Stream

Hi TeamI have completed the Tasks list as provided , but  for below TASK failed though i have completed as per the lab document, could you please help me apart from this everything shown as green. Attached screenshot for the reference   Task 11Make sure you have selected the "mobileOrders" Pipeline between the 'mobileOrders' source and the 'mobileOrders' destination.

unable to find unified_palo_alto.log in the dropdown present in Datagen Source, hence unable to complete the lab, I don't have chance of manually uploading of the log file to the datagen. Can some one help on resolving the issue

How can I customize the port HTTP (or raw HTTP) source listens on in Cribl.Cloud?10080 is the default, and https://docs.cribl.io/stream/ports/#cloud-ports seems to indicate that I can only use 20000-20010 for additional sources?I am trying to get a webhook configuration working for DocuSign and it looks like Docusign only supports 443, 1443, 2443, etc (https://support.docusign.com/s/document-item?language=en_US&bundleId=vob1727899215236&topicId=zjq1665170940873.html&_LANG=enus).Seems like this won't be the only challenge I’ll need to overcome based on the authentication methods DocuSign and Cribl support, but it's th

Good morning. I am new user, and I am going through the DCR section of the Prepare the Azure Workspace walkthrough.  I have found the jsons here, however nowhere in any of the instructions does it say which DCR json to load for this setup process, and none are named in such a way to obviously be the one I’m looking for. Anyone has any advice on this? Or am I just completely reading this incorrectly?

I have a need to send json formatted data to a beats (lumberjack) input. I am new to cribl and wondered if there was a pre-configured output that could be used to send lumberjack protocol based json to a receiver?My current SIEM solution has a json parser, but is using a Beats receiver as the only way to receive it.Thanks,

How do I identify the correct ingest API endpoint (POST /api/v2/logs/ingest) and validate tokens when the UI uses apps.dynatrace.com but the backend lives under live.dynatrace.com?”

Does Cribl Stream evaluate mask rules sequentially, and is there an optimal ordering strategy for high‑complexity regexes?

Hi All i am migrating some sources from source →lb → syslog →  splunk to source → lb → cribl → splunk I am seeing few big events landing on plunk via syslog but the same event when i search on cribl syslog source the events are not visible at all can anybody suggest if there are any setting at cribl that can cause this drop.

I’m looking to better understand how to monitor employee access to different applications via SSO. What approaches or best practices are others using?

After log configuration on port 1515 for some firewall logs, we observed logs are getting dropped and not all logs are forwarding to splunk.We observed udp drops on RHEL OS level, where we increased the max_mem_buffer size to 256 MB , but still same thing - Please check below output.But still we are getting buffer issue as provided in below output.[root@hostname ~]# cd /etc/sysctl.d/[root@hostname /etc/sysctl.d]# lltotal 4lrwxrwxrwx. 1 root root  14 Sep 12 16:14 99-sysctl.conf -> ../sysctl.conf-rw-r-----. 1 root root 187 Dec 11 16:08 99-udp-tuning.conf[root@hostname /etc/sysctl.d]# cat 99-udp-tuning.confnet.core.rmem_max=268435456net.core.wmem_max=268435456net.core.rmem_default=268435456net.core.wmem_default=268435456net.ipv4.udp_rmem_min=262144net.ipv4.udp_mem=65536 131072 262144[root@hostname /etc/sysctl.d]#[root@hostname /etc/sysctl.d]# netstat -usIcmpMsg:

Hi all i am having issue parsing nested Json the event goes like {  "records": [    {      "time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}{"time": "2025-12-18T17:25:46.3598689Z",      "operationName": "Publish"}  ],  "_time": 1766078828.252,  "index": "index",  "sourcetype": "sourcetype",  "source": "source"}so basically, records field have multiple Json event Nested in it  i want to extract to individual events with parent fields like metadata carried to each right now when i use event breaker i am getting no change can someone help me  

Hello everyone! I’m quite new to Cribl, but I’ve spent about 10-20 hours so far reading the documentation. I’d like to send Windows event logs from on-prem servers and workstations to Azure Storage with the sort of parsing/normalisation that you’d have from Azure Monitor Agent (such as the SecurityEvent and WindowsEvent structures). This isn’t directly possible with Azure Monitor Agent and the AgentDirectToStore kind in Data Collection Rules (only Azure VMs are supported). I’m hoping that one of the Cribl products can help me with this. I looked at the Sentinel pack, and it appears to only support forwarding data to Sentinel. Is there an existing solution for mapping/normalisation/transformation (I’m not sure which term(s) are appropriate here: pipelines are so complicated!)? My environment has a lot of events across many log providers, and I’m also not sure what kind of magic that Azure Monitor Agent does to events (ie, is it just changing field names? Does it enrich

Hello.  I am a total newb with API integrations and was hoping for someone to help me set up an integration between Delinea and Cribl.  I again am totally new at this and just dabbled at a couple of Cribl University courses but I need to get on the fast lane.  Is there anyone that has done this already than can walk me through this configuration.  If there is any additional details needed to clarify please let me know. So far in the Delinea platform I have followed their instructions and enabled the Syslog/CEF Logging option.  As for the entries I had to enter into the field I’m not sure if I did this right.On the Cribl side I tried setting up a Syslog Source but not sure what to enter into the field either.Hope someone can assist.Thanks!

i have corelight events which  has id.orig_h ,id.resp_h etc fields , but when i try to rename them using eval src_ip=id.orig_h… it doesnt work , the RENAME fucntion works though, I dont want to use rename because i dont want to lose original fields , i also cant use corelight pack because it is also using rename , how can i rename without losing original field???

how can i setup cribl hec source or the splunkhec destination to drop data older than 24hrs ?

