Products

Every time we update openshift in azure, my cribl config is lost. since we have the free version, we cannot use git repository. would using persistent storage helps keep the config because the update process drains the node from the cluster and restart them on another node. I suspect this is why the config is not kept.

Can i install Cribl Edge on my worker nodes without any production impact. `I want to use Cribl  Edge to monitor my Cribl Workers and certain files

Hi all i am trying to upload few packs into stream leader using files but getting below sample error Error while installing Pack file cribl-cisco-asa-cleanup-1.1.15 (1).crbl in Group: Dev-OP: failed to install: ENOENT: no such file or directory, open '/opt/cribl/state/packs/cribl-cisco-asa-cleanup.LtY1yaM.tmp/data/lookups/asa_drops.csv'. what does this error suggest we have already uploaded few which got uploaded. 

​Hi Team,I’m working on an SNMP trap pipeline where:Input event has fields like trap_name and trap_varbind_apSysMgmtTaskSuspend.I have a Lookup table that maps:trap_name → varbindname → Output_attribute_value.After Lookup, I want to create a new field dynamically:Field name = value of Output_attribute_value (e.g., id)Field value = value from the field referenced by varbindname (e.g., trap_varbind_apSysMgmtTaskSuspend).I tried using Eval with:JavaScript[Output_attribute_value] = get(__payload, varbindname)Show more lines…but got Unallowed assignment operator error.Then I tried a Code function: JavaScriptconst targetField = event.Output_attribute_value;const sourceField = event.varbindname; if (targetField && sourceField && event[sourceField]) {event[targetField] = event[sourceField];}Show more linesBut the new field (id) still doesn’t appear in the final JSON.Questions:Is Code function the right approach for dynamic field names?How can I verify Lookup values before Code

Is there a way of directly integrating netskope with cribl using rest api’s without using s3 Buckets for transactional logs

Hi all, I just completed the Level 3 Prerequisite exam but I have a question.One of the questions was as follows:What would be the result of the Mask function with the following settings Match Regex =`(user_id=) (d+)" Replace Expression = C. Mask. random( ${g2}') on the event host=server. local user_id=12345?A)host=server. local aeQI9B) host=server. local user_id=fe8780bd8237b0388df7175034db75d6C) host=server. local user_id=aeQI9D) The event would remain unchanged because the Match Regex is invalid.I chose option D. But apparently this was the wrong answer. But I think it shouldn't be… Here is why.The event host=server.local user_id=12345….(user_id=) (d+) matches “user_ID=”(d+) is incorrect, d is just a literal d and not a digit in this case, it should have been \d+. There is also a space in the regex, but the event itself does not have a space. “user_id=12345”This is why the event would remain unchanged because the match regex is invalid. If I am wrong, please explain to me where I am

We would like to stream data into RDBMS, but we don’t see the option rdbms destination. How can this be achieved?

HI all  I am trying to create a pipeline where all syslog data will land and i want to filter the events from device i want based on a string in _raw filed like firewall or any other unique string.i have tried _raw.includes(‘Firewall’) or /Firewall/ though when i  check in advanced mode in filter tab it matches the correct event but when i am checking it on a sample log i have built for testing it passes all the events regardless of filter.I know this can be done in routes itself but still would prefer if i could build a pipeline and more function inside it for each sources.  

Hi Team,I am currently working on one POC. I have created a Rest Collector, In the discovery section I have configured Crowdstrike API 1 which returns the list of resource ids. Post that, I am using a format discover results section to read all the resource ids one after the other in JS. These ids are dynamically passed to the query parameter of the next API 2 in the collect section. From API 2 response, I need to fetch an attribute related to device id and pass this attribute in the query parameter of the final API 3 whose response will be sent to the Splunk HEC destination.  I am currently not understanding how can I call this third API because Rest Collector doesn’t have  multiple collect sections and when I moved my data to pipeline to implement a code function to call the API 3, looks like its a limitation, I was not able to call external API from code function and I could not see any other functions in cribl that can support this. Is it possible to chain multiple Rest collectors,

Hi everyone,Does any of you ever tried to use the Logging level  known as silly? I’ve tried to use it for troubleshooting an issues on my env, but after less than 10 minutes, my three worker nodes were experiencing memory issues. One of my nodes went completely down, the other two remained with less than 1 GB of RAM (starting from 9 GB of free space in the beginning). I just want to know your experience/opinion on this, is it possible that my memory was not enough? 

