General

This message originated from Cribl Community Slack.Click here to view the original link.I teleported into a worker node and I was checking the CPU usage of the the Worker Processes. Are the data points in percentage?Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, is there anything that could trip us up if we wanted to run a collect job for data stored in Amazon Security Lake S3?

This message originated from Cribl Community Slack.Click here to view the original link.Question: Is Cribl Stream basically the cloud‑hosted platform, while Cribl Edge is the on‑prem agent that runs on your own servers or VMs?

This message originated from Cribl Community Slack.Click here to view the original link.Is there a way to dynamically set Datadog tags in a Datadog log destination?

This message originated from Cribl Community Slack.Click here to view the original link.Hi team, quick question about SSL/TLS. Outbound traffic from Edge/Stream to S3 is already encrypted, but we want to ensure inbound data sent to Cribl is encrypted if it may cross the internet. Do we need to enable SSL/TLS on the Listener for inbound data in that case Can Edge/Stream use a self‑signed certificate If so, is adding that cert to the sender’s trust store the correct approach

This message originated from Cribl Community Slack.Click here to view the original link.Struggling with understanding pagination on a particular REST API: https://docs.dynatrace.com/docs/discover-dynatrace/references/dynatrace-api/environment-api/rum/user-sessions/table#parameters The data that comes in does not explicitly include an indicator for which one of these to use: https://sandbox.cribl.io/coursedocs/rest/docs/7_pagination#offsetlimit

This message originated from Cribl Community Slack.Click here to view the original link.I am working on collecting Workday Sign-on Activity logs in Cribl I am having issues in obtaining Access token. How I can configure this in Cribl Authorization to get this working. <#C08L895TEEQ|> This is how I am doing it in Postman and it returns me access token, create a new POST request. Set the URL to: https://<your_workday_domain>/ccx/oauth2/token Go to the Authorization tab: Type: Basic Auth Username: Client ID Password: Client Secret Switch to the Body tab and select x-www-form-urlencoded Add the following key-value pairs: grant_type: refresh_token refresh_token: _token_value_

This message originated from Cribl Community Slack.Click here to view the original link.Hi. I created a raw HTTP/S source in Cribl on port 10081. When a .NET client tries pushing JSON data to the endpoint a 403 response is received. It's not an issue with proxies/firewalls and not due to any problems with auth tokens. We aren't having this issue using our other sources in Cribl Cloud. Has anyone run into similar issues and if so, how were they resolved?

This message originated from Cribl Community Slack.Click here to view the original link.I can't figure out how to use an environment variable that has been set in collector script running a python script. I have tried prefixing the environment variable with $, using just the variable name as set, using envVar., c.Vars. as well as a few other ways. Why isn't this documented somewhere? A screenshot of my env variables and their use in the python script are provided in the graphic below.Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.Hey ya'll! REST Collector question - API call to PingID endpoint /monitoring/logs to retrieve events. I'm having some trouble with the stored state being formatted as the API is expecting. parameter: beginTime = C.Time.strftime((state.latestTime+.001).toPrecision(13), "%Y-%m-%dT%H:%M:%S.%f") response: {"code":400,"message":"parameter \"beginTime\" in query has an error: string doesn't match the format \"date-time\": string doesn't match pattern \"^[0-9]{4}-(0[1-9]|10|11|12)-(0[1-9]|[12][0-9]|3[01])T([0-1][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)(\\.[0-9]+)?(Z|(\\+|-)[0-9]{2}:[0-9]{2})?$\""}

This message originated from Cribl Community Slack.Click here to view the original link.Greetings all. How can I get a more detailed view into what is comprising the storage on my Hybrid workers? Although I recently started configuring the workergroup (handful of sources, destinations, and 4 routes), the wg storage is high with ~5 TB of 5.5 TB in use. I wouldn’t have expected it to be nearly maxed out. Additionally, some worker groups with no configurations and no data flowing through them are also nearing their storage limits. Persistent Queue isn’t enabled on any sources or destinations

This message originated from Cribl Community Slack.Click here to view the original link.Hi, changed the IP address on Cribl worker and since then the API connection to google is failing. Any clues as to where to fix this issue?Links for this message:image.png

This message originated from Cribl Community Slack.Click here to view the original link.In the webhook output, there's an 'event per request' setting. But am I correct to say there's no option to rate-limit the calls?

