General Discussions

Discussion List

• 
  Is there a way to check historical data volume for a Source?

  Answered alan y 1.9K views 2 comments 0 points Most recent by alan y September 2023
• 
  Question on renaming a field in a json event

  Answered jlstanley 4.9K views 7 comments 0 points Most recent by jlstanley September 2023
• 
  When I have notification with default target, Does this get recorded in Cribl logs?

  Answered Martin Prado 7.3K views 9 comments 0 points Most recent by Martin Prado September 2023
• 
  Anyone have a list of prefixes that are used for Source / Destination objects?

  Answered Brandon McCombs 4K views 6 comments 0 points Most recent by Brandon McCombs September 2023
• 
  Performance question on multiple drops vs regex function

  Answered Brett Windom 3.7K views 5 comments 0 points Most recent by dritan September 2023
• 
  Can cribl read .trc files that are produced by SQL Server?

  Answered Nick Kwiecien Nick Kwiecien 3.2K views 4 comments 0 points Most recent by Brandon McCombs September 2023
• 
  Database connection unsuccessful: Failed to connect - What certificate is it using?

  Answered Shawn Cannon 34.3K views 67 comments 0 points Most recent by Jeremiah Ross September 2023
• 
  Are there any best practices to collect cribl logs and forward to Splunk?

  Answered Martin Prado 4.9K views 5 comments 0 points Most recent by Martin Prado September 2023
• 
  Is there a way we could use cribl to aggregate our log source data and create a report from it?

  Answered Nick Kwiecien Nick Kwiecien 2.5K views 3 comments 0 points Most recent by Manish September 2023
• 
  Has anyone here used API calls to perform Health Checks from a F5 VIP to the Worker Nodes?

  Answered ✓ Christopher Owen 2.7K views 2 comments 0 points Most recent by Christopher Owen September 2023
• 
  Is is possible to import a packs directly from my own git via rest api?

  Answered Thomas Vogt 5K views 8 comments 0 points Most recent by David Maislin September 2023
• 
  Could I replace my Splunk HEC with Cribl for my Corelight Sensors?

  Answered Franky Laarits 4K views 5 comments 0 points Most recent by Franky Laarits September 2023
• 
  Guidance on when to add additional processors due to a large number of consecutive tasks?

  Answered Brendan Dalpe 3.1K views 5 comments 0 points Most recent by Jon Rust September 2023
• 
  Is there a way to rename a field and remove parts of it?

  Answered Jeremy Prescott 1.7K views 2 comments 0 points Most recent by David Maislin September 2023
• 
  Is anyone sending PerfmonMetrics through Cribl?

  Answered jlstanley 30.9K views 43 comments 0 points Most recent by morrisnky September 2023
• 
  What information is needed (software, storage, hardware and network) to calculate ROI?

  Answered Franky Laarits 7.6K views 10 comments 0 points Most recent by Franky Laarits September 2023
• 
  Is there an easy way to analyze the memory usage of specific procs and pipelines?

  Answered Brett Windom 4.5K views 6 comments 0 points Most recent by Brett Windom September 2023
• 
  Could the Azure Blob collector potentially be used to pull in Azure Table data too?

  Answered Ryan Hennessy 3.3K views 3 comments 0 points Most recent by Ryan Hennessy September 2023
• 
  How do we decide on a safe value for concurrency for Chronicle destination?

  Answered Eugene Katz 14.9K views 14 comments 0 points Most recent by Kam Amir September 2023
• 
  How do you guys get data into Cribl to transform before hitting Splunk indexers?

  Answered Robbert Hink 14.3K views 17 comments 0 points Most recent by Robbert Hink September 2023
• 
  Are there documented procedures for moving the leader to new hardware?

  Answered Dave Geller 5.1K views 7 comments 0 points Most recent by Brandon McCombs September 2023
• 
  Check if a cribl instance is configured as a worker or a leader from the command-line?

  Answered Franky Laarits 3.6K views 6 comments 0 points Most recent by Brandon McCombs September 2023
• 
  When does the license clock start midnight my local timezone or GMT?

  Answered Corey McClure 1.1K views 1 comment 0 points Most recent by Brendan Dalpe September 2023
• 
  What exactly does a Syslog source do when it experiences backpressure?

  Answered Quinn Stevenson 6.7K views 7 comments 0 points Most recent by Quinn Stevenson September 2023
• 
  Script source in a distributed environment - Run once to avoid duplicates?

  Answered Jeremy Prescott 2.4K views 3 comments 0 points Most recent by Harry Gardner September 2023
• 
  Does anyone else deal with a high rate of job failures for Office365 Message Trace logs?

  Answered Nick Kwiecien Nick Kwiecien 7.7K views 7 comments 0 points Most recent by JP Bourget September 2023
• 
  Monitor and get alerted as soon as there is any issue with Cribl pushing data to AWS?

  Answered Bradley Murphy 2.1K views 2 comments 0 points Most recent by Brendan Dalpe September 2023
• 
  Passing two Collect parameters using the same name in a REST collector using a Get collect method?

  Answered lstropole 2K views 2 comments 0 points Most recent by lstropole September 2023
• 
  How do I prevent the double underscore internal Cribl fields from being inserted into the _raw?

  Answered Eric Reusche 3.8K views 7 comments 0 points Most recent by Jon Rust September 2023
• 
  Is there any way to force a pipeline to ONLY run on a single worker?

  Answered Abby Strong 12.1K views 15 comments 0 points Most recent by Abby Strong September 2023