled from the API. I can see that the data is formatted correctly. Within my Data Source. Result Routing → Sent to Routes: NO Pipeline: passthru Destination: SIEMPreview [Before Destination]: Shows my data formatted correctly. Discover: Sends a few lines to my SIEMFull Run: Nothing happens. Any ideas on what to look at to figure this out or how I can troubleshoot this would be greatly appreciated.Thanks!

12
M
M
Matt MarkwaldNew Participant
asked in Stream
Trouble sending syslog to Stream

We have configured a Cribl syslog source to listen on TCP and UDP port 514 however when we check in status of source we see the state as red and a netstat -rn in the OS does not show the port as listening.

302
B
G
G HParticipating Frequently
asked in Stream
What is a worker node's internal shutdown sequence?

I haven't found any documentation for this - please point me at it if it exists - but I wonder what the shutdown procedure of a worker is?I assume it stops all active listeners, then finishes processing any in-flight events before shutting each thread down?Does it disconnect from the leader before processing those events, or otherwise remove itself from the pool of workers available to run collections?Does it attempt to drain it's persistent queues? If so for how long and what happens it if fails?Do destination connections stay up till the very end, or does each get disconnected as soon as there are no more events destined for it?Plus lots of other considerations I'm sure - would be useful have a bullet list or flow chart of the shutdown sequence for reference.

81
Jon Rust
M
Matt MarkwaldNew Participant
asked in Stream
Cribl cloud access details information

What are the URL's and addresses used for in the Cribl cloud access details pop up:

391
B
A
Ale DiazNew Participant
asked in Stream
Cribl Destination returning error

Hi, I'm trying to setup a chronicle destination but I'm receiving the following error:Connection error: Client network socket disconnected before secure TLS connection was establishedI have tried curling the endpoint from my worker and I can see a successful connection, I'm not sure what I'm doing incorrectly.

104
A
T
Teja VivekNew Participant
asked in Stream
How do we create a Pack for a Security tool that doesn't have pack to convert data into OCSF?

How do we create a Pack for a Security tool that doesn't have pack to convert data into OCSF?

41
K
F
Florian UtztNew Participant
asked in Stream
REST Collector - complete variable reference

Hi everyone, I can't find a complete list of available variables to use in the REST collector configuration. I only know those that are embedded in the documentation (for example, ${earliest}). Is there a complete reference table which I may have overlooked?

22
F
F
Florian UtztNew Participant
asked in Stream
REST Collector Strategies - pull all events since last run

Hi, for most of my SaaS services, I have to use the REST collector to pull events periodically, as they do not support sending their events directly into Cribl. I wonder what the recommended strategy is to ensure that all events are getting collected. What schedule is common to run the REST collector on? every few hours or rather minutes?Most APIs support giving a "from" timestamp parameter - but what variable can I use within Cribl to reference "the last run time of a job" ?In general: Is it better to give the API precise instructions beforehand, so it will not return events already collected, or is it better to just collect duplicate events and then drop them in Cribl (I did it with a Suppression rule, but the thresholds need to be very long)Thanks a lot.

61
Jon Rust
R
Robbert HinkInspiring
asked in Stream
What does an "Unsupported op-code 249" mean?

Why do we see this message when using Cribl v4.4.0 with S2S V4 and Splunk forwarder version 9.1.x:{"time": "2023-12-19T15:16:15.549Z","cid": "w0","channel": "input:in_splunk_tcp","level": "error","message": "closed connection","src": "10.10.10.10:62453","error": {"message": "Unsupported op-code 249.","stack": "Error: Unsupported op-code 249.\n at g._processData (/opt/cribl/bin/cribl.js:15:15721335)\n at g._transform (/opt/cribl/bin/cribl.js:15:15717080)\n at Transform._write (node:internal/streams/transform:175:8)\n at writeOrBuffer (node:internal/streams/writable:392:12)\n at _write (node:internal/streams/writable:333:10)\n at Writable.write (node:internal/streams/writable:337:10)\n at TLSSocket.ondata (node:internal/streams/readable:766:22)\n at TLSSocket.emit (node:events:513:28)\n at TLSSocket.emit (node:domain:489:12)\n at TLSSocket.<anonymous> (/opt/cribl/bin/cribl.js:15:12649570)\n at addChunk (node:internal/streams/readable:324:12)\n at readableAddChunk (node:internal/str

71
B
K
KalebNew Participant
asked in Stream
Data cloned on F5 and sent to Cribl workers

Posting this to get community feedback and track our progress in case anyone encounters this issue in the future.We are attempting to use the data cloning functionality on our F5 load balancer to duplicate data to our Cribl workers. We want to do this so that we can route, filter, and reduce production data in Cribl without impacting production operations. When the time comes, Cribl will be ready for the cutover without much impact at all, hopefully.Right now, the F5 is sending data to our syslog servers, which then send to Splunk. The end goal is to replace syslog with Cribl, but we want to be able to see all the data in Cribl before then so that we can operate on it. We are successfully cloning data that comes from Splunk UFs and HFs, but the cloned syslog data from the F5 is not being seen by the Cribl worker.The specific problem is this: The data is making it to the to the correct interface and port on the worker, but is not being picked up by Cribl for whatever reason.I have verif

212
Jon Rust
U
User1Participating Frequently
asked in Stream
Error: Initialization error: bind EADDRNOTAVAIL

Hello, has anyone encountered this error? i'm trying to forward my firewall logs to Cribl.I added Syslog Push via QuickConnect. Address: is public IP address of the firewallUDP port: 1514On my firewall Settings:Syslog Server Address: is the Ingress IP of Cribl CloudPort: 1514Are these the correct settings?

3711
Jon Rust
B
Brian YearwoodInspiring
asked in Stream
What do the different fields mean in for the info events for the channel func:dns_lookup

channel: func:dns_lookupcid: w11cribl_postproc_pipe_ts: 1702407784.731hits: 1399991keys: 3ksize: 50level: debugmessage: Cache statsmisses: 9time: 2023-12-12T19:03:04.731Zvsize: 240

11
M
K
kgouldsk@live.comNew Participant
asked in Stream
Replication functionality of AD Group filtering of subscriptions

What is the recommended method of restricting groupings of clients/servers to accessing event collector subscriptions, absent support for computer group control that WEC has?I thought about creating additional listeners and via GPO pointing particular groupings of clients at particular listeners. Is there a better alternative?

22
K
J
Johan WogerInspiring
asked in Stream
what does "Cannot advance offset 2023514992 past end of event 74" mean?

Would it be possible to confirm:What does Cribl do with the events when this issue occursWhat is the maximum character limit CRIBL can parse

11
B

Badge winners

Show all badges
Terms & Conditions