General Discussions

Discussion List

• 
  Is Cribl Search functionality available for on prem Cribl deployment?

  Answered nicktank 3.7K views 3 comments 0 points Most recent by Chell Mendiola September 2023
• 
  Trying to a SED like search and replace?

  Answered Jaime Sanchez 12.6K views 17 comments 0 points Most recent by Jaime Sanchez September 2023
• 
  Deleting what is matched in REGEX

  Answered LovetheBeach 3.6K views 5 comments 0 points Most recent by Jon Rust September 2023
• 
  Notifications are through on messages and not notifications

  Answered Catlin Carter 3.4K views 4 comments 0 points Most recent by Catlin Carter September 2023
• 
  Passing data to another host with no extra meta data

  Answered Steve Bridge 28.9K views 35 comments 0 points Most recent by Joshua Napier September 2023
• 
  Anyone every pulled in events from Box?

  Answered Shawn Cannon 6.6K views 8 comments 0 points Most recent by Steve Litras September 2023
• 
  Way to recreate 30 pipelines for different business unit

  Answered Cam Borgal 21.5K views 29 comments 0 points Most recent by xpac xpac September 2023
• 
  Wondering if it's at all possible to do a lookup with multiple match criteria?

  Answered Louise Tang 5.1K views 6 comments 0 points Most recent by Louise Tang September 2023
• 
  Storing Windows Event Logs in XML with each event in a single file

  Answered Andrew Duca 4.1K views 4 comments 0 points Most recent by Andrew Duca September 2023
• 
  Why is passthrough reducing events?

  Answered saurabh.gupta 8.7K views 10 comments 0 points Most recent by saurabh.gupta September 2023
• 
  Using regex to extract fields

  Answered Mike Dupuis 6.3K views 4 comments 0 points Most recent by Mike Dupuis September 2023
• 
  How to parse a JSON object?

  Answered Eric Reusche 11.5K views 14 comments 0 points Most recent by Jon Rust September 2023
• 
  How are you handling token persistence?

  Answered Paul Dott 22.6K views 30 comments 0 points Most recent by Raanan Dagan September 2023
• 
  Does anyone know how to create a Webhook endpoint on Cribl?

  Answered Tomer Shvueli 2.9K views 2 comments 0 points Most recent by Tomer Shvueli September 2023
• 
  Looking for recommendations for a good services/processes config for a 1000+ edge node deployment?

  Answered Nick Kwiecien Nick Kwiecien 1.6K views 2 comments 0 points Most recent by Brandon McCombs September 2023
• 
  Looking for insight on the *Time Range* selection when running against an Amazon S3 bucket

  Answered Raanan Dagan 7.7K views 17 comments 0 points Most recent by Raanan Dagan September 2023
• 
  Looking to enrich my data by doing a reverse ip lookup and setting that as the source

  Answered Jim Apger 11.5K views 18 comments 0 points Most recent by Shawn Cannon September 2023
• 
  What are the steps to backup an old Cribl instane?

  Answered Anson VanDoren 1.4K views 1 comment 0 points Most recent by Andrew Duca September 2023
• 
  Can you use __hecToken as a filter condition for the breaker?

  Answered Shawn Cannon 4.1K views 8 comments 0 points Most recent by SonOfBuzi September 2023
• 
  Is there any way we can get the logs in the timeperiod when the server is down?

  Answered dduke 4.3K views 7 comments 0 points Most recent by David Maislin September 2023
• 
  Has anyone had to backpressure a destination via Persistent Queue?

  Answered Kyle McCririe 2.7K views 4 comments 0 points Most recent by Clint Sharp September 2023
• 
  Does anyone have any instructions on how to update SSL certs using CLI?

  Answered Christopher Owen 15.1K views 20 comments 0 points Most recent by Raanan Dagan September 2023
• 
  Moved: Is there a way we can add our own edge node info?

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 2023
• 
  Is it possible in worker mappings to filter by CIDR, like conn_ip is in 10.0.0.0/24?

  Answered Megan Davis 3.1K views 4 comments 0 points Most recent by Jon Rust September 2023
• 
  is it recommended to do a json extract after the GeoIP function?

  Answered Josh Brunvoll 2.8K views 5 comments 0 points Most recent by Jon Rust September 2023
• 
  How can I have script collector to run every 30 seconds?

  Answered Martin Prado 5.2K views 6 comments 0 points Most recent by Jon Rust September 2023
• 
  Is setting up Cribl WEC/WEF the same that is used in Windows Events routed to a WEC server?

  Answered Franky Laarits 3.9K views 4 comments 0 points Most recent by Anson VanDoren September 2023
• 
  What is the best way to remove a JSON array from _raw JSON data and reserialize to _raw?

  Answered Shawn Cannon 6.5K views 14 comments 0 points Most recent by David Maislin September 2023
• 
  Is there any checkpoint mechanism in REST collector?

  Answered Chris Rogers 966 views 1 comment 0 points Most recent by David Maislin September 2023
• 
  Any idea how I can add a field with its value to an existing field?

  Answered Johan Woger 2.6K views 3 comments 0 points Most recent by David Maislin September 2023