General Discussions

Discussion List

• 
  For wildcards to reference existing field names in an eval, how do you reference those field names?

  Answered Brett Windom 348 views 3 comments 0 points Most recent by Ahmed Kira September 22
• 
  Troubleshooting file monitor permission issue

  Answered Ryan Hennessy 1.2K views 11 comments 0 points Most recent by Ryan Hennessy September 22
• 
  Query on simplifying JSON to CSV conversion.

  Answered hgoolya 932 views 12 comments 0 points Most recent by hgoolya September 22
• 
  is there a way to remove the metric event but still send it to splunk not as a metric

  Answered Ahmed Kira 1.3K views 14 comments 0 points Most recent by Ahmed Kira September 22
• 
  Can I add a field that isn’t added to _raw, like not show up in the JSON that is the event?

  Answered Jon Rust 1.4K views 19 comments 0 points Most recent by Jon Rust September 22
• 
  Has Cribl considered Panther as a new possible Destination?

  Answered Eugene Katz 989 views 11 comments 0 points Most recent by Eugene Katz September 22
• 
  Optimize sourcetype assignment in pipeline

  Answered Franky Laarits 491 views 5 comments 0 points Most recent by Franky Laarits September 22
• 
  Is there a way to do POST to Cribl api endpoint (`/api/v1/version/sync`) from pipeline/destination?

  Answered ✓ Closed Martin Prado 631 views 6 comments 0 points Most recent by Martin Prado September 22
• 
  Is there an easy way to view all the HEC tokens in a HEC source?

  Answered Shawn Cannon 352 views 3 comments 0 points Most recent by Shawn Cannon September 22
• 
  Best practice when adding event breakers to sources with different teams using the same source?

  Answered Franky Laarits 337 views 3 comments 0 points Most recent by Franky Laarits September 22
• 
  Does Cribl have a checkpoint feature, similar to Splunk's fishbucket feature?

  Answered Robbert Hink 801 views 7 comments 0 points Most recent by Brandon McCombs September 22
• 
  is there a function that works with tabular data, like `top` output from linux?

  Answered Franky Laarits 723 views 9 comments 0 points Most recent by Franky Laarits September 22
• 
  Moved: How do the Windows Edge Nodes extract Windows Event logs and forward them to Cribl?

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 22
• 
  Are there default limits for JSON processing and are they tunable?

  Answered Jeremy Prescott 2.2K views 20 comments 0 points Most recent by Brandon McCombs September 22
• 
  Preserving dual values for a field in parser function extract mode.

  Answered Eugene Katz 1.7K views 19 comments 0 points Most recent by Eugene Katz September 22
• 
  Query about global variable behavior with event values

  Answered Eric Reusche 1.5K views 25 comments 0 points Most recent by Eric Reusche September 22
• 
  i applied a scheduler but it's not working

  Answered lstropole 230 views 2 comments 0 points Most recent by Paul Dott September 22
• 
  does cribls collector for rest api support jwt?

  Answered Thomas Vogt 757 views 8 comments 0 points Most recent by Jon Rust September 22
• 
  Using variables to select the production or staging redis environment?

  Answered Martin Prado 304 views 4 comments 0 points Most recent by Martin Prado September 22
• 
  A few question about PQ

  Answered ✓ Thomas Vogt 573 views 10 comments 0 points Most recent by David Maislin September 22
• 
  Looking into some dropped events when sending to one of my splunk sources

  Answered mferris 1.8K views 22 comments 0 points Most recent by mferris September 22
• 
  is there a way to add a function to drop for windows event logs that are sent via syslog?

  Answered Abby Strong 363 views 6 comments 0 points Most recent by David Maislin September 22
• 
  Does anyone have experience using cribl to send prometheus metrics?

  Answered Erin Sweeney 3K views 36 comments 0 points Most recent by nicktank September 22
• 
  Can we ingest data off the wire into Cribl?

  Answered Abdullah Zubair 701 views 8 comments 0 points Most recent by lstropole September 22
• 
  Does cribl had an agent that will run on IBM iseries?

  Answered Steve Litras 112 views 1 comment 0 points Most recent by David Maislin September 22
• 
  Timestamp for the data in replay is not honoring the original timestamp

  Answered Sirius Lange 682 views 7 comments 0 points Most recent by Sirius Lange September 22
• 
  Unable to bind to 514 for syslog input on Cribl with non-sudo user

  Answered Neil Parisi 971 views 14 comments 0 points Most recent by David Maislin September 22
• 
  Setting the timestamp to a value when sending data to Elasticsearch

  Answered lstropole 870 views 10 comments 0 points Most recent by lstropole September 22
• 
  Is sending data from InfluxDB to Cribl possible?

  Answered mtorres30 286 views 4 comments 0 points Most recent by nicktank September 22
• 
  For bringing Amazon Kinesis Firehose in to Cribl, what format should I use?

  Answered mferris 750 views 10 comments 0 points Most recent by mferris September 22