General Discussions

Discussion List

• 
  Does Cribl have any documentation for pulling Workday report logs?

  itsjustjordyn 13 views 0 comments 0 points Started by itsjustjordyn September 26 General Discussions
• 
  I have several questions regarding Stream deployed in AWS...

  Question itsjustjordyn 15 views 0 comments 0 points Started by itsjustjordyn September 26 General Discussions
• 
  Moved: Processing Syslog messages and sending to Splunk

  Closed Michael Donnelly 1 view 0 comments 0 points Started by Michael Donnelly September 22 General Discussions
• 
  Any reason my leader doesn't want to grab 4.03?

  Answered JP Bourget 35 views 2 comments 0 points Most recent by Ben Marcus September 25General Discussions
• 
  Moved: would it be possible to use the same encryption key in an Edge fleet and in a Stream worker …

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 22 General Discussions
• 
  Does anyone have an example of a working configuration to receive Palo Alto logs over HTTPS?

  Answered vupham 11 views 1 comment 0 points Most recent by Tony Reinke - Cribl September 28General Discussions
• 
  Injesting sysmon logs via Elastic API and events are getting dropped

  Answered Joel Yue 7 views 1 comment 0 points Most recent by itsjustjordyn September 26General Discussions
• 
  Cribl Stream Leader on Fargate, the container keeps running with unhealthy health check.

  Answered Joel Yue 10 views 1 comment 0 points Most recent by Tony Reinke - Cribl September 28General Discussions
• 
  What is the best way to reference a Worker Group Level Lookup File inside a pack?

  Answered ✓ JP Bourget 14 views 1 comment 0 points Most recent by Raanan Dagan September 28General Discussions
• 
  how would i configure encryption from a splunk uf to cribl cloud?

  Answered ✓ Franky Laarits 7 views 4 comments 0 points Most recent by Jon Rust September 22General Discussions
• 
  Is it possible to configure Cribl to sign the commits to Github?

  Answered ✓ Closed Eugene Katz 9 views 1 comment 0 points Most recent by Ben Marcus September 22General Discussions
• 
  Recurring UI problem with one worker group. Leader restart helps temporarily.

  Answered Eugene Katz 5 views 19 comments 0 points Most recent by Eugene Katz September 22General Discussions
• 
  For wildcards to reference existing field names in an eval, how do you reference those field names?

  Answered Brett Windom 8 views 3 comments 0 points Most recent by Ahmed Kira September 22General Discussions
• 
  Troubleshooting file monitor permission issue

  Answered Ryan Hennessy 9 views 11 comments 0 points Most recent by Ryan Hennessy September 22General Discussions
• 
  Query on simplifying JSON to CSV conversion.

  Answered hgoolya 4 views 12 comments 0 points Most recent by hgoolya September 22General Discussions
• 
  is there a way to remove the metric event but still send it to splunk not as a metric

  Answered Ahmed Kira 2 views 14 comments 0 points Most recent by Ahmed Kira September 22General Discussions
• 
  Can I add a field that isn’t added to _raw, like not show up in the JSON that is the event?

  Answered Jon Rust 3 views 19 comments 0 points Most recent by Jon Rust September 22General Discussions
• 
  Has Cribl considered Panther as a new possible Destination?

  Answered Eugene Katz 3 views 11 comments 0 points Most recent by Eugene Katz September 22General Discussions
• 
  Optimize sourcetype assignment in pipeline

  Answered Franky Laarits 2 views 5 comments 0 points Most recent by Franky Laarits September 22General Discussions
• 
  Is there a way to do POST to Cribl api endpoint (`/api/v1/version/sync`) from pipeline/destination?

  Answered ✓ Closed Martin Prado 6 views 6 comments 0 points Most recent by Martin Prado September 22General Discussions
• 
  Is there an easy way to view all the HEC tokens in a HEC source?

  Answered Shawn Cannon 3 views 3 comments 0 points Most recent by Shawn Cannon September 22General Discussions
• 
  Best practice when adding event breakers to sources with different teams using the same source?

  Answered Franky Laarits 2 views 3 comments 0 points Most recent by Franky Laarits September 22General Discussions
• 
  Does Cribl have a checkpoint feature, similar to Splunk's fishbucket feature?

  Answered Robbert Hink 4 views 7 comments 0 points Most recent by Brandon McCombs September 22General Discussions
• 
  is there a function that works with tabular data, like `top` output from linux?

  Answered Franky Laarits 2 views 9 comments 0 points Most recent by Franky Laarits September 22General Discussions
• 
  Moved: How do the Windows Edge Nodes extract Windows Event logs and forward them to Cribl?

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 22 General Discussions
• 
  Are there default limits for JSON processing and are they tunable?

  Answered Jeremy Prescott 2 views 27 comments 0 points Most recent by Brandon McCombs September 22General Discussions
• 
  Preserving dual values for a field in parser function extract mode.

  Answered Eugene Katz 3 views 19 comments 0 points Most recent by Eugene Katz September 22General Discussions
• 
  Query about global variable behavior with event values

  Answered Eric Reusche 2 views 25 comments 0 points Most recent by Eric Reusche September 22General Discussions
• 
  i applied a scheduler but it's not working

  Answered lstropole 2 views 2 comments 0 points Most recent by Paul Dott September 22General Discussions
• 
  does cribls collector for rest api support jwt?

  Answered Thomas Vogt 3 views 8 comments 0 points Most recent by Jon Rust September 22General Discussions