General Discussions

Discussion List

• 
  How do I test a set of sample data all the way through it’s processing pipeline

  Answered Franky Laarits 3K views 2 comments 0 points Most recent by dritan September 2023
• 
  setting up a Cribl journald data source for journal logs on remote machine

  Answered davec 4.9K views 5 comments 0 points Most recent by davec September 2023
• 
  Question about formatting date in REST collector for JSON body.

  Answered Shawn Cannon 8.7K views 9 comments 0 points Most recent by Shawn Cannon September 2023
• 
  Trying to set up monitoring for expanding health checks on various endpoints.

  Answered mferris 6K views 6 comments 0 points Most recent by mferris September 2023
• 
  Is there a way to order/sort the JSON keys prior to hitting the destination?

  Answered Takashi Kumagai 21.1K views 30 comments 0 points Most recent by Brendan Dalpe September 2023
• 
  I want to duplicate a certain set of sourcetypes to a second index

  Answered etc_cribl 2.5K views 2 comments 0 points Most recent by etc_cribl September 2023
• 
  IBM Qradar side what should I select as a log source type?

  Answered bryce 5.9K views 5 comments 0 points Most recent by Takashi Kumagai September 2023
• 
  Issues with REST collector in distributed setup, authentication token errors on multiple workers.

  Answered Shawn Cannon 3.3K views 2 comments 0 points Most recent by Shawn Cannon September 2023
• 
  TCP syslog flow to cribl is reporting that TCP window is full

  Answered neelsethia 2.2K views 1 comment 0 points Most recent by Brandon McCombs September 2023
• 
  how do people handle secrets that need to be used in scripts that Cribl may run?

  Answered etc_cribl 11.8K views 12 comments 0 points Most recent by etc_cribl September 2023
• 
  Can I create a lookup file from data I receive from a collector?

  Answered ✓ Shawn Cannon 5.7K views 4 comments 0 points Most recent by JP Bourget September 2023
• 
  Can I load a .js file up and just tell the code function to run the js file?

  Answered mromano 1.6K views 1 comment 0 points Most recent by Tony Reinke September 2023
• 
  Time is correct before processing and incorrect after processing

  Answered hgoolya 13.1K views 13 comments 0 points Most recent by hgoolya September 2023
• 
  HEC Source, what is the service endpoint?

  Answered Franky Laarits 1.6K views 1 comment 0 points Most recent by Brandon McCombs September 2023
• 
  Does anyone know how to migrate Splunk Cloud Archive frozen data to Azure blob (or even AWS)?

  Answered Julian Singkham 7.3K views 6 comments 0 points Most recent by Raanan Dagan September 2023
• 
  is it possible to change the max size of cribl.log?

  Answered Edward Bailey 11.1K views 12 comments 0 points Most recent by Edward Bailey September 2023
• 
  Perminately export environmental variables

  Answered dle 2.4K views 2 comments 0 points Most recent by dle September 2023
• 
  generate logging messages when a Cribl worker node goes off-line & also when it recovers operation

  Answered aren 6.9K views 8 comments 0 points Most recent by Brandon McCombs September 2023
• 
  Any plans to implement something like server classes?

  Answered Jeremiah Ross 3.3K views 3 comments 0 points Most recent by nicktank September 2023
• 
  Can we merge two APIs response in Cribl?

  Answered lukasz 13.6K views 13 comments 0 points Most recent by lukasz September 2023
• 
  Is there a way to set a retention period for filesystem destination?

  Answered azerbe 1.6K views 1 comment 0 points Most recent by Brandon McCombs September 2023
• 
  Anyone integrate with Microsoft cloud app security?

  Answered Daniel Jordan 5.4K views 4 comments 0 points Most recent by JP Bourget September 2023
• 
  Does the S3 collector pull every file from the s3 bucket on each run?

  Answered Igor Gifrin 7.6K views 6 comments 0 points Most recent by Raanan Dagan September 2023
• 
  New index time fields from a syslog

  Answered Chad Lavine 3.4K views 4 comments 0 points Most recent by xpac xpac September 2023
• 
  With Cribl GitOps - how can we avoid script collector running ONLY in production environment?

  Answered Martin Prado 3.5K views 3 comments 0 points Most recent by Brendan Dalpe September 2023
• 
  Forcing the Worker nodes (using Docker) to communicate with the leader over a specific TLS version?

  Answered dritan 7.7K views 7 comments 0 points Most recent by dritan September 2023
• 
  Testing 2 different index mapping in Elastic

  Answered steve.malenfant 16.3K views 23 comments 0 points Most recent by David Maislin September 2023
• 
  Handling the missing date_ fields for Splunk Enterprise Security

  Answered asc_me 9.7K views 11 comments 0 points Most recent by asc_me September 2023
• 
  how to get the current mode the collector is running in

  Answered nick 2.4K views 2 comments 0 points Most recent by nick September 2023
• 
  Field shows up in preview but not sent to syslog

  Answered kpimentel 1.6K views 1 comment 0 points Most recent by Brendan Dalpe September 2023