General Discussions

Discussion List

• 
  Why is passthrough reducing events?

  Answered saurabh.gupta 7.1K views 10 comments 0 points Most recent by saurabh.gupta September 2023
• 
  Using regex to extract fields

  Answered Mike Dupuis 5.2K views 4 comments 0 points Most recent by Mike Dupuis September 2023
• 
  How to parse a JSON object?

  Answered Eric Reusche 9.4K views 14 comments 0 points Most recent by Jon Rust September 2023
• 
  How are you handling token persistence?

  Answered Paul Dott 19K views 30 comments 0 points Most recent by Raanan Dagan September 2023
• 
  Does anyone know how to create a Webhook endpoint on Cribl?

  Answered Tomer Shvueli 2.3K views 2 comments 0 points Most recent by Tomer Shvueli September 2023
• 
  Looking for recommendations for a good services/processes config for a 1000+ edge node deployment?

  Answered Nick Kwiecien Nick Kwiecien 1.3K views 2 comments 0 points Most recent by Brandon McCombs September 2023
• 
  Looking for insight on the *Time Range* selection when running against an Amazon S3 bucket

  Answered Raanan Dagan 6.3K views 17 comments 0 points Most recent by Raanan Dagan September 2023
• 
  Looking to enrich my data by doing a reverse ip lookup and setting that as the source

  Answered Jim Apger 9.2K views 18 comments 0 points Most recent by Shawn Cannon September 2023
• 
  What are the steps to backup an old Cribl instane?

  Answered Anson VanDoren 1.1K views 1 comment 0 points Most recent by Andrew Duca September 2023
• 
  Can you use __hecToken as a filter condition for the breaker?

  Answered Shawn Cannon 3.3K views 8 comments 0 points Most recent by SonOfBuzi September 2023
• 
  Is there any way we can get the logs in the timeperiod when the server is down?

  Answered dduke 3.5K views 7 comments 0 points Most recent by David Maislin September 2023
• 
  Has anyone had to backpressure a destination via Persistent Queue?

  Answered Kyle McCririe 2.2K views 4 comments 0 points Most recent by Clint Sharp September 2023
• 
  Does anyone have any instructions on how to update SSL certs using CLI?

  Answered Christopher Owen 12K views 20 comments 0 points Most recent by Raanan Dagan September 2023
• 
  Moved: Is there a way we can add our own edge node info?

  Closed Maliha Balala 1 view 0 comments 0 points Started by Maliha Balala September 2023
• 
  Is it possible in worker mappings to filter by CIDR, like conn_ip is in 10.0.0.0/24?

  Answered Megan Davis 2.5K views 4 comments 0 points Most recent by Jon Rust September 2023
• 
  is it recommended to do a json extract after the GeoIP function?

  Answered Josh Brunvoll 2.2K views 5 comments 0 points Most recent by Jon Rust September 2023
• 
  How can I have script collector to run every 30 seconds?

  Answered Martin Prado 4K views 6 comments 0 points Most recent by Jon Rust September 2023
• 
  Is setting up Cribl WEC/WEF the same that is used in Windows Events routed to a WEC server?

  Answered Franky Laarits 3.1K views 4 comments 0 points Most recent by Anson VanDoren September 2023
• 
  What is the best way to remove a JSON array from _raw JSON data and reserialize to _raw?

  Answered Shawn Cannon 5.1K views 14 comments 0 points Most recent by David Maislin September 2023
• 
  Is there any checkpoint mechanism in REST collector?

  Answered Chris Rogers 758 views 1 comment 0 points Most recent by David Maislin September 2023
• 
  Any idea how I can add a field with its value to an existing field?

  Answered Johan Woger 2.1K views 3 comments 0 points Most recent by David Maislin September 2023
• 
  Curious if anyone has a way to show splunk license utilization and cribl savings on the same chart?

  Answered Franky Laarits 5.8K views 7 comments 0 points Most recent by Franky Laarits September 2023
• 
  Can we limit the number of lines per event instead of the max bytes?

  Answered Joshua Napier 2.2K views 3 comments 0 points Most recent by xpac xpac September 2023
• 
  Is anyone aware of why the leader needs to restart in order for auth changes?

  Answered Gayathri Pandyaram 1.8K views 2 comments 0 points Most recent by dritan September 2023
• 
  Anyone know where the the Auth logs for Cribl Stream/Edge are located?

  Answered ✓ Gayathri Pandyaram 6.2K views 12 comments 0 points Most recent by Brandon McCombs September 2023
• 
  Data Enrichment on the fly using cribl stream with the enrichments are from a CSV lookup

  Answered Mina Yacoub 1.9K views 2 comments 0 points Most recent by Paul Hoffman September 2023
• 
  Getting Cribl to see the added data at the bottom of a CSV file

  Answered Jon Rust 8.5K views 15 comments 0 points Most recent by Jon Rust September 2023
• 
  Is there a way to use the API to `PATCH` a lookup table in a pack?

  Answered ✓ JP Bourget 9.4K views 15 comments 0 points Most recent by Eric Fontenot September 2023
• 
  I have a problem with some of the data coming into Cribl from Splunk

  Answered Jon Rust 8.4K views 16 comments 0 points Most recent by David Maislin September 2023
• 
  Is there a way to extract the key-value pair in the JSON object from the _raw field in the Pipeline?

  Answered alan y 4.8K views 13 comments 0 points Most recent by xpac xpac September 2023