Hello,I’m using Cribl Cloud to pull JSON events from an Azure Event Hub and forward them to Splunk via HEC. Each incoming event contains a nested array field called records, for example:{ "records": [ { "FileName": "xx", "FileType": "xx", "NetworkMessageId": "xx", "RecipientEmailAddress": "xx", "RecipientObjectId": "xx", "ReportId": "xx", "SHA256": "xx", "SenderDisplayName": "xx", "SenderObjectId": "x", "SenderFromAddress": "x", "FileSize": x, "Timestamp": "xx", "TimeGenerated": "xx", "_ItemId": "xx", "TenantId": "xx", "_TimeReceived": "xx", "_Internal_WorkspaceResourceId": "xx", "Type": "xx" }, { "FileName": "xx", "FileType": "xx", "NetworkMessageId": "xx", "RecipientEmailAddress": "xx", "RecipientObjectId": "xx", "ReportId": "xx", "SHA256": "xx", "SenderDisplayName": "xx", "SenderObjectId": "x", "SenderFromAddress": "x", "Fil

HI all just wanted to confirm if CIDR ranges are supported in no proxy setting where i want to mention CIDR range of leader node in worker node settings instead of directly providing leader node IP.Is there any additional settings needed to make this work? 

In both the API Reference (with authenticated session) and via Python, I started running into an issue with submitting queries to the POST /search/jobs API to submit a remote query to Cribl Search.Despite the fact that it's a POST endpoint, and I'm using the headers generated by the API Reference, I receive the following error<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot POST /api/v1/search/jobs</pre></body></html>In the API Reference this is the payload I am POST'ing with application/json as the accept and Content-Type - the Auth comes from my session automatically{ "query": "cribl dataset=\"cribl_internal_logs\" | limit 10 "}In Python, I attempted to recreate it as well, I can confirm that the Client ID and Client Secret are valid and I receive a valid token. Here is the relevant portion of that script.def generateBearerToken() -> str: url = "https://

As the title says, I’m looking to create and update a lookup table based on incoming events, somewhat similar to the outputlookup function in splunk. Is there any way to update or create a table based on fields from events passing through a pipeline?

Looking for a configuration example for sending webhook notifications to Teams channel.

Hi All,We are managing Crowdstrike NGSIEM  in our network and all the data sources are routed to Cribil and from Cribil , we are forwarding the logs to NGSIEM. Data source → Cribil →  NGSIEM I understand , we require parsers in NGSIEM to read the relevent logs received from the  datasources but I wish to know ,is there any parser concept present in cribil to onboard the logs from the different datasources.    

This is an example of how we can reference a value provided by Discover Type HTTP Request in the REST API Collector which will correctly save a bearer token value which will expire (default time 5 minutes) using a named Token attribute: token, Authorization header `Bearer $(token)` and Authentication expression `Bearer $(token)` The initial authorization request:curl -X POST 'http://localhost:9000/api/v1/auth/login' -H "Content-Type: application/json" -d '{ "username": "admin", "password": "<password value here>" }' Run a Discover request to generate a bearer token: The above request will return a value something like: {"token":"abcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKEN","forcePasswordChange":false} The Collect layer will use the information pulled during discover to pull the following: The Encode operation is not necessary but provided for illustration purposes.‘ite

hello,i need options on how to enrich data coming from zabbix as a source on cribl stream before it reaches the destination by API or Http requestthe data is on database i need to call the database by API to fetch the data using fields in the data payload from zabbix and enrich the data received from zabbix then forward it to destinationnote : i want to get the data on fly and the API call will use attributed from the data payload this is the URL that i want to use and will take the massagegroup and the application value from the data payload to call the needed data to be enrichedhttp://IP:25050/3i_service.php?MESSAGEGROUP=X&APPLIKATION=Yi tried by code on the pipeline to do httprequest but it didn't work

Had a situation where the automatic upgrade was not working, so had to manually upgrade.From the logs it was trying to download ARM version not X64 version.Fortunately managed to figure out the correct weblink by changing the file name slightly: https://cdn.cribl.io/dl/4.10.1/cribl-4.10.1-45136dbb-linux-x64.tgz.Are these links listed anywhere on the cribl website, or how would we manually upgrade?

