General Discussions

Discussion List

• 
  Looking for some advice to parse FW events coming in from Azure EventHub

  Answered Franky Laarits 540 views 10 comments 0 points Most recent by Franky Laarits September 22
• 
  Can Cribl handle the Splunks functionality of assigning default fields dynamicaly?

  Answered Philipp Gerke 170 views 4 comments 0 points Most recent by xpac xpac September 22
• 
  Passing the message field in JSON to Splunk

  Answered kpimentel 599 views 15 comments 0 points Most recent by kpimentel September 22
• 
  How can I access the name of the Cribl Group in a pipeline?

  Answered ✓ Quinn Stevenson 651 views 10 comments 0 points Most recent by dritan September 22
• 
  What happens with retention setting in Splunk with timestamp from Replay?

  Answered Paul Dott 322 views 5 comments 0 points Most recent by dritan September 22
• 
  What happens during a restart and is the restart done in a rolling fashion?

  Answered Kevin Morris 167 views 4 comments 0 points Most recent by Brendan Dalpe September 22
• 
  How do you get the workers to send metrics (like CPU usage, etc.) to Splunk?

  Answered Jon Rust 684 views 21 comments 0 points Most recent by Jon Rust September 22
• 
  How can we get cribl to keep the time within the log?

  Answered hgoolya 1.5K views 37 comments 0 points Most recent by hgoolya September 22
• 
  Is there a way to add a field from a REST Collector’s `Discover` phase to the collection results?

  Answered Kevin Morris 431 views 10 comments 0 points Most recent by Tomer Shvueli September 22
• 
  Is Cribl Search functionality available for on prem Cribl deployment?

  Answered nicktank 195 views 3 comments 0 points Most recent by Chell Mendiola September 22
• 
  Trying to a SED like search and replace?

  Answered Jaime Sanchez 741 views 17 comments 0 points Most recent by Jaime Sanchez September 22
• 
  Deleting what is matched in REGEX

  Answered LovetheBeach 204 views 5 comments 0 points Most recent by Jon Rust September 22
• 
  Notifications are through on messages and not notifications

  Answered Catlin Carter 185 views 4 comments 0 points Most recent by Catlin Carter September 22
• 
  Passing data to another host with no extra meta data

  Answered Steve Bridge 1.7K views 35 comments 0 points Most recent by Joshua Napier September 22
• 
  Anyone every pulled in events from Box?

  Answered Shawn Cannon 334 views 8 comments 0 points Most recent by Steve Litras September 22
• 
  Way to recreate 30 pipelines for different business unit

  Answered Cam Borgal 1.3K views 29 comments 0 points Most recent by xpac xpac September 22
• 
  Wondering if it's at all possible to do a lookup with multiple match criteria?

  Answered Louise Tang 269 views 6 comments 0 points Most recent by Louise Tang September 22
• 
  Storing Windows Event Logs in XML with each event in a single file

  Answered Andrew Duca 193 views 4 comments 0 points Most recent by Andrew Duca September 22
• 
  Why is passthrough reducing events?

  Answered saurabh.gupta 536 views 10 comments 0 points Most recent by saurabh.gupta September 22
• 
  Using regex to extract fields

  Answered Mike Dupuis 248 views 4 comments 0 points Most recent by Mike Dupuis September 22
• 
  How to parse a JSON object?

  Answered Eric Reusche 590 views 14 comments 0 points Most recent by Jon Rust September 22
• 
  How are you handling token persistence?

  Answered Paul Dott 1.3K views 30 comments 0 points Most recent by Raanan Dagan September 22
• 
  Does Cribl Stream handle native delivery to Azure Data Explorer (ADX / Kusto)?

  Answered Paul Hoffman 75 views 1 comment 0 points Most recent by David Maislin September 22
• 
  Does anyone know how to create a Webhook endpoint on Cribl?

  Answered Tomer Shvueli 162 views 2 comments 0 points Most recent by Tomer Shvueli September 22
• 
  Looking for recommendations for a good services/processes config for a 1000+ edge node deployment?

  Answered Nick Kwiecien Nick Kwiecien 118 views 2 comments 0 points Most recent by Brandon McCombs September 22
• 
  Looking for insight on the *Time Range* selection when running against an Amazon S3 bucket

  Answered Raanan Dagan 572 views 17 comments 0 points Most recent by Raanan Dagan September 22
• 
  Looking to enrich my data by doing a reverse ip lookup and setting that as the source

  Answered Jim Apger 823 views 18 comments 0 points Most recent by Shawn Cannon September 22
• 
  What are the steps to backup an old Cribl instane?

  Answered Anson VanDoren 86 views 1 comment 0 points Most recent by Andrew Duca September 22
• 
  Can you use __hecToken as a filter condition for the breaker?

  Answered Shawn Cannon 275 views 8 comments 0 points Most recent by SonOfBuzi September 22
• 
  Is there any way we can get the logs in the timeperiod when the server is down?

  Answered dduke 302 views 7 comments 0 points Most recent by David Maislin September 22