General Discussions

Discussion List

• 
  Is it possible to ingest logs from Containerized Applications with Cribl?

  Answered nicktank 242 views 4 comments 0 points Most recent by Bradley Murphy September 22
• 
  How do I map value field with appropriate name field for the following log sample?

  Answered tpeveler 608 views 10 comments 0 points Most recent by David Maislin September 22
• 
  Anyone have a good set up for querying Azure AD via graph to access specific user object parameters?

  Answered Oliver Hoppe 101 views 1 comment 0 points Most recent by Tony Reinke September 22
• 
  How to make a variable from one event and add that variable to all events in the pipeline?

  Answered Phoebe Chang 383 views 6 comments 0 points Most recent by Phoebe Chang September 22
• 
  Proper URL for sending to Cribl via Webhook

  Answered LovetheBeach 1.2K views 22 comments 0 points Most recent by LovetheBeach September 22
• 
  CSV File being ingested and the headers are not showing up as fields

  Answered Chell Mendiola 291 views 5 comments 0 points Most recent by Brendan Dalpe September 22
• 
  Can Cribl monitor a folder, uncompress, and read the csv within the zip?

  Answered Daniel Jordan 71 views 2 comments 0 points Most recent by Daniel Jordan September 22
• 
  Is there a prebuilt pipeline for AWS S3 Access logs?

  Answered davec 228 views 2 comments 0 points Most recent by Paul Dott September 22
• 
  Every morning when I log in to the Cribl leader I get an error

  Answered DougMac_docs.cribl 140 views 1 comment 0 points Most recent by baconesq September 22
• 
  I was wondering how is Cribl implementing OCSF mappings?

  Answered Michael Katz 1.1K views 16 comments 0 points Most recent by asc_me September 22
• 
  Looking for pointers on putting Cribl between Splunk UF and Indexer with TLS Encryption

  Answered saurabh.gupta 705 views 12 comments 0 points Most recent by xpac xpac September 22
• 
  Questions on expressions

  Answered Nick Kwiecien Nick Kwiecien 953 views 15 comments 0 points Most recent by Nick Kwiecien Nick Kwiecien September 22
• 
  Sending JSON data to Splunk from Cribl causing.30:1

  Answered SonOfBuzi 590 views 10 comments 0 points Most recent by Louise Tang September 22
• 
  Can we use python as a script collector?

  Answered Sirius Lange 246 views 3 comments 0 points Most recent by Sirius Lange September 22
• 
  Extract into json objects together with the other _raw.items and rename the field

  Answered Paul Martins 539 views 9 comments 0 points Most recent by Patrick Sharkey September 22
• 
  What would the Source field be for a json parsed event?

  Answered Jamey Turcic 613 views 9 comments 0 points Most recent by Patrick Sharkey September 22
• 
  Where do I find the backpressure graphs?

  Answered LovetheBeach 2.6K views 44 comments 0 points Most recent by LovetheBeach September 22
• 
  Integrate InsightVM Rapid7 security alerts

  Answered Eli 870 views 10 comments 0 points Most recent by JP Bourget September 22
• 
  How can I get the default `@timestamp` on elastic output?

  Answered steve.malenfant 4K views 75 comments 0 points Most recent by steve.malenfant September 22
• 
  Moved: Does Edge have any local application debug / error logs?

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 22
• 
  Is send the data to s3 to SnowFlake read it the only possibility?

  Answered Andrew Duca 307 views 3 comments 0 points Most recent by Andrew Duca September 22
• 
  How to remove the null elements of an array

  Answered etc_cribl 136 views 1 comment 0 points Most recent by Patrick Sharkey September 22
• 
  Best way to serialize to a delimiter, without having that delimited in a string value

  Answered Manish 191 views 2 comments 0 points Most recent by Manish September 22
• 
  Does Cribl provide functionality to compute a network flow hash?

  Answered wcall_cribl 241 views 3 comments 0 points Most recent by Jon Rust September 22
• 
  Would this be a max active requests settings issue?

  Answered Harry Gardner 886 views 18 comments 0 points Most recent by Brandon McCombs September 22
• 
  What's the best way to do an if statement for status codes?

  Answered Logan Carter 454 views 8 comments 0 points Most recent by asc_me September 22
• 
  Is Cribl search available for on-prem yet?

  Answered Kevin Morris 636 views 9 comments 0 points Most recent by Kevin Morris September 22
• 
  How does it TLS work with Redis?

  Answered Rob Franz 290 views 4 comments 0 points Most recent by Rob Franz September 22
• 
  Can I filter meta data in a custom Event Breaker Ruleset?

  Answered Rob Franz 493 views 7 comments 0 points Most recent by Rob Franz September 22
• 
  Since Cribl is doing all the hard work, I can remove the palo TA from the indexers?

  Answered Mugdha Khandekar 267 views 3 comments 0 points Most recent by nick September 22