Hello,I noticed a strange thing maybey anyone can explain.I have 3 syslog sources: syslog:514: ,syslog:51402: and syslog:51403:Three routes for these sources, each with a different pipeline attached. The order off the routes are 514 then 51402 and at last 51403.The filter in de routes are __inputId.startsWith('syslog:514:') &&  __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51402:') && __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51403:')&&  __srcIpPort.includes('10.10.1.112')(same host with different syslog outputs)In this order the 514 port gets a load off events, the 51402 lesser and teh 51403 nothing. That surpised me because when a check the source side i can capture 51403 events from this sourceip.For test i moved the 514 route after the 51403 route. Just a feeling. but what??.. the 51403 gets suddenly l the events it was missing. And here it gets strange. Just as if the 514 filter takes al the events from the 51403. But

HiI setup a worker node on premise by running the script captured from cribl leader cloud. I enabled UI access for worker node. I can open the link in browser but what will be the credentials for it ?Thanks

I am new with Cribl.Cribl Edge (standalone, installed on Windows 10 laptop for test/evaluation): Windows Metrics do not return actionable information when forwarding to a standalone Splunk Enterprise instance. What am I doing wrong or what I am missing here?Windows Eventlog cribl-source is correctly received in json. But adding the Windows Metrics cribl-source to the same (working) Splunk Destination (default forwarding to port 9997) it shows:All relevant metric_names seems to be received correctly, but no Values to find. Besides, do not understand the metric_type "g". I would expect a value-field in bytesI have tried many things sofar, including Cloud Stream, searching in the docs and and start some basic first lessons on Cribl Universty. Neither an overall and understandable Google search explanation about type g. Stuck now!Does somebody has a clue, suggestion, tip or direction to search in other sources?ThanksAshleyP

I am trying to send logs from cribl to OpenObserve.OpenObserve accepts data in a JSON array format.e.g.[ { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }, { "kubernetes.annotations.kubectl.kubernetes.io/default-container": "prometheus", "kubernetes.annotations.kubernetes.io/psp": "eks.privileged", "kubernetes.container_hash": "quay.io/prometheus/prometheus@sha256:4748e26f9369ee7270a7cd3fb9385c1adb441c05792ce2bce2f6dd622fd91d38", "kubernetes.container_image": "quay.io/prometheus/prometheus:v2.39.1", "kubernetes.container_name": "prometheus" }]What is the best way to do this?

Hello everyone,I have the following problem. I'm designing a distributed deployment. I have to create an environment for data reduction but before that I need to send the data to a blob storage, for compliance reason, as you can imagine. Now, all of these is achieved but I have some doubts. When I use the Azure blob storage as only destination, all the 100% of the data goes in there but, the Monitoring Page, is telling me that the data that comes in are the same as the data that goes out (sometimes, the data that goes out are even more), even with compression enable. As said, I have the g-zip compression enabled on the Azure Destination page. I've checked the storage and I found out that the data are really compressed. So, my point is the following: when I try to estimates the possible number of workers and their capabilities, should I trust the monitoring page and consider DATA IN = DATA OUT (since the data is not processed by any pipeline at all) or I can consider the quantity of byt

Hi,We are currently working on updating our Cribl Edge Agents. While our Linux agents successfully auto-update through the UI, we are encountering issues with our Windows agents. Specifically, the Windows agents display an error during the download process and fail to update.Manual updates are possible by logging into the system and running the update script; however, the UI-based update consistently fails. We have confirmed that port 4200 is open, and there are no indications of blocked or dropped traffic. Additionally, all platform-specific packages, including the corresponding hash files, have been prepared and placed in the appropriate Cribl temporary directory.Given these conditions, what could be causing this issue?