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, I am collecting Logs from PaloAlto Prisma Access and I filtered some logs and I want to route them to Snowflake. There is couple of approaches i came across, is it better to write the logs to Azure Blob or GCS in this case in terms of performance ? These are the two options available for me in terms of storage. Also, can i use an api to directly send the data to snowflake warehouse? Thanks alot.

This message originated from Cribl Community Slack.Click here to view the original link.Hello, can the worker group name be changed after it is created in Cribl Cloud?

This message originated from Cribl Community Slack.Click here to view the original link.Hey all, i'm troubleshooting a sentinel destination, trying to get SecurityEvent logs into the SecurityEvent table in sentinel, I have the same destination on 4 other worker groups, and they appear to be healthy. Allowed the traffic outbound to the Azure DCR url and login on my firewall so I don't believe there's a network error: Getting this error instead: I have tried back pressure set to PQ, and it appeared to be writing into the disk and then set back to block to test around. I've already tried restarting the worker nodes and still getting the same error. I clone the destination on a different worker group again to test and it work. The volume isn't anything crazy, 20-30gb in total going through, or should be. I'm getting 401 and 400

This message originated from Cribl Community Slack.Click here to view the original link.Hello! Is there a simple way to sync lookups across worker groups that I'm not thinking of before I start diving into the API?

how to convert dump is s3 into lookup file

This message originated from Cribl Community Slack.Click here to view the original link.I need to access a rest api to grab okta logs. I see an okta pack but dont see rest api stuff. Do I need to roll ny own?

This message originated from Cribl Community Slack.Click here to view the original link.Hi everyone, I’m currently working on naming conventions for Cribl Stream and thinking through a few things. I’m wondering how, for example, setting tags on objects like sources, destinations, and routes can help with identifying related objects. I’d also like to make the best possible use of the Cribl Stream search bar that’s shown in the top right within a worker group to find objects more easily. Are there any filtering options for this, such as tag=prod? I haven’t been able to find anything on either topic in the documentation.

This message originated from Cribl Community Slack.Click here to view the original link.i have a rest feed that sends data to splunk on a daily basis. i’d like to also send that data to another destination but only once a week. I was thinking of using an output router, but is there a way to look at the day of week in the filter? Open to other suggestion on how to do this.

This message originated from Cribl Community Slack.Click here to view the original link.Hello team, I need one clarification on - Zscaler log source can be ingested in CRIBL via Amazon S3 ??

This message originated from Cribl Community Slack.Click here to view the original link.In general... should I need to import the default Cribl certificate when attempting to connect one of our AWS EC2 Linux-based Splunk Heavy Forwarders to a Splunk TCP Source hosted in a Cribl Cloud's AWS workgroup? We've confirmed that we have connectivity using netcat, but when I configure the TA in question to send data to the Cribl workgroup (using the FQDN in outputs.conf), the IP addresses fail after 3 attempts and are quarantined. I've reviewed the splunkd logs on the heavy forwarder, but they have yielded little so far.

This message originated from Cribl Community Slack.Click here to view the original link.I'll preface this by stating that I've searched the community here, and have seen some rumblings but nothing concrete. Has anyone successfully load balanced Windows Event Forwarding with an F5?

This message originated from Cribl Community Slack.Click here to view the original link.When migrating Leader Nodes from and old server to a new server (on-prem) it says to start the new Leader node, apply the license and just zip up the existing $CRIBL_HOME/groups directory and unzip it onto the new Leader node. What about for Edge Fleets?