We are planning to integrate SailPoint log with Cribl and send to Cribl lake. Is there any specific Cribl doc for the same? Or anyone has done this integration in the past?

I'm seeking assistance with connecting a Cribl Stream worker (running on a GCP VM) to our Cribl Cloud Leader. We are encountering a persistent connection handshake timeout error, despite extensive troubleshooting that indicates the network path through our corporate proxy is otherwise functional.Environment Details:Cribl Version: Latest (installed via install-worker.sh script) Worker OS: Ubuntu (GCP VM){"time":"2025-11-11T17:11:14.026Z","cid":"api","channel":"ProcessMetrics","level":"info","message":"stats","cpuPerc":0.69,"eluPerc":0.41,"mem":{"heap":108,"heapTotal":117,"ext":3,"rss":201,"buffers":0}}{"time":"2025-11-11T17:11:16.589Z","cid":"api","channel":"MetricsStore","level":"info","message":"active metrics","numMetrics":29}{"time":"2025-11-11T17:11:23.433Z","cid":"api","channel":"output:DistWorker","level":"warn","message":"sending is b

I have verified that I can list the directories using the AWS CLI with the following command:aws s3 ls s3://cisco-managed-us-east-2/my_directory_prefix/I can pull the logs to my local directory using the following command:aws s3 sync s3://cisco-managed-us-east-2/my_directory_prefix/dnslogs/ C:\umbrella_logs\However, I am unable to pull them using the Umbrella S3 Collector in Cribl Stream locally hosted. Any ideas on what I could do differently?Here are my settings for the Cribl S3 collector with the personalized info redacted:{ "type": "collection", "ttl": "4h", "removeFields": [], "resumeOnBoot": false, "schedule": { "cronSchedule": "*/5 * * * *", "maxConcurrentRuns": 1, "skippable": true, "run": { "rescheduleDroppedTasks": true, "maxTaskReschedule": 1, "logLevel": "info", "jobTimeout": "0", "mode": "run", "timeRangeType": "relative", "timestampT

Hi all i am trying to upload few packs into stream leader using files but getting below sample error Error while installing Pack file cribl-cisco-asa-cleanup-1.1.15 (1).crbl in Group: Dev-OP: failed to install: ENOENT: no such file or directory, open '/opt/cribl/state/packs/cribl-cisco-asa-cleanup.LtY1yaM.tmp/data/lookups/asa_drops.csv'. what does this error suggest we have already uploaded few which got uploaded. 

​Hi Team,I’m working on an SNMP trap pipeline where:Input event has fields like trap_name and trap_varbind_apSysMgmtTaskSuspend.I have a Lookup table that maps:trap_name → varbindname → Output_attribute_value.After Lookup, I want to create a new field dynamically:Field name = value of Output_attribute_value (e.g., id)Field value = value from the field referenced by varbindname (e.g., trap_varbind_apSysMgmtTaskSuspend).I tried using Eval with:JavaScript[Output_attribute_value] = get(__payload, varbindname)Show more lines…but got Unallowed assignment operator error.Then I tried a Code function: JavaScriptconst targetField = event.Output_attribute_value;const sourceField = event.varbindname; if (targetField && sourceField && event[sourceField]) {event[targetField] = event[sourceField];}Show more linesBut the new

Is there a way of directly integrating netskope with cribl using rest api’s without using s3 Buckets for transactional logs

We would like to stream data into RDBMS, but we don’t see the option rdbms destination. How can this be achieved?

HI all  I am trying to create a pipeline where all syslog data will land and i want to filter the events from device i want based on a string in _raw filed like firewall or any other unique string.i have tried _raw.includes(‘Firewall’) or /Firewall/ though when i  check in advanced mode in filter tab it matches the correct event but when i am checking it on a sample log i have built for testing it passes all the events regardless of filter.I know this can be done in routes itself but still would prefer if i could build a pipeline and more function inside it for each sources.  

Hi Team,I am currently working on one POC. I have created a Rest Collector, In the discovery section I have configured Crowdstrike API 1 which returns the list of resource ids. Post that, I am using a format discover results section to read all the resource ids one after the other in JS. These ids are dynamically passed to the query parameter of the next API 2 in the collect section. From API 2 response, I need to fetch an attribute related to device id and pass this attribute in the query parameter of the final API 3 whose response will be sent to the Splunk HEC destination.  I am currently not understanding how can I call this third API because Rest Collector doesn’t have  multiple collect sections and when I moved my data to pipeline to implement a code function to call the API 3, looks like its a limitation, I was not able to call external API from code function and I could not see any other functions in cribl that can support this. Is it possible to chai

Hi everyone,Does any of you ever tried to use the Logging level  known as silly? I’ve tried to use it for troubleshooting an issues on my env, but after less than 10 minutes, my three worker nodes were experiencing memory issues. One of my nodes went completely down, the other two remained with less than 1 GB of RAM (starting from 9 GB of free space in the beginning). I just want to know your experience/opinion on this, is it possible that my memory was not enough?